# Imunify Security Plugin for WordPress

# Overview

The Imunify Security plugin for WordPress is available to all Imunify customers (ImunifyAV, ImunifyAV+, and Imunify360). It provides WordPress administrators with a modern interface, real-time malware and security status, and a seamless upgrade path from AV to 360. The plugin is designed to enhance your website's security and user experience directly from the WordPress dashboard.

# Prerequisites

• WordPress Version: 5.0.0 or higher
• PHP Version: 5.6 or higher
• Imunify360: 8.4.1 or higher
• ImunifyAV/AV+: 8.6.0 or higher

# Installation

The plugin is not available in the WordPress plugin repository. To install:

1. Navigate to Imunify settings in your hosting control panel (e.g., cPanel).
2. Open the General tab.
3. Scroll to the WordPress Plugin section.
4. Tick the Install WordPress plugin checkbox and click Save changes.
5. The plugin will be installed in the background to all active WordPress installations on the server.

Plugin installation settings in the control panel

# Features

# Dashboard Widget

The plugin adds a dashboard widget that helps administrators keep track of their site's security status:

• Real-time security status
• Proactive Defense status
• Web Application Firewall status and recent WAF incidents (see Web Application Firewall)
• Bot Protection status and recent bot activity (see AI Bot Management)
• Timestamps for last and next scheduled scans
• Detailed list of detected and cleaned malware (file path, signature, detection or clean-up time)

Widget - no malware found

Widget - all malware cleaned

Widget - Imunify AV

Widget - Imunify not installed

# Notice

The plugin adds a notice to the WordPress admin dashboard for non-administrator users. This notice informs users about the security status of the website and provides a link to the Imunify360 dashboard for more information.

# Plugin Page

The plugin provides a dedicated page within the WordPress admin area where you can view more granular details about your website's security. Here, you can:

• See an overview of your site's protection status
• Access scan results and malware details
• Find recommendations for improving your site's security
• For ImunifyAV users, see information about upgrading to Imunify360 for additional features

Malware Scanner tab on the plugin page: view and manage detected threats.

Proactive Defense tab: monitor and configure proactive protection.

Malware Scanner as seen by ImunifyAV users.

# Upgrade Prompt

ImunifyAV users are shown a limited interface and prompted to upgrade to Imunify360 for full protection and advanced features.

Upgrade prompt encouraging users to switch to Imunify360 for more features.

# Web Application Firewall (Virtual Patching)

The Imunify Security plugin includes a Web Application Firewall (WAF) that provides virtual patching for WordPress. It protects your sites against known vulnerabilities (CVEs) in WordPress plugins, themes, and core — without modifying any of your site's files. When a plugin or theme you use has a known security flaw, the WAF blocks attempts to exploit it, giving you time to apply the real update.

# How it works

The Imunify agent regularly delivers an up-to-date set of virtual patches to each protected WordPress site. On every request, the plugin checks whether the request matches a rule for a component (plugin, theme, or core) that is actually installed on the site, and acts before the vulnerable code can run:

• In Imunify360, matching requests are blocked with an HTTP 403 response.
• In ImunifyAV and ImunifyAV+, matching requests are logged only — see Protection modes.

Every match is recorded as an incident. Because rules are matched only against the versions actually installed, protection adapts automatically as you install, update, or remove plugins and themes.

# Protection modes: Enabled vs Monitoring

The WAF works in one of two modes depending on your Imunify product. There is no manual switch — the mode follows the product:

In monitoring mode, the widget shows the message "Attacks are logged but not blocked. Upgrade to Imunify360 to enable full WAF protection." with an Upgrade now link.

# In the WordPress dashboard widget

The Imunify Security dashboard widget includes a Web Application Firewall row showing the current status (Enabled or Monitoring) and the number of recent incidents. Below it, a Latest incidents (7 days) table lists the most recent detections, together with the current ruleset version:

• Date — when the incident occurred
• Component — the vulnerable plugin, theme, or core
• CVE — the vulnerability the rule addresses
• Severity — severity of the rule
• Count — how many times it was triggered

Use Show more results to open the full incident list on the CMS WAF tab.

The Web Application Firewall row in the dashboard widget, showing Enabled with no recent detections (Imunify360).

When there are recent detections, the row shows the incident count (here, 34); expand it to see the Latest incidents (7 days) list.

In ImunifyAV and ImunifyAV+, the WAF runs in Monitoring mode with a prompt to upgrade.

# Managing WAF incidents

The CMS WAF tab in the Imunify control panel is where you review WAF activity and manage rules.

