PHP Immunity + Proactive Defense

Proactive Defense is one of the core pieces of our security measures. It is part of Imunify360 and its purpose is to provide a layer of protection on the application itself.

To simplify the process: when someone accesses an application or website, the first line of defence is the network firewall. It detects the IP the connection comes from, evaluates its reputation and, if it may be a bot or malicious agent, decides whether to block it or put it through additional checks, such as a captcha test.

After this initial filtering, checks are run at web server level: an engine analyses the request and, based on a library of rules, blocks requests intended to breach the application's security.

These two layers are essential, but Proactive Defense takes security to the next level: it analyses the code as it runs.

Imagine an attacker managed to get past the first two layers and injected malicious code into the index.php file of a WordPress website. At this point the website is compromised, and when a visitor arrives, the malicious code will run.

With Proactive Defense this code doesn't run: the security system blocks the process, preventing the consequences of the tampering from affecting visitors and the domain's reputation.

Proactive Defense has been in production and active for all accounts for about a year. What's new is PHP Immunity.

PHP Immunity can dynamically detect unknown malware and malicious code not yet in the Proactive Defense database, automatically learning from each new unknown infection, without waiting for the Proactive Defense malware database to be updated. This method prevents the dreaded zero-day attacks.

It doesn't just detect and stop them: it also automatically cleans the malware from the affected files, removing the infection and preventing it from happening again, so the website or app keeps working as if nothing had happened.