Imunify360, CXS and CSF do not do the same job: Imunify360 is a complete security suite, CXS is a malicious code scanner and CSF is a firewall with intrusion detection. Chosen and deployed in the right order, they cover most incidents on a hosting server. This guide explains what each licence covers and how to combine them without leaving gaps.
Three complementary roles
- Imunify360: continuous protection (application firewall, antivirus, IP reputation, anti-bot).
- CXS: scanning of files already present (pirate scripts, backdoors, shells).
- CSF: network traffic control and brute-force attack blocking.
Imunify360: continuous protection
Imunify360 combines an application firewall, antivirus, intrusion detection, IP reputation and anti-bot protection, driven by machine learning. The suite integrates with cPanel and Plesk and relies on CloudLinux for some advanced protections, which is why the two licences are often paired. From the interface, you follow threats, infected files and blocked addresses.
CXS: finding what is already installed
CXS (ConfigServer eXploit Scanner) scans server files and detects pirate scripts, backdoors and shells dropped by a compromised website. It can scan files on upload and quarantine suspicious items. The cPanel extension lets you launch a full scan and review the results; a weekly scan is often enough on a stable server, while a daily scan is preferable on a heavily exposed one.
CSF: firewall and intrusion detection
CSF (ConfigServer Security and Firewall) manages iptables and ip6tables, with the LFD daemon blocking addresses after login failures. Before starting CSF, put it in test mode and add your own IP address to the allowlist: a bad setting can cut off SSH access. Also check the ports you actually use (SSH, HTTP, HTTPS, mail) before applying the configuration.
Deployment order and coexistence
- Enable CSF in test mode, review the rules, then move to production.
- Install CXS and run a first full scan.
- Deploy Imunify360 for continuous protection.
Avoid running two firewalls that rewrite iptables at the same time: either CSF or the Imunify360 firewall. If you keep CSF, disable firewall management on the Imunify360 side to avoid conflicts.
Monitor and react
Check logs and the quarantine list regularly, enable email notifications and make sure no false positive blocks a customer. On a shared server, warn the affected accounts before any cleanup, and keep a copy of isolated files before deleting them. Schedule full scans outside peak hours so that they do not slow down hosted websites.
