Imunify AV vs AV+ vs Imunify360: which tier your fleet needs

TuxCare sells Imunify as a family of three: Imunify AV (free), Imunify AV+ (paid, malware only), and Imunify360 (paid, the full security stack). The pricing gap between AV+ and 360 is roughly 4×, and the marketing pages do not make it obvious where the line actually sits — so a lot of hosts buy AV+ thinking they have "Imunify lite" and discover after the first WordPress incident that the WAF, brute-force protection, and reputation feed are all locked behind 360.

This article draws the line. What each tier really protects against, where they overlap, the workloads where AV+ is genuinely enough, and the cases where Imunify360 is the only choice that ends well.

What each tier actually does

Imunify AV (free)

A malware scanner with a web UI. It scans /home/*/public_html on a schedule, ships a cleanup engine, and surfaces detections in WHM and inside each cPanel account. The detection engine is the same MRS (Malware Research Signatures) database that AV+ and 360 use — what's missing is automatic action. AV will tell you a file is infected. AV+ and 360 will fix it.

There is no real-time on-write scanning, no WAF, no brute-force protection, no IP reputation, no proactive defence. It is a periodic scanner. If a customer's WordPress is compromised on Tuesday, AV will flag it on Wednesday's scan and email you.

Imunify AV+

Everything AV does, plus:

• Automatic malware cleanup. Detected files are cleaned in place — surgical patching of known infection patterns rather than quarantine. The original file is preserved in /var/imunify/cleanup-storage/ for rollback.
• Real-time scanning of new and modified files. A kernel-level inotify hook scans every file written into /home, so an infection is caught at upload time rather than on the next scheduled pass.
• Per-customer email notifications. End users see "your account had malware, it was cleaned" rather than discovering it through your support team.

AV+ is still malware-only. No WAF, no brute-force, no behavioural defence.

Imunify360

Everything AV+ does, plus the entire perimeter and runtime stack:

• WAF with the Comodo ruleset and Imunify's own virtual-patching rules for known CMS CVEs. Drops SQL injection, XSS, RCE, LFI attempts before they reach PHP.
• Brute-force protection for cPanel, WHM, SSH, FTP, Dovecot/IMAP, Exim, WordPress wp-login.php, and Joomla admin. Failed logins move IPs into greylist then blocklist.
• GreyList with captcha challenge — IPs flagged as suspicious are not blocked, they're shown a captcha. Legitimate users pass, bots fail. This is the difference between a support ticket every time someone logs in from a hotel WiFi and a clean inbox.
• TuxCare-managed IP reputation feed. Known bad actors are blocked before they touch your server, fed by attack data across the entire Imunify fleet.
• Proactive Defense — a runtime PHP shield that blocks malicious behaviour at execution time, catching infections that signature scanners miss. See Imunify360 Proactive Defense and the PHP shield for the runtime detail.
• Webshield — captcha and bot mitigation in front of HTTP requests, not just logins.
• KernelCare integration hooks when you also run KernelCare for live kernel patching.

Feature comparison

Where the line between AV+ and 360 matters most

WAF and virtual patching

This is the single biggest reason to buy 360 instead of AV+. AV+ catches an infected file after it's on disk. The WAF catches the request that would have written the file in the first place. For any server hosting WordPress, Joomla, Drupal, or Magento — which is most shared hosting — the WAF is doing real work every day, stopping exploit attempts you'd otherwise only see in the access log post-mortem.

Virtual patching takes this further: Imunify ships ModSecurity rules that block exploitation of specific CVEs, including ones in CMS plugins that customers may never update. The plugin stays vulnerable; the exploit stops at the WAF. For unmanaged shared hosting where you cannot force customers to update, this is the difference between an incident every month and none.

Brute-force protection at the panel level

wp-login.php brute-force is the most common attack on shared hosting full stop. AV+ does nothing about it. 360 detects credential-stuffing patterns and greylists the source IP across the whole server, so an attacker hitting account-A also gets blocked from account-B. With AV+ you would need to wire CSF, Fail2ban, or WHM's cPHulk brute-force daemon yourself, then keep them in sync with your firewall rules indefinitely.

