How to Set Up Free ImunifyAV Email Notifications in WHM

ImunifyAV Free can detect malware, but getting a useful email for every scan path is not automatic. If you are searching for WHM ImunifyAV free email notifications because detections appear in the plugin without a clear alert, this guide shows a tested, hook-based setup for custom and user scans. It also explains the separate cPanel notification path that Imunify uses for generic panel messages.

TPP Web Solutions built and tested the two scripts below end to end on a live cPanel/WHM server. They turn ImunifyAV’s malware-found events into readable email alerts, prevent duplicate messages for the same scan ID, and require no paid script or service. You can review and download the open-source files on GitHub before installing anything.

What This ImunifyAV Alert Setup Does

• Sends a readable email when a custom scan reports malware through CUSTOM_SCAN_MALWARE_FOUND.
• Sends a readable email when a user scan reports malware through USER_SCAN_MALWARE_FOUND.
• Uses the WHM server contact address already stored in /etc/wwwacct.conf.
• Lists the affected path, detection count, scan type, scan ID, timestamps, and infected files supplied by the event.
• Uses a scan-ID-specific lockfile to prevent duplicate email for one event. Old lockfiles are removed automatically after 24 hours.

Imunify’s current documentation confirms that ImunifyAV and ImunifyAV+ can run custom scripts for notification events. It also notes that built-in email notifications in this interface are an Imunify360 feature. The script hook is what fills that specific gap for the free product. Review the official ImunifyAV notification-hook documentation.

What It Does Not Do

• It does not clean, quarantine, or repair an infected file.
• It does not replace ImunifyAV, your mail server, or WHM Contact Manager.
• It does not change how often ImunifyAV scans the server.
• It does not guarantee delivery if Exim, DNS, spam filtering, or the destination mailbox rejects the message.
• It does not make every Imunify notification path identical. Generic cPanel panel notifications use a separate iContact setting, covered below.

Requirements

• A cPanel/WHM server running ImunifyAV Free.
• Root-level access to WHM Terminal or an SSH session.
• Python 3 available on the server.
• A working server contact email address in WHM.

If you do not have root access or are not comfortable running server commands, stop here and contact your hosting provider or server administrator. Many managed hosts can complete these steps for you.

Before You Start: Check Both WHM Contact Paths

The hook scripts and cPanel’s generic notification channel do not use exactly the same configuration. Check both locations before troubleshooting the scripts.

1. In WHM, open Server Configuration > Basic WebHost Manager Setup. Under Contact Information, confirm the server contact field contains the address that should receive the hook-script messages. cPanel documents this as the address used when a problem arises with the server.
2. Open Server Contacts > Contact Manager. Under Communication Type, confirm Email has the correct address and that its “Receives” level includes High-priority notices.

See cPanel’s documentation for Basic WebHost Manager Setup and Contact Manager.

WHM Malware Alert Setup: Step by Step

1. Open WHM Terminal

Log in to WHM as root. Type Terminal into the WHM search box, then open Terminal under Server Configuration. The first visit may show a warning. Click “I understand and want to proceed” only if you are authorized to administer the server.

The Terminal opens as a dark command window. Follow this same process for every command in this guide:

1. Use the Copy button beside one command in this article.
2. Return to the WHM Terminal window and click once inside it.
3. Right-click inside the Terminal and choose Paste. Do not rely on Ctrl+V; it does not paste normally in many browser-based terminals.
4. Check that only the command was pasted, then press Enter once.
5. Wait until the command finishes and the Terminal shows a new prompt before copying the next command.

The prompt looks similar to [root@server ~]#. Never copy or type that prompt. Copy only the text inside each command box below.

2. Check for Existing Files

This read-only check reports whether either destination already exists:

if [ -e "/usr/local/bin/imunify-format.py" ] || [ -e "/usr/local/bin/imunify-mail-notify.sh" ]; then echo "STOP: an existing script file was found"; else echo "DONE: no existing script files found"; fi

Continue only if the Terminal prints DONE: no existing script files found. If it prints STOP, do not replace either file until the existing installation has been identified and backed up.

