Knowledgebase

cPanel's Virus Scanner lets you check your whole hosting account -- website files, email and FTP folders -- for known viruses and malware whenever you like. This guide shows you how to scan your account for viruses with cPanel's Virus Scanner, how to read the results, and how to decide whether to quarantine, delete or ignore each file without breaking your website.

What the Virus Scanner does (and doesn't do)

The Virus Scanner uses ClamAV, a widely used open-source antivirus engine. It compares every file it scans against a large database of known malware "signatures" and reports any matches.

• It's good at finding infected email attachments, Windows viruses in files people have uploaded, known malicious scripts and old backup archives that contain infected copies of a site.
• It isn't a complete website malware check. Attackers constantly change and disguise the PHP code they inject into websites, and signature scanners miss much of it. A clean scan is good news, but it doesn't prove a hacked site is clean.

Separately, our servers run Imunify360 at the server level, which watches for attacks and scans for malware automatically. You can't configure it from cPanel. The Virus Scanner is your own on-demand tool on top of that.

When to run a scan

• After we've told you malware was found on your account, to see what's there.
• After cleaning or restoring a hacked site, to double-check.
• If your antivirus flagged a file you downloaded from your own website.
• If someone reports a suspicious attachment coming from one of your email addresses.
• Before downloading a full backup of your site to your computer.

How to run a scan

1. Log in to cPanel (from the client area: Services > My Services, choose your plan, then Log in to cPanel).
2. Go to Advanced > Virus Scanner. You can also type virus in the cPanel search bar.
3. Choose what to scan:

   Option	What it covers	Use it when
   Scan Mail	All mailboxes on the account	You're worried about infected attachments
   Scan Entire Home Directory	Everything: website, email, uploads, old backups and files outside public_html	You want the most thorough check (slowest)
   Scan Public Web Space	Your website folder, public_html	You only want to check the website (quicker)
   Scan Public FTP Space	The public_ftp folder	You use anonymous or public FTP uploads (most sites don't)

4. Click Scan Now.
5. Watch the progress. cPanel shows File (files scanned so far out of the total), Data (amount scanned), Scanner Progress and Infected Files. Leave the page open until it finishes.

A small website scans in a few minutes. A full home directory with years of email can take much longer, because every message is a separate file. If you only need to check the website, Scan Public Web Space is much faster.

Reading the results

If nothing is found, you'll see that the scan completed with no infected files. If something is found, each file is listed with its full path and the name of the malware signature it matched, for example:

/home/username/mail/example.com/pat/cur/1726151234.M12P3456.secure,S=48211:2,S   Doc.Downloader.Agent-1234567
/home/username/public_html/wp-content/uploads/2026/08/cache.php   Php.Malware.Agent-7654321
/home/username/old-site-backup.zip   Heuristics.Encrypted.Zip

(These are illustrations -- your file names and signature names will differ.) The first part of the signature name usually tells you what kind of file it is: Win for Windows programs, Doc or Xls for Office documents, Pdf, Html, Js or Php for web files. Names starting with Heuristics or PUA ("potentially unwanted application") are guesses based on suspicious features rather than a known virus, and are more often false alarms.

Quarantine, Destroy or Ignore?

For each infected file, cPanel asks what to do:

• Quarantine -- moves the file into a quarantine folder in your home directory, out of your website and mailboxes. It stops the file doing harm but keeps a copy in case you need it.
• Destroy -- permanently deletes the file.
• Ignore -- leaves the file exactly where it is. Only use this if you're certain it's a false alarm.

Choose an action for each file (or use the option at the bottom to apply one choice to all), then click Process Cleanup.

The right choice depends on where the file is:

Files in the mail folder

Paths containing /mail/ are individual email messages -- each message is stored as one file. A detection here almost always means an email with a malicious attachment. Destroy is usually right: it deletes that one message, and nobody should open it anyway. If you're not sure whether the message was important, choose Quarantine.

