# Hosting Provider Guide

# Overview

The Imunify Security plugin for WordPress brings the protection your Imunify product already provides into the WordPress dashboard of every site on your servers. It is available to all Imunify customers (ImunifyAV, ImunifyAV+, and Imunify360).

For your customers, the plugin:

• shows the security status of their site, including malware detected and cleaned;
• adds a Web Application Firewall (virtual patching) that blocks attempts to exploit known vulnerabilities in plugins, themes, and WordPress core;
• adds AI Bot Management, which rate-limits crawlers, scrapers, and AI bots;
• gives ImunifyAV and ImunifyAV+ users an upgrade path to Imunify360.

The plugin is not published in the WordPress.org plugin directory. It is delivered and updated by the Imunify agent on the server.

For what your customers see and can change themselves, send them to the Site Owner Guide.

# Requirements

On each WordPress site:

• WordPress version: 5.0.0 or higher
• PHP version: 5.6 or higher

On the server:

• Imunify360 8.4.1 or higher, or
• ImunifyAV/AV+ 8.6.0 or higher

Individual features need newer versions of both the plugin and the Imunify agent:

The plugin is updated by the Imunify agent, so keeping the agent current is enough.

# Installing the plugin

Installation is a single server-wide switch. Once it is on, the plugin is installed in the background on every active WordPress installation on the server, and new WordPress sites are picked up by the daily job that scans for them.

# From the control panel

1. Navigate to Imunify settings in your hosting control panel (e.g., cPanel).
2. Open the General tab.
3. Scroll to the WordPress Plugin section.
4. Tick the Install WordPress plugin checkbox and click Save changes.

Plugin installation settings in the control panel

# From the command line

imunify360-agent config update '{"WORDPRESS":{"security_plugin_enabled": true}}'

On ImunifyAV and ImunifyAV+, use imunify-antivirus instead of imunify360-agent.

security_plugin_enabled is the master switch for the plugin, its Web Application Firewall, and AI Bot Management. Setting it to false removes the plugin from the sites again.

See also WordPress plugin settings in the admin interface.

# Checking the result

After a rollout, list the WordPress sites where the plugin is installed:

imunify360-agent wordpress-plugin list-sites

To check whether the WAF is on for each hosting account, and whether that comes from the server default or a per-account override:

imunify360-agent wordpress-plugin waf status

Both commands accept filters and paging — see the command-line reference.

# When a site owner removes the plugin

A site owner can delete the plugin from their WordPress site like any other plugin. A daily job then records the site as removed by the user, cleans up the data kept for it, and stops managing it. The server does not install the plugin on that site again, and turning security_plugin_enabled off and on again does not bring it back.

To put the plugin back on such a site, contact Imunify support for the steps. A command for this is planned for a future release.

# Web Application Firewall

The WordPress WAF provides virtual patching against known vulnerabilities (CVEs) in WordPress plugins, themes, and core, without modifying site files. In Imunify360 matching requests are blocked with HTTP 403; in ImunifyAV and ImunifyAV+ they are logged only.

For how the WAF works and how site owners review incidents and disable individual rules, see Web Application Firewall (Virtual Patching).

# Server-wide settings

In the control panel, the WAF is controlled from Settings | General | WordPress plugin:

• Enable WordPress WAF — turns the WAF on for WordPress sites on this server. When it is disabled, WAF rules are removed from all sites, and site owners no longer see the WAF views in WordPress.
• Enable WAF for new accounts by default — automatically enables the WAF for newly created hosting accounts.

The same settings from the command line:

imunify360-agent config update '{"WORDPRESS":{"waf_enabled": true}}'
imunify360-agent config update '{"WORDPRESS":{"waf_default": true}}'

# Per-account settings

Change the WAF for hosting accounts in bulk:

imunify360-agent wordpress-plugin waf set --status enabled --all-users
imunify360-agent wordpress-plugin waf set --status disabled --users user1 user2

Or for a single account:

imunify360-agent config update --user user1 '{"WORDPRESS":{"waf_enabled": false}}'

For all options, and for enabling or disabling individual WAF rules server-side, see the WordPress plugin CLI commands.

# AI Bot Management

AI Bot Management classifies incoming traffic (verified search engines, verified AI crawlers, unknown automated clients, unverified bots, malicious bots, and humans) before WordPress finishes loading, and applies a per-minute request limit to each non-human category. Human visitors are never rate-limited, and the check is fail-open.

For the categories, the preset limits, and what site owners see, see AI Bot Management.

# Server-wide settings

AI Bot Management is controlled through configuration keys rather than the control panel. Enable or disable it server-wide:

imunify360-agent config update '{"WORDPRESS":{"ai_bot_protection": true}}'
imunify360-agent config update '{"WORDPRESS":{"ai_bot_protection": false}}'

Set the default preset applied to sites that have not chosen their own — one of balanced, strict, or monitor:

imunify360-agent config update '{"WORDPRESS":{"ai_bot_protection_preset": "strict"}}'

While the feature is off server-wide, the Bot Protection row does not appear in the WordPress dashboard widget.

# Per-site control

AI Bot Management is a server-wide setting. Unlike the WAF, it cannot be enabled or disabled for a single hosting account. Once it is on for the server, control belongs to the site:

• the WordPress administrator turns it on or off for their own site, and picks a preset, from the Bot Protection row of the dashboard widget;
• setting IMUNIFY_AI_BOT_PROTECTION or IMUNIFY_AI_BOT_PROTECTION_PRESET in the wp-config.php file overrides the widget.

See Turning it on or off.

# What site owners can change

Site owners can solve most common problems themselves. The Site Owner Guide covers them in Something is not working. What can I do? — blocked traffic, a WAF false positive, and Bot Protection refusing a tool they use. You can link to it from your own help pages.

# Reference

• WordPress plugin settings in the admin interface
• WordPress plugin CLI commands
• Configuration file: WORDPRESS section
• Site Owner Guide