3. Download the Two Scripts

Run each download separately. A successful command prints a short DONE message. If you see an error or do not see DONE, stop before continuing.

curl -fsS -o /usr/local/bin/imunify-format.py https://raw.githubusercontent.com/tppweb/tpp-whm-imunify-alerts/refs/heads/main/imunify-format.py && echo "DONE: formatter downloaded"

curl -fsS -o /usr/local/bin/imunify-mail-notify.sh https://raw.githubusercontent.com/tppweb/tpp-whm-imunify-alerts/refs/heads/main/imunify-mail-notify.sh && echo "DONE: mail script downloaded"

4. Check the Downloaded Files

Confirm both files are text files and that the shell script does not report CRLF line endings:

file /usr/local/bin/imunify-format.py /usr/local/bin/imunify-mail-notify.sh

Then check the Python and shell syntax. Each successful check prints a DONE message.

python3 -c 'compile(open("/usr/local/bin/imunify-format.py", encoding="utf-8").read(), "/usr/local/bin/imunify-format.py", "exec")' && echo "DONE: Python syntax passed"

bash -n /usr/local/bin/imunify-mail-notify.sh && echo "DONE: shell syntax passed"

If the file result mentions CRLF line terminators, download the files again with curl or transfer them in binary mode. An FTP client’s automatic text mode can silently change Unix line endings and break the shell script.

5. Set Ownership and Permissions

Imunify’s hook runner uses the _imunify service account. The official documentation says the script must be executable and readable by that group.

chown root:_imunify /usr/local/bin/imunify-format.py /usr/local/bin/imunify-mail-notify.sh

chmod 750 /usr/local/bin/imunify-format.py /usr/local/bin/imunify-mail-notify.sh

Verify the result:

stat -c '%U:%G %a %n' /usr/local/bin/imunify-format.py /usr/local/bin/imunify-mail-notify.sh

Each line should begin with root:_imunify 750. Stop if either line shows a different owner, group, or permission number.

6. Register the Malware-Found Hooks

In WHM, open Plugins > ImunifyAV > Settings > Notifications. Enable script execution for these two events and enter the full path /usr/local/bin/imunify-mail-notify.sh for each:

• Custom scan: malware detected, or CUSTOM_SCAN_MALWARE_FOUND
• User scan: malware detected, or USER_SCAN_MALWARE_FOUND

Remain on the Notifications page and confirm that both switches are enabled and both fields show the exact script path. This avoids printing ImunifyAV’s full notification configuration in Terminal.

7. Check the Separate cPanel Panel-Notification Path

Imunify can also send generic panel notifications through cPanel’s native iContact system. Current Imunify documentation says this path is available to ImunifyAV and does not require an add-on license. It is separate from the two malware-found hook emails above.

Enable the documented administrator iContact setting:

imunify-antivirus config update '{"ADMIN_CONTACTS": {"enable_icontact_notifications": true}}' >/dev/null && echo "DONE: panel notifications enabled"

Then read the current WHM importance for Imunify’s generic event:

whmapi1 get_application_contact_event_importance app=Imunify event=Generic

If the result is Low or Disabled and you want these messages sent at the High level, make that specific change:

whmapi1 set_application_contact_event_importance app=Imunify event=Generic importance=High >/dev/null && echo "DONE: notification priority set to High"

Run the read command again to verify the setting. The Imunify panel-notification documentation and cPanel notification API documentation describe these controls.

Version-specific note: the project server also exposed a MALWARE_SCANNING.notify_on_detect key. The current public ImunifyAV configuration reference does not document that key, so this guide does not tell every reader to change it. If scheduled-scan detections remain silent, check the configuration available in your installed version and confirm the correct setting with Imunify support.