# Incidents

The Incidents sub-tab lists every request the WAF acted on:

You can filter incidents by date range and domain, or search by rule, description, or IP. Click a row to expand it and see the Sensor, Rule, Abuser (source IP), and Domain details.

The Incidents sub-tab on the CMS WAF tab.

# Disabling a rule

If a WAF rule interferes with legitimate traffic, you can disable it. On the Incidents sub-tab, click Disable rule for the incident and confirm in the dialog:

• By default, the rule is disabled for all of your domains.
• If you manage more than one WordPress site, you can instead pick specific domains from the Select domains list.

Click Yes, disable to confirm. The change may take a few minutes to take effect across your sites.

Disabling a WAF rule for all domains or for selected domains.

# Disabled Rules

The Disabled Rules sub-tab lists the rules you have turned off, showing the affected Component, Version, Rule, and Domains. To turn a rule back on, click Enable and confirm.

Re-enabling a previously disabled rule.

# Enabling or disabling the WAF

The WordPress WAF requires the Imunify Security plugin to be installed, and is controlled from Settings | General | WordPress plugin in the Imunify control panel:

• Server administrators enable or disable the WAF server-wide, and can choose whether it is on by default for new hosting accounts. See WordPress plugin settings and the command-line reference.
• Hosting-account owners can turn the WAF off for their own account, unless the administrator has locked it server-wide (shown as This value is set by server administrator).

# AI Bot Management

Imunify Security includes AI Bot Management — a layer that identifies automated traffic (search-engine crawlers, AI/LLM crawlers, scrapers, and malicious bots) before WordPress finishes loading and applies a per-minute request limit to each kind of bot, while leaving real visitors untouched. It protects sites from aggressive crawling and bot-driven resource abuse — increasingly from the wave of AI training and scraping crawlers — without slowing down legitimate users.

# How it works

The feature runs as a must-use plugin, so it evaluates each request before the rest of WordPress (and other plugins) load. For every request it:

1. Classifies the visitor into one category — a verified search engine, a verified AI crawler, an unknown automated client, an unverified bot, a malicious bot, or a human. Clients that claim to be a known crawler (for example, Googlebot) are confirmed by forward-confirmed reverse DNS, so a spoofed user-agent does not earn a crawler's higher limit.
2. Applies the category's limit. Each non-human category has a requests-per-minute allowance set by the active preset. Requests over the limit are refused with HTTP 429 (Too Many Requests) and a Retry-After hint; malicious bots are blocked outright with HTTP 403 (Forbidden). Clients that keep exceeding their limit can be escalated to a temporary block.

Human visitors are never rate-limited. The check is fail-open: if anything goes wrong (for example, the backing storage is unavailable), the request is allowed through, so the feature can never take a site down.

# Bot categories

# Protection presets

The active preset decides the per-minute limits. Balanced is the default.

• Balanced — sensible limits for a typical site. Recommended for most sites.
• Strict — tighter limits for sites under heavy bot pressure.
• Monitor only — classifies traffic but does not block or limit anything. Useful for trying the feature out before enforcing it.

# In the WordPress dashboard widget

Once your hosting provider has enabled AI Bot Management, the Imunify Security dashboard widget shows a Bot Protection row with the current status, the active preset, and the number of requests blocked in the last 24 hours.

The Imunify Security dashboard widget. The Bot Protection row shows the active preset and the number of requests blocked in the last 24 hours.

Click the row to open the detail pane, where you can:

• see the current Status and Blocked (24h) count;
• view the active preset and its live Rate limits (requests / minute) table, and switch preset with change → Save;
• turn protection off for this site — or back on.

The detail pane: status, the 24-hour blocked counter, the preset picker, and the per-category rate limits for the selected preset.

Only WordPress administrators (users who can manage options) can change these settings.

# Turning it on or off

AI Bot Management is controlled at three levels:

1. Hosting provider (server-wide). The provider enables the feature and sets the default preset. When it is off at the server level, the Bot Protection row does not appear. Providers control it from the command line — see the configuration file reference (ai_bot_protection, ai_bot_protection_preset) and the command-line reference.
2. Site owner (WordPress admin). Once the provider has enabled it, the WordPress administrator turns it on or off for their own site and chooses the preset from the Bot Protection widget.
3. wp-config.php (advanced). Definitions in wp-config.php override the widget:

// Force AI Bot Management off for this site (overrides the widget):
define( 'IMUNIFY_AI_BOT_PROTECTION', false );

// Force a specific preset (balanced | strict | monitor):
define( 'IMUNIFY_AI_BOT_PROTECTION_PRESET', 'strict' );

When AI Bot Management is disabled in wp-config.php, the widget shows Disabled in wp-config.php and the controls are locked.