Antimalware

The Antimalware section scans your sites' files for malware, web shells and modified WordPress files. It is in the menu for administrators, resellers and users; everyone sees only their own sites. Nothing is ever deleted automatically: you decide what to do with each finding.

How it works

Each scan uses two engines together:

• Built-in scanner: fast and dependency-free, it recognises the techniques backdoors use most: obfuscated code run with eval, commands taken from the web request ($_POST, $_GET…), functions chosen by the browser, preg_replace with the /e modifier, PHP code hidden inside images, PHP files in the uploads folder, .htaccess auto-execution, cron jobs that download and run code, and the names of common web shells (c99, r57, wso, alfa…). The rules are deliberately conservative to limit false positives.
• ClamAV (signature antivirus): recognises known malware. It is installed by panel-agent setup antimalware (called by install.sh and upgrade.sh). Because ClamAV's daemon keeps about 1–1.5 GB of signatures in memory, the panel picks the mode from the server RAM: resident daemon with at least 4 GB, on demand (signatures loaded only during a scan, no resident daemon) on smaller servers such as the 2 GB ones, and no ClamAV below ~1.5 GB — there the built-in scanner and the WordPress checks still work. You can force the mode in Settings.

If the site is WordPress, the panel also checks integrity: it compares the core and plugin files with the official ones from wordpress.org.

Every finding has a severity (critical, high, medium, low), a plain explanation, the file path, the line and a snippet of the suspicious code (sanitized and shortened).

Scans run as low-priority background jobs (nice/ionice) as the site user, so they do not slow the site down. They are incremental: after the first full scan only new or changed files are re-checked (by date, size and hash), with a full scan once a week. At night the panel scans the sites in turn, one at a time.

What you can do with a finding

• Quarantine: the file is moved to a hidden folder out of the site (no longer reachable from the web) and made unreadable. It is reversible: Restore puts it back with its original permissions. The move is safe against symlinks and hard links.
• Delete: permanently removes a file already in quarantine (with confirmation).
• False positive: the finding is not shown again until the file changes (the list is by content hash, not just the path).
• Repair WordPress: puts the official core files back (after an automatic safety copy). wp-content and wp-config.php are never touched.

In Settings (administrators) you can turn on nightly scans and choose their time window, the ClamAV mode, email alerts for new critical and high threats, and — if you want — automatic quarantine of «critical» threats only (not recommended unless you are comfortable with false positives).