A malware warning can turn a normal workday into a scramble. Your site may redirect visitors, display suspicious ads, send spam, or get flagged by search engines. The good news is that you can often start investigating from the same place you manage files, email, and domains. Here is how to scan a website for malware in cPanel, understand what the scan finds, and take the next safe step.

A scan is a strong first check, but it is not a complete cure by itself. Malware can hide in old plugins, modified theme files, database entries, scheduled tasks, or stolen administrator accounts. Treat the scan result as evidence to review, then pair cleanup with updates, password changes, and a backup plan.

Before You Scan: Make a Backup

If your site still loads, create a fresh backup before deleting or changing anything. This gives you a recovery point if a file turns out to be legitimate or a cleanup step breaks part of the site.

In cPanel, look for Backup, Backup Wizard, or your hosting account’s backup tool. Save a copy of your website files and database. For WordPress and other database-driven websites, you need both. The files contain themes, plugins, uploads, and site code, while the database contains pages, settings, users, and sometimes malicious content.

If the site is actively redirecting visitors or sending malicious emails, contact hosting support before spending time on cleanup. Support can help protect the account while you investigate and may identify server-level activity that is not visible from your dashboard.

How to Scan a Website for Malware in cPanel

The exact scanner name depends on your hosting plan and server configuration. In cPanel, common options include Virus Scanner, ImunifyAV, Site Quality Monitoring, Security, or a security tool provided by your host. If you do not see one of these, that does not mean your site is clean. It may mean malware scanning is handled through another service or requires support assistance.

1. Log in and find the security tool

Sign in to cPanel using the login details supplied with your hosting account. On the main page, use the search bar and type words such as “virus,” “malware,” “security,” or “scanner.” This is usually faster than looking through every section.

Open the scanner and read the available scan choices. Some tools let you scan your entire home directory, your public web files, email accounts, or a single folder. For a website concern, start with the folder where the site is installed. This is commonly public_html for the primary domain. Addon domains and subdomains may use separate folders.

2. Choose the right scan scope

A full home-directory scan is the better choice when you do not know where the issue started. It can identify infected files outside the main website folder, including abandoned installations, old backups, or email attachments.

A targeted scan is useful when you manage several sites in one cPanel account and know which domain has the problem. It may finish faster and makes the results easier to review. However, do not assume the problem is limited to one folder just because only one website is showing symptoms.

3. Start the scan and wait for the report

Run the scan and allow it to finish. Larger accounts, image-heavy websites, and full-account scans can take time. Avoid making broad file changes while the scan runs, since that can complicate the results.

When it is complete, review each flagged item. A report may identify a file as malicious, suspicious, infected, or potentially unwanted. It may also show the file path, malware signature, and a suggested action such as clean, quarantine, or delete.

Do not automatically delete every flagged file. Security scanners can produce false positives, especially with compressed backup archives, cache files, custom scripts, and legitimate code that resembles an attack pattern. Check the file location and name before acting.

Review Malware Scan Results Safely

A suspicious PHP file inside an unfamiliar folder, a random filename in a plugins directory, or code injected into a core file deserves attention. So does a recently modified file that you did not update yourself. Common signs include long strings of scrambled characters, unexpected eval or base64_decode functions, hidden iframes, and code added before or after normal file content.

Context matters. For example, a file in an old backup archive might be safely removed if the archive is no longer needed. A file in an active WordPress plugin should not be edited blindly. The safer approach is to replace that plugin with a fresh copy from its trusted source after confirming it is legitimate and current.

If the scanner offers quarantine, that is often safer than permanent deletion. Quarantine removes the file from normal use while preserving a copy for review. Still, quarantining a required site file can cause an error, so keep your backup available and test the website after each action.

Clean the Site Without Leaving the Door Open

Removing the detected file is only one part of malware cleanup. If an attacker entered through an outdated plugin or compromised password, the site can be infected again within hours. Work through the likely entry points after you address the scan results.

First, update your website software, themes, plugins, and extensions. Delete anything you do not use, including inactive themes and old plugins. An unused component can still be a security risk if it remains installed.

Next, change passwords for cPanel, FTP or SFTP, website administrators, databases, and associated email accounts. Use unique, long passwords. If multiple people access the site, make sure each person has an individual account rather than sharing one login. Remove former staff, developers, or vendors who no longer need access.

For WordPress, review the Users screen for unfamiliar administrator accounts. Check installed plugins and themes for anything you do not recognize. Also inspect scheduled tasks if your cPanel includes Cron Jobs. Attackers sometimes use cron jobs to reinfect a site after malicious files are removed.

Finally, clear your website and browser caches, then test key pages. Check the homepage, contact form, login page, and any checkout or member area. A clean scan does not guarantee every visitor-facing problem is gone, but it is a useful checkpoint.

When cPanel Scanning Is Not Enough

Some infections are too complex for a file scanner alone. Database injections, compromised advertising scripts, modified DNS settings, and stolen user sessions may not appear as a simple infected file. You should ask for help if the malware returns after cleanup, the scanner cannot clean the files, visitors are being redirected, or search engines and browsers continue showing security warnings.

Professional support is also the right choice when you are unsure whether a flagged file is safe to remove. Guessing can lead to unnecessary downtime. A hosting support team can help verify the account, check server logs where available, and advise on the right recovery path. With Visiba, customers can also rely on 24/7 support when a website issue needs a second set of eyes.

Reduce the Chance of Another Infection

The most effective protection is regular maintenance. Keep automatic updates enabled where appropriate, back up your site on a schedule, and remove unused software promptly. Use a current version of PHP that your website supports, and make sure your SSL certificate is active so visitors connect securely.

It also helps to scan periodically, not only after something goes wrong. Monthly scans may be enough for a simple brochure site, while stores, membership sites, and frequently updated blogs may need more frequent monitoring. The right schedule depends on how often your site changes and how much customer data it handles.

A cPanel malware scan gives you a practical place to start, but calm, careful action makes the real difference. Back up first, review findings before deleting files, close the security gap that allowed the infection, and ask for support when the issue goes beyond a straightforward cleanup.