How long does a cPanel Virus Scanner scan take?

Depends on account size. A typical WordPress site with a few thousand files finishes in 5-15 minutes. Large accounts with big media libraries or archived email can take an hour or more. It runs in the background once started, so you can navigate away from the page.

Should I choose Delete or Quarantine for a flagged file?

Quarantine unless you're certain the file is malicious and not something your site needs to function. Quarantined files can be restored from within the Virus Scanner interface if you flagged something legitimate by mistake; deleted files are gone for good.

The scanner didn't find anything but my site is still redirecting to spam. What now?

ClamAV signature-based scanning misses obfuscated or newly written malware that doesn't match a known signature yet. Check your theme's functions.php and any recently modified files by timestamp (File Manager, sort by Last Modified), and inspect .htaccess for injected redirect rules that a file scan wouldn't flag.

Can I schedule the cPanel Virus Scanner to run automatically?

The standard cPanel Virus Scanner is on-demand only, not schedulable through the interface. If you want automated recurring scans, that's a VPS-level ClamAV setup with a cron job, or an always-on tool like Imunify360 if it's included on your plan.

Will running a virus scan slow down my site?

It adds some disk I/O load while running since it's reading every file in the scanned directory, but on shared hosting resource limits this is rarely noticeable to visitors. If you're on a resource-constrained plan, running it during low-traffic hours is a reasonable precaution.

cPanel Virus Scanner Guide: Scan & Clean Files

Got an email from your host saying malware was found on your account, or noticed your site flagged in Google Safe Browsing? Before you panic and start deleting files, cPanel has a built-in tool made exactly for this: the Virus Scanner. Here's how to actually use it, read the results correctly, and clean up without breaking your site.

What the Virus Scanner Actually Is

Under cPanel → Advanced → Virus Scanner, most shared hosting accounts (including Getwebup's) ship with a ClamAV-based scanner you can run from the browser. No SSH, no root, no cron setup. It's a different tool from Imunify360's automatic quarantine (which reacts in real time and moves suspicious files on its own) and different from a VPS-level ClamAV install where you're running scans as root over an entire server. This one scans just your account — home directory, email, or public_html — on demand, and leaves the decision about what to do with a flagged file in your hands.

That distinction matters. If you're on a VPS and want automated, scheduled scanning across the whole box, you need a proper ClamAV + rkhunter setup at the OS level. The cPanel Virus Scanner is the shared-hosting equivalent: manual, account-scoped, and good enough to catch the common stuff — injected PHP backdoors, spam-sending scripts dropped by a compromised plugin, infected email attachments sitting in old mailboxes.

Symptom: Why You'd Reach for This Tool

Your host's abuse team emailed about outbound spam or a malicious script found on your account.
Browsers show a "Deceptive site ahead" or Google Safe Browsing warning for your domain.
Your site is randomly redirecting visitors to spam or adult sites.
A plugin or theme update failed and you suspect a nulled/pirated copy was the entry point.
You just want a clean bill of health before a client handover or migration.

Running a Scan

Log in to cPanel and open Advanced → Virus Scanner.
Pick a scan target. You'll usually see options like Scan Home Directory, Scan Mail, Scan Public FTP Space, and Scan Entire Home Directory (Including Mail). For a suspected website compromise, scan the home directory; for spam complaints, scan mail as well.
Click Scan and let it run. On a large account (tens of thousands of files, big media library) this can take anywhere from a few minutes to over an hour — don't close the tab, but it's safe to open a new tab and keep working.
When it finishes, you'll get a results table: file path, and an action dropdown per file (usually Ignore, Quarantine, or Delete).

Reading the Results Without Overreacting

This is where people get into trouble. Not everything flagged is actually malicious, and not everything that's actually malicious gets flagged.

What you see	What it usually means	What to do
PHP file in `wp-content/uploads/` with a random name	Almost always a real backdoor — uploads folders shouldn't contain executable PHP	Quarantine or delete, then check `.htaccess` in that folder for PHP execution rules that shouldn't be there
A signature match inside `wp-content/plugins/` or `wp-content/themes/`	Could be a genuinely infected plugin, or a false positive on obfuscated-but-legit code some page builders ship with	Compare the flagged file against a fresh download of that exact plugin version before deleting
Email attachment flagged in an old inbox	Usually a virus someone emailed you years ago that's just sitting there, never opened	Safe to delete — it's not actively doing anything, but no reason to keep it
Core WordPress file (`wp-load.php`, `wp-settings.php`, etc.) flagged	Either a real core-file infection, or occasionally a heuristic false positive	Don't just delete it — re-download the same WordPress version and diff before removing, since deleting a core file blindly will break your site

If you're not sure whether a flagged file is legitimate, don't delete it outright. Quarantine keeps a copy cPanel can restore from if you got it wrong, which is exactly why it's the safer default over Delete for anything you can't identify with certainty.

The Fix: Cleaning Up Properly

Running the scan is step one. A thorough cleanup looks like this:

Quarantine flagged files first, don't delete outright, until you've confirmed each one is actually malicious.
Change every password tied to the account — cPanel password, WordPress admin, database user, FTP/SFTP accounts, and email passwords if mail was also compromised. If one credential leaked, assume they all did.
Update everything — WordPress core, every plugin, every theme. Most infections ride in through an outdated plugin with a known vulnerability, not a zero-day.
Check for new admin users in WordPress (Users → All Users) and new cPanel/FTP accounts you didn't create.
Re-scan after cleanup to confirm nothing was missed, and check cron jobs (WHM/cPanel → Cron Jobs) for anything that looks unfamiliar — a common re-infection trick is a scheduled task that re-downloads the malware.
Review .htaccess in your document root and any uploads folders for injected rewrite rules or PHP handlers you didn't add.

If the scanner keeps finding the same files reappearing after you clean them, that's a sign the entry point is still open — usually an outdated plugin, a leaked FTP password, or a scheduled cron re-infecting the account. Cleaning symptoms without closing the entry point just means you're back here next week.

Prevention: Keeping It From Coming Back

Keep WordPress core, plugins, and themes updated — set up auto-updates for minor releases at minimum.
Avoid nulled/pirated plugin and theme copies; they're a common malware delivery method.
Use strong, unique passwords for cPanel, database, and WordPress admin — a password manager makes this painless.
Enable two-factor authentication on both cPanel and WordPress admin logins.
Run a Virus Scanner pass monthly, or right after any plugin/theme install from a source you're not 100% sure about.
Consider Imunify360 (if available on your plan) for real-time, automatic protection between manual scans — the two tools complement each other rather than overlap.

The Virus Scanner won't catch everything a full server-level security suite would, but for a shared hosting account it's a fast, no-cost first check that catches the vast majority of real-world infections. Run it before you assume the worst, and run it again after cleanup to confirm the fix actually held.

cPanel Virus Scanner: How to Scan and Clean Infected Files