Test the Alert With the EICAR File

Do not wait for a real infection to test the setup. EICAR publishes a harmless antivirus test file that security products intentionally detect as if it were malware. It contains no malicious code. Read the official EICAR test-file explanation before continuing if you are unfamiliar with it.

1. Choose the Test Account

In a separate WHM tab, open Account Information > List Accounts. Choose one non-critical cPanel account for this test and note the value in its Username column. You will type that username into Terminal in the next step. You do not need Notepad, and you do not need to edit any command.

2. Enter the Username in Terminal

Copy and run the command below. After you press Enter, the Terminal displays a question and waits.

read -r -p "Type the cPanel username, then press Enter: " TPP_TEST_ACCOUNT

Type only the cPanel username you copied from WHM, then press Enter. The username is now saved temporarily in this Terminal session.

Run this check next:

if [ -d "/home/$TPP_TEST_ACCOUNT" ]; then echo "DONE: account confirmed: $TPP_TEST_ACCOUNT"; else echo "STOP: account not found"; fi

Continue only if the Terminal prints DONE followed by the correct username. If it prints STOP, repeat the username command and enter the correct value. Keep this Terminal session open for the remaining test. If you close or reconnect it, repeat this username step.

3. Download the EICAR Test File

Run the following command. You do not need to change any part of it because the Terminal already saved the username.

curl -fsS -o "/home/$TPP_TEST_ACCOUNT/eicar-test.txt" https://secure.eicar.org/eicar.com.txt && echo "DONE: EICAR test file downloaded"

Continue only if the Terminal prints DONE: EICAR test file downloaded.

4. Start the ImunifyAV Scan

Run this command to start a scan of that one test file:

imunify-antivirus malware on-demand start --path "/home/$TPP_TEST_ACCOUNT/eicar-test.txt" >/dev/null && echo "DONE: ImunifyAV scan started"

After the DONE message appears, wait for the scan and email processing to finish. You do not need to run another Terminal status command.

In WHM, open Plugins > ImunifyAV. On the ImunifyAV page, click the Malicious link. The EICAR result may not appear on the first ImunifyAV screen even though ImunifyAV detected it. In the Malicious list, find the entry for /home/your-username/eicar-test.txt. Its detection name should contain eicar; the rest of the signature name may vary by version.

Confirm three things: the EICAR entry appears under Malicious, one email arrives, and the email lists the same test-file path.

5. Remove the EICAR Test File

After confirming the result, run this cleanup command in the same Terminal session:

if [ -z "$TPP_TEST_ACCOUNT" ]; then echo "STOP: repeat the username step"; else rm -f -- "/home/$TPP_TEST_ACCOUNT/eicar-test.txt" && echo "DONE: EICAR test file removed"; fi

The detection may remain visible in ImunifyAV’s history after the file is removed. That record is harmless and does not need to be cleared to finish the test.

The script’s duplicate-prevention lockfile is unrelated to the EICAR file. It is unique to the scan ID and is removed automatically after 24 hours, so no manual lockfile cleanup is needed.

If the Email Does Not Arrive

1. Recheck both WHM email locations described above.
2. Confirm the two notification rules are enabled and use the full script path.
3. Confirm both files are owned by root:_imunify with mode 750.
4. Run the Python and Bash syntax checks again.
5. Confirm the shell file does not contain CRLF line endings.
6. Check WHM’s event importance and the Email “Receives” threshold.
7. Check the server’s mail logs and the destination spam folder. A successful hook does not prove external mail delivery.

Download the Free ImunifyAV Notification Scripts

The source, setup notes, and change history are available in the public TPP WHM Imunify Alerts repository. Review both files, download them, and follow the checks above before trusting the alert path on a production server.

If the scripts behave differently on another cPanel or ImunifyAV version, leave a GitHub issue or a comment below with the product version and the exact event you tested. That kind of detail makes the project more useful without competing with the page’s separate email-subscription popup.