# Scan your site for malware
Source: https://docs.webgee.com/en/security-ssl/malware-scanner-how-to-scan-your-sites-for-malware







Scan a hosting account for malware on demand. Applies to shared and reseller
hosting, at no additional cost.

Imunify360 already scans continuously in the background across all WebGee
servers. This is for when you want to check a specific account now — after a
suspected compromise, or before handing a site over.

## Run a scan [#run-a-scan]

1. In cPanel, open **Imunify360** under **Security**.

   <img alt="Imunify360 in the cPanel Security section" src="__img0" />

2. Select **Start scanning**.

   <img alt="The Imunify360 interface with the Start scanning button" src="__img1" />

The scan is queued and runs through the account's files. Large accounts take a
while; you can leave the page.

## Read the results [#read-the-results]

Anything found appears under **Malicious**, listing the file path and the
detected signature.

For each result you can:

* **Clean up** — Imunify360 attempts to remove the malicious code and keep the
  file.
* **Delete** — remove the file entirely.
* **Add to ignore list** — for a false positive.

<Callout type="warn">
  Take a backup before cleaning or deleting anything. Cleanup modifies files in
  place, and a false positive on a legitimate file can break your site. See
  [Take a snapshot backup](/en/backups/jetbackup-snapshot-backups).
</Callout>

## Cleaning is not the whole job [#cleaning-is-not-the-whole-job]

Removing the malicious files does not close the hole they came through. If a
scan finds anything, assume the site was compromised through an outdated plugin,
theme or password and deal with that too — otherwise it returns within days.

Work through
[Clean malware from your website](/en/security-ssl/steps-to-cleaning-malware-from-your-website),
which covers the rest: updating everything, rotating passwords, and checking for
files and admin users the attacker left behind.

## If the site is flagged by Google [#if-the-site-is-flagged-by-google]

A clean scan is not enough on its own — Google keeps showing the warning until
it re-checks. See
[Request a Google review of a compromised site](/en/security-ssl/deceptive-site-ahead-how-to-request-google-to-review-a-compromised-site).

## Related [#related]

* [Clean malware from your website](/en/security-ssl/steps-to-cleaning-malware-from-your-website)
* [Request a Google review of a compromised site](/en/security-ssl/deceptive-site-ahead-how-to-request-google-to-review-a-compromised-site)
* [Take a snapshot backup](/en/backups/jetbackup-snapshot-backups)