Files in public_html (your website)

Be careful here. Attackers often inject malicious code into real website files -- index.php, wp-config.php, a theme's functions.php -- rather than adding new files. If you Destroy one of those, you delete a file your site needs and it will break.

• A file with a random or out-of-place name, such as a .php file inside wp-content/uploads, is very likely entirely malicious. Quarantine it.
• A core WordPress, plugin or theme file with a normal name has probably been modified. Quarantine it, then replace it with a clean copy by reinstalling that plugin or theme, or restoring the file from a backup dated before the infection.
• Either way, treat a detection in public_html as a sign your site has been compromised. Removing the file isn't the end of the job -- see the next section.

Backup archives and old copies

Old .zip or .tar.gz backups, or folders such as old-site, often contain infected copies of a site from before it was cleaned. If you don't need the old copy, Destroy it. Password-protected archives are often flagged as Heuristics.Encrypted simply because the scanner can't look inside; if you created the archive yourself, that one is safe to Ignore.

Likely false alarms

Security plugins sometimes keep copies of malware signatures in their own files, and some legitimate tools are flagged as PUA. If the file belongs to software you installed on purpose from its official source, and the signature name starts with Heuristics or PUA, it's probably a false alarm. When in doubt, choose Quarantine rather than Ignore -- if the site then breaks, you know the file was needed and can open a ticket.

After the scan: what to do if malware was found in your website

Malware in your website files means someone got in, and they usually leave more than one file behind. Removing what the scanner found is a start, not a fix.

1. Change your passwords from a computer you trust: cPanel, every WordPress administrator, FTP accounts and the database user.
2. Scan your own computers with up-to-date antivirus. Malware on a PC can steal saved FTP and cPanel passwords.
3. Update everything. Most website infections come through an outdated plugin or theme.
4. Restore a clean backup if you can pin down roughly when the infection started. JetBackup 5 keeps the last 7 backups, taken three times a week.
5. Scan again once you've finished, to confirm nothing is left that ClamAV recognizes.

If the infection is older than your backups, keeps coming back, or you'd rather not do it yourself, a professional cleanup is the safer choice. Our guides on hacked WordPress sites and malware cleaning (below) walk you through the options.

Troubleshooting

The scan seems stuck or very slow

Large mailboxes and old backup archives take the longest. Try Scan Public Web Space first. If a full scan never finishes, open a ticket.

My site broke after cleanup

A needed file was quarantined or destroyed. Check the site's error_log for a "failed to open stream" or "No such file" message that names the missing file, then reinstall the plugin or theme it belongs to, or restore that file with JetBackup 5.

The scanner found nothing, but my site is still redirecting to spam

The malware isn't one ClamAV recognizes. That's common with website infections. Follow the hacked-site guide below or open a ticket and tell us what you're seeing.

I don't see Virus Scanner in cPanel

Use the search bar at the top of cPanel and type virus. If it still doesn't appear, open a ticket.

Common questions

How often should I scan?

There's no need to scan on a schedule, since the server already runs its own protection. Run a scan when you have a reason to: a warning, a cleanup, or anything suspicious.

Can I get a quarantined file back?

Quarantined files are moved to a quarantine folder in your home directory rather than deleted. If you're not sure how to put one back, open a ticket with the file name. Destroyed files can only come back from a backup.

Does scanning slow my website down?

A scan uses some of your account's resources while it runs. For most sites it isn't noticeable, but avoid running full home directory scans repeatedly.

Will this scan my computer?

No. It only scans files stored on your hosting account. Use antivirus software on your own devices.

Related guides

• Website Infected with Malware? How to Get It Cleaned
• What to Do If Your WordPress Site Is Hacked
• How to Restore a File or Folder with JetBackup 5
• How to Secure WordPress with WP Toolkit Security Hardening
• How to Check Your Website Error Log and Recent Visitors

Still stuck? Open a support ticket and the Instant Access Internet Services team will help.