Malware scanning on shared hosting is usually a server-side check of files in selected parts of your hosting account. A scan report is a reason to investigate, not proof that the entire site is infected or that it has been cleaned. Whether you can start a scan, see its results, or remove flagged files depends on your host’s software, configuration, and plan.
How does malware scanning for shared hosting work?
A scanner running on the hosting server inspects files in the locations its administrator has configured. For example, cPanel’s ClamAV documentation lists possible scan targets including a server’s home directory, mail folders, public FTP space, and public web space. That does not mean every shared host scans all of those locations, or that a file scan covers databases, every account, or external services. Ask your provider what is in scope and whether scans run on a schedule or only on demand. cPanel’s ClamAV Scanner documentation
As an Amazon Associate I earn from qualifying purchases.
Who can run or view a scan?
The hosting provider controls the server software and permissions. In cPanel’s documented ImunifyAV installation workflow, installation is performed through WHM’s Security Advisor and requires root or root-level reseller privileges. A shared-hosting customer typically does not have those administrative permissions, so the documented server installation steps are not a universal customer workflow. cPanel also says the installation alert may not appear on unsupported servers, trial accounts, or for users without sufficient privileges. Ask your host whether scanning is enabled and how you can obtain a report. cPanel’s ImunifyAV installation instructions
Scans use server resources
Scan speed and performance depend on the server and its settings. cPanel strongly recommends at least 3 GB of RAM for a server installing ClamAV, warns of possible performance issues on systems with less memory, and recommends scheduling scans during off-peak hours. For Imunify scans, cPanel support explains that reducing CPU and I/O use also reduces scan speed. These are product-specific operating notes, not a prediction of how long a scan will take or how much a particular shared site will slow down. ClamAV configuration guidance and cPanel’s explanation of slow Imunify scans
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Does a malware scan remove malware?
Not necessarily. Detection, cleanup, and restoration are different actions:
- Detection: The scanner flags or lists files it considers malicious or suspicious. A flag should be investigated; it does not establish the full extent of an incident or prove that unflagged files are clean.
- Cleanup: A separate feature or administrator action may quarantine, modify, or remove files. cPanel says ImunifyAV lists suspicious files but does not include integrated file removal. Its comparison describes file-removal options in ImunifyAV+ and broader security features in Imunify360. Availability and configuration depend on the host. cPanel’s comparison of Imunify products
- Restoration: If a tool changes or quarantines files, restoring retained originals may be possible. cPanel’s ImunifyAV+ instructions require an active ImunifyAV+ license to restore original files after product actions. A separate known-clean backup remains important. cPanel’s file-restoration instructions
Do not treat a scan’s completion or a removal action as a guarantee that the site is clean. A compromise can involve other files, persistence mechanisms, or access credentials beyond the items in one report.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Does my shared hosting plan include malware scanning?
There is no universal shared-hosting feature set established by the cPanel documentation. A host may enable scanning server-wide, limit which accounts or directories are covered, expose results in a control panel, or handle reports through support. Product names alone do not tell you what your plan actually includes.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAsk the provider these questions before relying on the feature:
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
- Is scanning enabled for my account, and which directories, file types, and accounts are covered?
- Which scanner and product tier is running, and when did the last scan finish?
- Can I see the flagged paths and the reason each item was flagged?
- Does the service only detect and report, or can it quarantine, clean, or restore files?
- Will support investigate the entry point and look for persistence beyond the reported files?
- Is there a known-clean backup from before the suspected compromise, and can it be restored without losing valid content?
- If the issue may involve the server itself rather than just my site account, what will the provider investigate?
When comparing hosting security features, compare coverage, scan scheduling or on-demand access, customer visibility, actions after detection, incident support, backup restoration, and controls for scan resource use. Do not assume a scan frequency, cleanup service, detection rate, or plan inclusion unless your provider confirms it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should I do if my hosting provider finds malware?
Coordinate with the host before deleting files or restoring a backup. A scan finding can be only one part of the incident, and removing a file without understanding the compromise may destroy useful evidence or leave another route back in.
Quick Recap
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
- Get the details. Ask for the affected paths, scan time, reason for each flag, and the action already taken. Ask how the provider believes the site was hacked and what malicious content it removed; Cloudflare recommends seeking those details from the provider. Cloudflare’s hacked-site recovery guidance
- Establish the scope. Ask whether the suspected compromise is limited to your website or account, or could involve the server itself. These are different situations and may require different responders.
- Agree on cleanup or restoration. Ask whether the host can investigate the entry point and persistence, and whether a clean pre-compromise backup is available. cPanel notes that thoroughly cleaning a hacked website or account can take considerable skill and labor; a known-clean backup is often the practical recovery option. cPanel’s guidance on cleaning a hacked website
- Protect evidence and valid content. Follow the host’s instructions before changing files. Confirm what will be quarantined, removed, or replaced and how valid site content will be preserved.
- Verify recovery. After removal or restoration, ask the provider to check the affected areas again. If Google or browser warnings appeared, Cloudflare advises resolving the site warnings in Google Webmaster Tools and requesting a review after the hack is resolved. Cloudflare’s recovery steps
How can I protect my website from getting hacked again?
- Keep the site software current. Update the content management system, plugins, themes, and other site components, removing anything you no longer use.
- Protect administrative access. Use strong, unique credentials and limit administrator accounts and access to the people who need them. Ask your host which additional access controls are available.
- Keep recoverable backups. Maintain backups that preserve valid site content, and know how to restore one. A backup is useful for recovery only if it predates the compromise and can be restored safely.
- Confirm what the host monitors. Ask about scan coverage, how findings are reported, and how the provider handles suspected persistence or a wider server incident.
- Recheck warnings after remediation. If search or browser warnings were shown, follow the relevant review process once the site has been cleaned or restored.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
