How to Install ClamAV on cPanel

The cPanel ClamAV plugin installs the Clam AntiVirus engine, its signature database and a scanning interface on a server you control. Root gets a Configure ClamAV Scanner page in WHM, and each cPanel account can get a Virus Scanner icon for its own files.

This is a server-owner job. On shared hosting the provider decides which scanner runs, and an account holder cannot add the plugin. You need root WHM on a cPanel VPS or dedicated server, and cPanel strongly recommends at least 3 GB of RAM, because the ClamAV daemon keeps its whole signature set in memory.

• Scans home directories, mail, public FTP space and public web space, on demand or from cron.
• Scans inbound mail through Exim automatically; outbound scanning needs two extra Exim settings.
• Signature-based detection, updated by freshclam.
• No licence fee; the plugin is offered in WHM’s Manage Plugins list.

cPanel’s own documentation now recommends ImunifyAV ahead of ClamAV. ClamAV still makes sense when you want an open-source scanner, mail scanning in Exim, or command-line scans you can script.

Run cPanel’s clamscan with --version: it prints the engine version, the signature database number and the database date, which should be no more than a day or two old. The install can succeed while the first signature download fails, so check the date rather than the status.

/usr/local/cpanel/3rdparty/bin/clamscan --version
/usr/local/cpanel/3rdparty/bin/freshclam            # update now and read any error
/scripts/restartsrv_clamd                           # restart the daemon after a manual update

cPanel’s ClamAV binaries live in /usr/local/cpanel/3rdparty/bin/, not in /usr/bin, so a bare clamscan may return “command not found”. If your own scripts expect /usr/local/bin, cPanel documents creating symlinks:

ln -s /usr/local/cpanel/3rdparty/bin/clamscan /usr/local/bin/clamscan
ln -s /usr/local/cpanel/3rdparty/bin/freshclam /usr/local/bin/freshclam

Finally, log in to any cPanel account and look under Advanced for Virus Scanner. If the icon is missing, enable the feature for that account’s package in WHM » Feature Manager.

ClamAV only detects what its signatures know, so check weekly that freshclam is still updating and that the server can reach the update mirrors. A blocked outbound connection or a stale lock stops updates without any warning in cPanel.

• Run /usr/local/cpanel/3rdparty/bin/freshclam by hand after install and read the output, not just the exit code.
• Confirm outbound HTTPS (port 443) and DNS resolution work; signature mirrors are reached over HTTPS. If you run CSF firewall, check its outbound rules.
• If clamscan --version shows a database date older than three days, treat updates as failing.
• Restart the daemon after a manual database repair with /scripts/restartsrv_clamd.

ClamAV flags files that match known signatures; it does not stop a new PHP backdoor being uploaded, block an exploited plugin, or clean an infected database. Treat it as one layer beside updates, a firewall and tested backups.

When a scan flags files on a live site, follow cleaning a hacked website before deleting anything, because removing one file rarely removes the way in. Pair the scanner with server backups you have restored at least once, and see what malware scanning covers for how signature and behaviour-based scanners differ. Email support@webji.services with the scan log if a hit names a file you do not recognise.

Sources: cPanel & WHM documentation, “Configure ClamAV Scanner” (docs.cpanel.net/whm/plugins/configure-clamav-scanner/) and “Manage Plugins” (docs.cpanel.net/whm/cpanel/manage-plugins/), both last modified 8 July 2026.