The network firewall leverages our global threat intelligence network, which collects attack data from over 57 million domains worldwide. When an attack is detected on one server, the offending IP is immediately blocked across the entire network, preventing that attacker from reaching any other server protected by Imunify. It stops known bad actors at the outermost perimeter before they can even attempt to exploit a vulnerability.

WebShield sits in front of web servers to detect and filter malicious traffic, including botnet attacks and Denial of Service (DoS) attempts. For suspicious traffic, it presents our invisible JavaScript challenge, which effectively blocks automated bots while remaining passthrough for human visitors. It ensures server availability and prevents brute-force login attempts without frustrating legitimate users with traditional CAPTCHAs.

The WAF inspects incoming traffic to identify and block common web application attacks like SQL injections, cross-site scripting, and illegal resource access. It also provides virtual patching by blocking attempts to exploit known vulnerabilities in popular software (like WordPress plugins) before an official patch is released or can be applied, protecting sites from being compromised through their own code.

Our comprehensive scanner performs real-time and on-demand scanning of all files on the server for malware signatures, backdoors, and other threats. It also includes a database scanner, which inspects the databases of popular CMS applications (WordPress, Joomla, and more) to find infections, and it scans for malicious cron jobs, closing a common backdoor used by attackers.

This is our signature real-time PHP script evaluation engine. It analyzes what PHP scripts are doing as they execute, identifying and blocking malicious behavior before it can cause harm. This is our answer to zero-day attacks as it stops even brand-new, unknown threats that traditional signature-based scanners would otherwise miss.

The IDS/IPS continuously monitors server logs for signs of suspicious activity, such as repeated failed login attempts. When it detects a pattern that indicates a brute-force attack or an exploit attempt, it automatically blocks the offending IP address, protecting all server services, not just websites