Automating Imunify360 Feature Upgrades & Malware Scan Reports in WHMCS: A Step‑by‑Step Guide

Keeping web servers secure and up‑to‑date is a top priority for any hosting provider. When you combine WHMCS—a powerful billing and automation platform—with Imunify360, the leading security suite for Linux servers, you get a robust solution that protects customers while simplifying your workflow. However, manually updating Imunify360 features and pulling malware‑scan reports quickly becomes a time sink as your client base grows.

Why Automate Imunify360 in WHMCS?

Automation delivers three core benefits:

• Consistency: Every server receives the same updates at the same time, eliminating human error.
• Efficiency: Technicians can focus on higher‑value tasks instead of repetitive clicks.
• Customer transparency: Automated scan reports are delivered directly to clients, building trust and reducing support tickets.

In this guide we’ll walk through automating Imunify360 feature upgrades and generating malware‑scan reports within WHMCS. By the end you’ll have a reliable, hands‑off system that keeps your infrastructure secure and your clients informed.

Prerequisites

1. WHMCS version

Run WHMCS 8.0 or later. Older versions lack the API endpoints required for seamless integration.

2. Imunify360 license

A valid Imunify360 license must be installed on each server you manage. The automation scripts call the imunify360-agent CLI, which requires an active license.

3. Server access

Root SSH access (or sudo privileges) is essential for installing the automation script and scheduling cron jobs.

4. WHMCS API credentials

Create an API user with the following permissions:

• Products/Services → View
• Orders → View
• Tickets → View (if you plan to attach reports to tickets)

Record the API identifier and secret; you’ll need them for the PHP scripts.

Setting Up the Automation Script

1. Create a central PHP wrapper

Save the file below in a secure location on your WHMCS server (for example /usr/local/whmcs/imunify360_automation.php):

<?php
// Load WHMCS bootstrap
require __DIR__ . '/../../init.php';
require_once __DIR__ . '/../../includes/functions.php';
require_once __DIR__ . '/../../includes/clientfunctions.php';

// ---------------------------------------------------------------------
// Configuration – keep this file out of the web root and protect it!
// ---------------------------------------------------------------------
$apiUser   = 'automation_user';
$apiSecret = 'YOUR_API_SECRET';
$apiUrl    = 'https://yourwhmcs.com/includes/api.php';

// ---------------------------------------------------------------------
// Helper: call WHMCS API
// ---------------------------------------------------------------------
function whmcs_api(string $action, array $params = []): array
{
    global $apiUser, $apiSecret, $apiUrl;

    $postFields = array_merge(
        ['action' => $action, 'username' => $apiUser, 'password' => md5($apiSecret)],
        $params
    );

    $ch = curl_init($apiUrl);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($postFields));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    curl_close($ch);

    return json_decode($response, true) ?? ['result' => 'error', 'message' => 'Invalid JSON'];
}

// ---------------------------------------------------------------------
// 1. Retrieve all active services that use Imunify360
// ---------------------------------------------------------------------
$services = whmcs_api('GetClientsProducts', ['status' => 'Active']);
if ($services['result'] !== 'success') {
    exit('Failed to retrieve services: ' . ($services['message'] ?? 'unknown'));
}

// ---------------------------------------------------------------------
// 2. Process each service
// ---------------------------------------------------------------------
foreach ($services['products']['product'] as $service) {
    $serverId  = $service['serverid'];
    $serviceId = $service['id'];

    // Get server details
    $server = whmcs_api('GetServers', ['serverid' => $serverId]);
    if ($server['result'] !== 'success') {
        continue; // skip if we cannot fetch server info
    }

    $hostname = $server['servers']['server']['hostname'];
    $sshUser  = $server['servers']['server']['username']; // usually root
    $sshKey   = '/path/to/ssh_private_key';

    // Build base SSH command
    $sshBase = "ssh -i {$sshKey} -o ConnectTimeout=10 {$sshUser}@{$hostname}";

    // a) Upgrade Imunify360
    $upgradeCmd = "{$sshBase} 'imunify360-agent upgrade && imunify360-agent update'";
    exec($upgradeCmd, $upgradeOut, $upgradeRet);

