Question Exceptions for Imunify checks in Plesk?

[brother4]

Server operating system version

Ubuntu 22.04.5 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.73 Update 3 Web Host Edition

Hello! I disabled domains in Plesk, but I still received warnings from Immunify. I then excluded the directories, as they are no longer publicly accessible.

For example:

/var/www/vhosts/example.com/old.example.com/

However, this still resulted in warnings about security vulnerabilities. How should this be entered?

/var/www/vhosts/example.com/old.example.com/**

 

[Sebahat.hadzhi]

Hello, @brother4 . Could you please confirm if by excluded you mean the directory has been added into the Imunify's Ignore list? Also, could you please provide an example of the notification(s) you receive for the disabled domain? Thank you in advance.

 

[brother4]

Could you please confirm if by excluded you mean the directory has been added into the Imunify's Ignore list?

Yes. Imunify's ignore list.

Also, could you please provide an example of the notification(s) you receive for the disabled domain?

Subject: Vulnerabilities found on your Server - Action Required: WordPress
or Subject: Outdated or vulnerable software discovered

Plesk Mail with:

Dear Administrator,
We are reaching out to you to keep you informed on security threats. The list below shows vulnerable software that has been detected in your environment:

[list of old WordPress versions]

[and another mail with outdated plugin versions]

Everything about disabled domains & ignored paths (both conditions met).

 

[Sebahat.hadzhi]

Thank you for the provided details. There is an open case with Imunify regarding the notifications related to outdated WordPress versions/plugin versions and they are currently working on improving the flexibility of notification management. I asked them to check the relation of the notifications with the domain status (disabled/suspended) in the scope of this research. I will follow-up with more details as soon as possible. For the time being, the only alternative I can suggest is to completely disable Imunify notifications from Tools & Settings > Notifications.