Scan your account with Virus Scanner
Run cPanel's ClamAV scan across your files or mail, choose the right scan target, and know what it can and cannot find.
Virus Scanner runs a ClamAV scan across your hosting account. Applies to shared, reseller and Premium hosting on cPanel.
In cPanel, open Virus Scanner in the Advanced section.
Choose what to scan
| Target | Covers | Use when |
|---|---|---|
| Scan Entire Home Directory | Everything in the account | You do not know where the problem is |
| Scan Mail | The mail store | Mailboxes are sending or receiving infected attachments |
| Scan Public FTP Space | public_ftp | You accept uploads over FTP |
| Scan Public Web Space | public_html | You suspect the website itself |
Start with Scan Public Web Space if a site is misbehaving — it is much faster than the whole account and covers where web malware actually lives.
Select Scan Now.
Scans stop automatically if they run for more than a day. On a large account the full home directory scan can take a long time, which is another reason to narrow the target.
What it finds, and what it does not
ClamAV matches known signatures. It is good at finding recognised malware and infected attachments.
A clean result does not mean the account is clean. Most WordPress compromises are obfuscated PHP written to look like ordinary theme code, and signature scanning routinely misses them. Do not treat a clean scan as proof.
For a genuine compromise, use the server's own protection, which does behavioural detection rather than signatures alone:
If it finds something
Do not simply delete the file and stop. A single infected file is almost always a symptom — the attacker got in somehow, and if the route is still open the file returns.
Work through Clean malware from your website, which covers closing the entry point as well as removing the payload.