    // b) Run a full malware scan (JSON output)
    $scanCmd = "{$sshBase} 'imunify360-agent scan --output json'";
    exec($scanCmd, $scanOut, $scanRet);
    $scanResult = implode("\n", $scanOut);

    // -----------------------------------------------------------------
    // 3. Store scan result as a WHMCS ticket (optional)
    // -----------------------------------------------------------------
    $ticketParams = [
        'deptid'   => 1, // Support department ID
        'subject'  => "Imunify360 Scan Report for Service #{$serviceId}",
        'message'  => "
{$scanResult}
",
        'clientid' => $service['userid'],
        'priority' => 'Low',
        'status'   => 'Closed',
    ];
    whmcs_api('OpenTicket', $ticketParams);

    // -----------------------------------------------------------------
    // 4. Log activity
    // -----------------------------------------------------------------
    $logLine = sprintf(
        "[%s] Service %d on %s – upgrade:%d, scan:%d\n",
        date('Y-m-d H:i:s'),
        $serviceId,
        $hostname,
        $upgradeRet,
        $scanRet
    );
    file_put_contents('/var/log/imunify360_automation.log', $logLine, FILE_APPEND);
}
?>

The script performs the following actions for each active Imunify360‑enabled service:

1. Connects to the server via SSH.
2. Runs the Imunify360 upgrade command.
3. Executes a full malware scan, captures the JSON output, and creates a closed ticket in WHMCS containing the report.
4. Writes a concise entry to a log file for auditing.

2. Secure the script

• Set permissions to 600 and ownership to root.
• Store the API secret in a separate, non‑web‑accessible configuration file and include it.
• Use SSH keys without passphrases that are dedicated solely to WHMCS automation.

3. Schedule the cron job

Add the following line to the WHMCS server’s crontab (run as root or the WHMCS system user):

0 2 * * * /usr/bin/php /usr/local/whmcs/imunify360_automation.php >/dev/null 2>&1

This runs the script daily at 02:00 AM, a low‑traffic window ideal for upgrades and scans.

Delivering Scan Reports Directly to Clients

Email notifications

If you prefer email over tickets, replace the $ticketParams block with a call to the SendEmail API action:

$emailParams = [
    'messagename'   => 'Imunify360 Scan Report',
    'id'            => $service['userid'],
    'customsubject' => 'Your Imunify360 Scan Report',
    'custommessage' => "Hello {firstname},\n\nPlease find below the latest malware scan for your server.\n\n
{$scanResult}
\n\nBest regards,\nSupport Team",
];
whmcs_api('SendEmail', $emailParams);

Client‑area integration

For a seamless experience, create a custom WHMCS client‑area page that pulls the latest scan JSON from a database table. Extend the script to insert the JSON into a table named mod_imunify_reports with columns service_id, scan_date, report_json. Then, develop a clientarea.php module that queries this table and renders an HTML table showing detected threats, file paths, and recommended remediation actions.

Monitoring and Troubleshooting

Log file

Append detailed entries to a log file for audit trails:

file_put_contents(
    '/var/log/imunify360_automation.log',
    date('[Y-m-d H:i:s]') . " Service {$serviceId} on {$hostname}: Upgrade {$upgradeRet}, Scan {$scanRet}\n",
    FILE_APPEND
);

Common issues

• SSH timeout: Ensure the WHMCS server can reach each target on port 22. Use ssh -o ConnectTimeout=10 to avoid hanging.
• License expired: The upgrade command fails without an active Imunify360 license. Consider checking imunify360-agent status before attempting upgrades.
• API rate limits: When managing hundreds of servers, space out API calls with usleep(500000) (0.5 s) between iterations.

Conclusion

Automating Imunify360 feature upgrades and malware‑scan reports within WHMCS transforms a labor‑intensive security routine into a reliable, repeatable process. By leveraging WHMCS’s API, secure SSH automation, and scheduled cron jobs, you ensure every server stays protected, every client stays informed, and your support team can focus on growth rather than maintenance.

Implement the steps outlined above, tailor the notification method to your business model, and watch your operational efficiency—and client satisfaction—rise. Happy automating!