Panellicense

Submit Imunify360 malware scanner false positives

Use the in-product submit flow (v6.7.3+) or the support form to get a clean file de-listed and prevent re-flagging across servers.

4 min readUpdated 2026-05-16malware · false-positive · submission · scanner
schema: HowToschema: FAQPage

When the Imunify360 malware scanner flags a file that you've verified is clean — a minified CDN library, a custom WordPress plugin, an obfuscated-but-legitimate JS — a local whitelist gets you running again. Submitting the file upstream is what stops the same file being re-flagged on every other Imunify-protected server, including yours after the next signature update.

Two paths exist: the in-product submit flow (added in agent 6.7.3) and the support form. Use the in-product one whenever you can — it's faster and the scan engine team sees the file with full context.

Submit from the UI

In WHM (or Plesk), go to Imunify360 → Malware Scanner → History. Find the flagged file, open the row, and click Submit false positive. Add a sentence about what the file is — "minified version of XYZ library v1.2.3, official source: github.com/..." — and submit. The agent uploads the file content and the matched signature ID to TuxCare.

If the Submit false positive button is missing, your agent is below 6.7.3. Check:

imunify360-agent --version

Upgrade with yum update imunify360-firewall if you're behind. The submission flow lives in the agent, not the panel, so even Plesk hosts get it after upgrade.

Submit from the CLI

The same flow exists as a CLI command, useful for scripting or when the panel is offline:

imunify360-agent submit false-positive --path /home/user/public_html/wp-content/plugins/custom/file.php

The agent prints a submission ID. You can chase it later via the support portal if you don't hear back within 48 hours.

Submit via the support form

For older agents, or when the file has already been quarantined and moved out of its original path, use the cloudlinux.zendesk.com support form. Attach:

  • The original file (zip it if the panel strips PHP/JS).
  • The signature ID that flagged it — visible in the Imunify360 incident detail view.
  • The full path on the server.
  • A one-line explanation of what the file is and why it's legitimate.

Submissions without the signature ID get bounced back asking for it. Save yourself the round trip — grab it from the UI before opening the ticket.

What happens next

TuxCare's malware team reviews the submission, typically within 24-48 hours. If they agree the file is clean, the signature is updated in the global database. On the next signature pull (the agent refreshes every few hours by default), the file stops being flagged across every Imunify-protected server worldwide — not just yours.

The rescan on your specific server happens on the next scheduled scan cycle, or trigger it manually:

imunify360-agent malware on-demand start --path /home/user/public_html

Whitelist locally while you wait

The 24-48 hour cycle is too slow if a customer is in the middle of a support escalation. Whitelist locally so the file is ignored by future scans on this server:

imunify360-agent malware ignore list add /home/user/public_html/wp-content/plugins/custom/file.php

The local ignore list survives signature updates. Once the upstream signature is fixed, remove the local entry to make sure the next genuine match on that path isn't silently ignored:

imunify360-agent malware ignore list delete /home/user/public_html/wp-content/plugins/custom/file.php

When the file really is malicious

If you're submitting because a customer insists the file is clean but you have any doubt, don't whitelist first and submit later. Quarantine the file, get a second opinion (VirusTotal, your own analysis), and only then decide. The TuxCare team is good but they trust the submitter's framing — if you tell them it's clean, they'll prioritise that signal.

A common pattern: heavily obfuscated JavaScript on a customer site that the customer swears is from their developer. Nine times out of ten it's a real backdoor. Get the developer to provide the original, unobfuscated source before submitting.

How do I submit a false positive to Imunify360?+
From the WHM UI under Malware Scanner → History, click 'Submit false positive' on the flagged row (agent 6.7.3+). Or run `imunify360-agent submit false-positive --path /full/path/to/file` from the CLI.
How long until Imunify360 stops re-flagging my file?+
TuxCare typically reviews submissions in 24-48 hours. Once they update the signature, every Imunify-protected server worldwide gets the fix on the next signature refresh (a few hours).
How do I whitelist a file locally on one server only?+
`imunify360-agent malware ignore list add /path/to/file` — that file is excluded from future scans on this server. Remove it later with `ignore list delete` once the upstream signature is fixed.
What information do I need to attach to a false-positive ticket?+
The file itself (zipped if needed), the signature ID that matched, the full server path, and a one-line explanation of what the file is. Tickets without the signature ID get bounced back.

Next steps

Related articles

All tutorials & how-tos →
how to
Set up JetBackup 5 deduplication backups to cut storage cost
JetBackup 5.4 added a deduplication backup structure that fingerprints data in chunks and stores each unique chunk once — here's how it works, where it pays off, and how to turn it on.
6 min read
how to
Plesk 360 setup guide for centralized licenses and monitoring
Plesk 360 is the SaaS control plane for everyone running more than one Plesk box — license management, uptime monitoring, and SSO into every panel from one dashboard.
7 min read
how to
Use the Plesk REST API with reseller and customer accounts
Plesk Obsidian 18.0.79 opens the REST API to reseller and customer accounts and adds file, log, and impersonation endpoints — how to authenticate and use them.
7 min read
Switch in an afternoon

Switch from your current reseller — free.

We migrate active cPanel, Plesk, LiteSpeed and CloudLinux licenses from any reseller. We prorate the first month so you never pay twice, and your customers see zero downtime during the swap.