What Is Malware Scanning?
Website malware scanning checks a site's files and database for code that should not be there: injected scripts, backdoors, spam pages, rogue admin users and altered core files. Scanners use signatures, behaviour heuristics and checksum comparisons. A scan only finds candidates; cleanup, closing the entry point and a clean backup follow.
For website owners and admins choosing a scanner, reading its results, and deciding what to do when it flags something.
knowledge
- Read time
- 2 min
- Sections
- 4
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What does website malware scanning check?
Website malware scanning reads the files the server executes and the rows in the database, looking for injected scripts, backdoors, spam pages, rogue admin users and core files that no longer match a clean copy. It is a different job from scanning a laptop: the target is the code that visitors’ browsers and your server run.
- Files: PHP, JavaScript and .htaccess under the web root, including uploads and cache folders where code should never appear.
- Database: posts, options and widget rows where a script can be stored and printed into every page.
- Users: administrator accounts nobody on the team created.
- Behaviour seen from outside: redirects to other domains, hidden links and unexpected downloads that a visitor or Google would see.
How do malware scanners decide a file is malicious?
Scanners use three methods: signatures that match known malicious code, heuristics that flag suspicious behaviour, and integrity checks that compare files with the copy the software vendor shipped. Each catches something the others miss.
| Method | What it catches | Blind spot |
|---|---|---|
| Signature | Known web shells, injectors and spam kits | New or heavily obfuscated code |
| Heuristic | Code that decodes and runs strings, phones home, or sits in an image folder | False positives on legitimate minified or encoded code |
| Integrity (checksum) | Any change to a core or plugin file | Files that never had an official copy, such as uploads or custom themes |
A match is a lead, not a verdict. Someone still has to decide whether the file is foreign, especially when a heuristic flags a plugin that legitimately uses base64_decode.
Where does website malware usually hide?
Most website infections sit in out-of-date or nulled themes and plugins, the uploads folder, the database, and .htaccess rules that redirect only some visitors. A homepage that looks normal to a logged-in owner can still load a hidden script for everyone else.
- Nulled or abandoned plugins: pirated premium plugins often ship with a backdoor already inside.
- wp-content/uploads: any .php file here is suspicious, because the folder should hold media only.
- Database options and posts: injected
<script>tags or iframes stored in content or widgets. - .htaccess and index files: conditional redirects that send mobile or search-engine visitors elsewhere.
- Cron and scheduled tasks: a job that re-creates the backdoor after you delete it.
Which malware scanners can you use on a hosting account or server?
Server-side scanners such as ImunifyAV, ClamAV and Linux Malware Detect read every file on disk, while remote scanners only see what the site sends to a browser; use server-side scanning whenever you can.
| Scanner | Runs on | Notes |
|---|---|---|
| ImunifyAV | cPanel or Plesk server | The scanner cPanel recommends; free edition detects, paid ImunifyAV+ also cleans |
| ClamAV | Any Linux server; cPanel plugin | Open-source signatures; also scans mail. See installing ClamAV on cPanel |
| Linux Malware Detect (maldet) | Linux server with root | Signatures aimed at shared-hosting threats; can use ClamAV’s engine |
| WP-CLI checksums | Any WordPress site with SSH | Integrity check against WordPress.org copies |
| Google Safe Browsing / Search Console | Google’s side | Tells you when Google has already flagged the site |
On a WordPress site with shell access, two commands compare core and plugin files with the official releases:
wp core verify-checksums
wp plugin verify-checksums --allAny file reported as changed or “should not exist” needs a look. Premium plugins not hosted on WordPress.org are skipped, so scan those with a server-side tool.
Does a malware scan remove the malware?
No: a scan finds candidates, and cleanup is a separate job of removing the code, closing the way in and proving the site is clean. Deleting one flagged file while the vulnerable plugin stays installed usually brings the infection back within days.
- Take a copy of the infected site for evidence before changing anything.
- Restore a backup from before the infection, or remove the flagged files and database entries by hand.
- Update or remove the plugin, theme or password that let the attacker in.
- Change every password: CMS admins, database, hosting panel, FTP and SFTP.
- Scan again, then ask Google to review the site if Search Console lists a security issue.
The full order of work is in cleaning a hacked website, and the browser warning side is covered in “site ahead contains malware”.
How often should a website be scanned for malware?
Run an automatic scan at least daily on a busy or e-commerce site and weekly on a small brochure site, plus an extra scan after every plugin install, theme change or suspected incident. Schedule full-server scans outside business hours, because they use CPU and disk.
- Daily: stores, membership sites and anything that takes payments.
- Weekly: small business and portfolio sites that change rarely.
- On change: after installing or updating a plugin, and after any staff member leaves.
- With backups: keep at least one backup older than the scan interval, so you can roll back past an infection the scanner found late.
If nobody on the team will act on scan reports, WebJi®’s Website Security Consultancy covers a security audit and malware-cleanup consultancy for ₹4,200 a year before 18% GST in WebJi®’s published pricing; see website security services.
Sources: cPanel documentation (ImunifyAV recommendation, ClamAV plugin); R-fx Networks documentation for Linux Malware Detect; WP-CLI command reference for core verify-checksums and plugin verify-checksums; Google Search Console Help for security issues.
Frequently asked questions
Can an online scanner find all website malware?
No. A remote scanner sees only what the site sends to a browser at that moment, so backdoors, dormant files and conditional redirects can be missed. Use it as a quick check, and rely on a server-side scanner for a real answer.
Why does my scanner flag a plugin file that I trust?
Heuristic rules flag patterns such as encoded strings or remote requests, which some legitimate plugins use. Compare the file with a fresh download of the same plugin version; if they match, mark it as a false positive.
Is malware scanning included with shared hosting?
It depends on the host and plan. Many cPanel hosts run a server-wide scanner, but reports may not reach you. Ask support which scanner runs on your account, how often, and whether you are told when it finds something.
Will a malware scan slow down my website?
A full scan reads every file and can add CPU and disk load while it runs, so schedule it at night. Incremental scans that check only changed files, or a real-time scanner on upload, cost far less.
Last editorial update: 15 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.