Using cPGuard
What cPGuard protects on GoZen cPanel servers, how to check scan results, and how to manage quarantined files.
4 min read
cPGuard is a server-level security suite for cPanel servers. GoZen Host shared hosting and WordPress hosting accounts get a web application firewall and malware scanning from Imunify360 or cPGuard, depending on the server. On a VPS or Business Cloud server with cPanel, cPGuard is an optional paid add-on (“cPGuard - Unlimited Server Users”). See our full security overview.
If your account is on a cPGuard server, you don’t need to install or configure anything. It runs in the background.
What cPGuard Does
It works at the server level, so it catches threats that WordPress security plugins can’t see from inside the application.
| Feature | What It Does |
|---|---|
| Malware Scanner | Scans files on upload and modification. Quarantines known malicious files |
| Web Application Firewall (WAF) | Blocks SQL injection, cross-site scripting (XSS), remote file inclusion |
| Brute Force Protection | Rate-limits failed login attempts on cPanel, WordPress wp-login, and other app login pages |
| Outgoing Spam Detection | Monitors outgoing email and catches compromised accounts before they damage server IP reputation |
| CMS Vulnerability Scanner | Checks installed CMS applications (WordPress, Joomla, Drupal) for known vulnerabilities |
| IP Reputation Monitoring | Watches server IP against blacklists and alerts if something gets listed |
Checking Your Security Status
In cPanel
- Log into cPanel
- Look for the cPGuard section (usually under Security or as its own section)
- Click cPGuard to open the dashboard
If there’s no cPGuard icon, your account is on a server that uses Imunify360 instead. Look for Imunify360 under Security.
The dashboard shows:
- Overview - summary of recent scans, blocked attacks, and current status
- Malware scan results - list of files scanned, any detections, and quarantine status
- WAF logs - recent blocked requests with details (IP, attack type, URL targeted)
- Brute force logs - login attempts blocked per service (cPanel, WordPress, FTP)
Understanding Scan Results
When cPGuard finds something, it either quarantines the file or flags it for review:
- Quarantined - the file has been moved to a safe location and can no longer execute. Your site may show errors if it was an active file.
- Flagged - the file is suspicious but not confirmed malicious. Review it manually.
False positives happen. Some WordPress plugins use obfuscated code that triggers malware scanners. If a legitimate plugin file gets quarantined, you can restore it from the cPGuard dashboard and whitelist the file.
Managing cPGuard
Restoring a Quarantined File
If cPGuard quarantined a file that you know is safe:
- Open the cPGuard dashboard in cPanel
- Go to Malware → Quarantine
- Find the file in the list
- Click Restore to put it back in its original location
Only do this if you’re sure the file is legitimate. If you’re not sure, open a support ticket and our team will review it.
Whitelisting Files or Paths
If you have a legitimate application that keeps getting flagged:
- In the cPGuard dashboard, go to Settings or Whitelist
- Add the specific file path (e.g.,
/home/username/public_html/wp-content/plugins/some-plugin/file.php) - Save
Whitelist specific files, not entire directories. Whitelisting /public_html/ would disable protection for your whole site.
cPGuard vs WordPress Security Plugins
If you’re wondering whether you still need Wordfence or Solid Security, this table compares the two approaches:
| Feature | cPGuard | WordPress Security Plugin |
|---|---|---|
| Operates at | Server level | Application level (PHP) |
| Protects | All sites on your account | Only the WordPress install it’s on |
| WAF | Blocks before request hits PHP | Blocks during PHP execution |
| Malware scanning | All file types, server-wide | WordPress files only |
| Resource use | Doesn’t count against your account’s CPU/RAM limits | Uses your PHP processes and memory |
| Brute force protection | cPanel, WordPress, FTP, email | WordPress login only |
| Requires configuration | No | Yes |
cPGuard handles server-level protection. A WordPress plugin adds application-level features such as login URL changes, file integrity monitoring, and two-factor auth. You can use both.
For a simple setup, rely on the server-level scanning and WAF, and add two-factor authentication to your WordPress admin.
Common Questions
“Does it cost extra?”
On shared and WordPress hosting, the server-level security (Imunify360 or cPGuard) is included in your plan. On a VPS or Business Cloud server, cPGuard is an optional paid add-on.
“Can I disable it?”
On shared hosting, the server-level WAF and malware scanner protect the whole server and can’t be disabled per account. The cPanel dashboard shows what it’s doing and lets you manage quarantined files.
“Does it slow down my site?”
Scanning and WAF checks add a little work on every request, but cPGuard runs outside your account’s CloudLinux resource limits, so it doesn’t use up your CPU or memory allocation.
“I got hacked despite cPGuard. What happened?”
cPGuard blocks known threats. If an attacker used a zero-day vulnerability or gained access through a leaked password, cPGuard may not catch the initial entry. It should still detect malware they upload and quarantine it. If you suspect a compromise, contact support immediately.
What to Do Next
- Securing WordPress - application-level hardening on top of server-level security
- Enabling Two-Factor Authentication - protect your cPanel and WordPress logins
- Understanding Your GoZen Hosting Stack - how the security layer fits into the bigger picture
- Why GoZen Host - CloudLinux, server-level security and the rest of the platform
Last updated 21 Oct 2026, 00:00 +0300.