The network firewall leverages our global threat intelligence network, which collects attack data from over 57 million domains worldwide. When an attack is detected on a server, the offending IP address is immediately blocked across the entire network, preventing the attacker from reaching any other server protected by Imunify. It blocks known malicious actors at the outer perimeter, before they can even attempt to exploit a vulnerability.

WebShield sits in front of web servers to detect and filter malicious traffic, including botnet attacks and Denial of Service (DoS) attempts. For suspicious traffic, it features our invisible JavaScript challenge, which effectively blocks automated bots while still allowing human visitors to pass through. It ensures server availability and prevents forced login attempts without frustrating legitimate users with traditional CAPTCHAs.

The Web Application Firewall (WAF) inspects incoming traffic to identify and block common web application attacks, such as SQL injection, cross-site scripting, and illegal resource access. It also provides a virtual patching system, blocking attempts to exploit known vulnerabilities in popular software (such as WordPress plugins) before an official patch is released or applied, thus protecting sites from compromise through their code.

Our comprehensive scanner performs real-time and on-demand scans of all files on your server for malware signatures, backdoors, and other threats. It also includes a database scanner, which scans the databases of popular CMS applications (WordPress, Joomla, and others) for infections, and scans malicious cron jobs, blocking a common backdoor used by attackers.

This is our unique real-time PHP script evaluation engine. It analyzes the behavior of PHP scripts as they run, identifying and blocking malicious activity before it can cause problems. It’s our answer to zero-day attacks, blocking even the latest and most unknown threats that traditional signature-based scanners would miss.

The IDS/IPS system constantly monitors server logs for suspicious activity, such as repeated failed login attempts. When it detects a pattern indicative of a brute-force attack or vulnerability exploitation, it automatically blocks the offending IP address, protecting all server services, not just websites.