GreyList + captcha is the support-load multiplier

A naive block-on-bad-reputation system creates support tickets every time a real customer logs in from an airport, a coffee shop, or a new mobile network. Imunify360's GreyList shows those users a captcha instead. They pass it, they're in, and your support team never hears about it. This single feature is why hosts who try AV+ at scale almost always switch to 360 within a quarter.

Proactive Defense is what catches the cleanup gap

Malware scanners — including Imunify AV+ — work on signatures. New infections evade signatures for hours to days. Proactive Defense watches PHP execution and blocks calls that match malicious behavioural patterns (writing executables to /tmp, exfiltrating mail relay credentials, calling eval() on decoded base64 from $_POST, etc.) regardless of whether the file has been seen before. This is the 0-day net.

Where AV+ is genuinely enough

There are real scenarios. AV+ is sufficient when:

• The server hosts no PHP execution. Static-site hosting, mail-only servers, FTP archives. Without PHP there is no WAF surface to defend, and brute-force protection on SSH/FTP can be handled by sshd config and firewall.
• Single-tenant dedicated server with a managed application. If you run one enterprise app, the perimeter is locked down at the load balancer or upstream WAF (Cloudflare, AWS WAF, ModSecurity in nginx). Imunify360's perimeter features duplicate what's already there; AV+ for malware detection on uploads is enough.
• Compliance-driven antivirus requirement only. PCI-DSS shared hosting environments sometimes need a documented antivirus engine for audit; AV+ ticks the box without buying the whole stack.

If your fleet doesn't fit one of those, you almost certainly want 360.

Pricing: what you actually pay

All three are priced per-server, not per-account or per-domain — a 5,000-account shared host pays the same per-server rate as a 50-account VPS, within the same server-class tier.

The pricing tiers differ across product:

• Imunify AV — free, no licence required, install with a one-line script.
• Imunify AV+ — single monthly fee per server, the same regardless of server size.
• Imunify360 — tiered by server class. Shared-hosting (cPanel/Plesk box, hundreds of accounts) is one rate; VPS is roughly half; dedicated server with no panel is the enterprise rate. See current numbers on the Imunify360 activation page.

Worked example for a 50-server cPanel fleet at shared rates: 360 runs roughly 4× the AV+ rate per box. For 50 servers and rough industry pricing, that's a few hundred dollars per month of difference — usually less than the cost of one customer's WordPress incident including the operator's time to clean up, restore from backup, and respond to the support tickets it generates.

What none of them do

It's worth being explicit about the limits. Imunify, at any tier, does not:

• Filter inbound or outbound email spam. That's the job of Imunify Email Security (a separate SKU) or a third-party gateway like SpamExperts or MailScanner.
• Provide DDoS protection at the network edge. A volumetric flood saturates your uplink before Imunify sees a single packet. Cloudflare, AWS Shield, or your DC's scrubbing service do that job — see running Imunify360 behind Cloudflare for the integration detail.
• Patch the Linux kernel. A kernel CVE exploited from inside a CageFS jail still owns the host. That's KernelCare's job.
• Replace a backup strategy. Imunify cleans known infections in place. For everything else — ransomware, accidental deletion, customer mistakes — you still need JetBackup with immutable offsite storage.

A defence-in-depth posture for a 2026 shared host is roughly: Imunify360 + KernelCare + JetBackup (or R1Soft) with Object Lock + an upstream CDN/WAF for DDoS. AV or AV+ alone addresses one quarter of that picture.

How to decide

Three questions in order:

1. Does this server run PHP code from end users? If yes, you need the WAF — Imunify360.
2. Does this server have a panel login exposed to the internet? If yes, you need brute-force protection — Imunify360.
3. If neither, do you need automatic malware cleanup or just detection? Cleanup → AV+. Detection only → AV (free).

For mixed fleets, standardise on Imunify360 across shared and VPS hosts and use AV+ only for the niche servers above. Mixed Imunify SKUs across your fleet make the support runbook harder than the savings justify.

FAQ

Next steps

• Get started with the Imunify360 install walkthrough for cPanel and activate via the Imunify360 license page
• Tune the defaults using Imunify360 WAF false-positive tuning
• Pair with KernelCare for kernel-level patching to close the kernel-CVE gap that no antivirus product addresses