{"id":3553,"date":"2016-02-27T23:14:13","date_gmt":"2016-02-28T04:14:13","guid":{"rendered":"http:\/\/underhost.com\/blog\/?p=3553"},"modified":"2026-10-23T08:55:49","modified_gmt":"2026-10-23T12:55:49","slug":"how-to-install-clamav-cpanel","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/how-to-install-clamav-cpanel\/","title":{"rendered":"How to Install and Use ClamAV on a cPanel &#038; WHM Server (2026)"},"content":{"rendered":"<div class=\"uh-blog-hero\" style=\"margin:0 0 40px;text-align:center;padding:48px 24px;border-radius:20px;background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;box-shadow:0 20px 40px -15px rgba(13,31,60,0.28);position:relative;overflow:hidden;\">\n<div style=\"display:inline-flex;align-items:center;gap:8px;padding:7px 14px;margin-bottom:16px;border:1px solid rgba(0,212,255,0.32);border-radius:999px;color:#DFF8FF;font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;background:rgba(0,212,255,0.10);\"><i class=\"fas fa-sliders-h\" style=\"color:#00D4FF;\"><\/i> Control Panels<\/div>\n<h1 style=\"color:#ffffff;font-size:clamp(32px,5vw,46px);line-height:1.12;margin:0 0 14px;font-weight:800;\">How to Install and Use ClamAV on a cPanel &amp; WHM Server (2026)<\/h1>\n<p style=\"font-size:18px;color:#EAF6FF;max-width:800px;margin:0 auto;line-height:1.7;\">Protect your server from malware and viruses by installing ClamAV on WHM. Follow this guide to install, update, and scan your system for threats.<\/p>\n<\/div>\n<div class=\"uh-blog-excerpt\" style=\"border-left:4px solid #00D4FF;padding:18px 20px;margin:0 0 34px;background:#F8FAFC;color:#1F2937;border-radius:0 14px 14px 0;box-shadow:0 8px 28px rgba(13,31,60,0.08);line-height:1.75;\"><strong style=\"color:#0D1F3C;\">Short answer:<\/strong> In WHM, open <strong>cPanel &gt; Manage Plugins<\/strong>, tick <strong>ClamAV for cPanel<\/strong> and click <strong>Save<\/strong>. cPanel installs ClamAV in <code>\/usr\/local\/cpanel\/3rdparty\/bin\/<\/code>. Choose what users can scan in <strong>Plugins &gt; Configure ClamAV Scanner<\/strong>, then scan from the command line with <code>\/usr\/local\/cpanel\/3rdparty\/bin\/clamscan -ri \/home\/USER<\/code>. Review the results before you delete anything, and plan for at least 3 GB of RAM on the server.<\/div>\n<nav aria-label=\"Table of contents\" class=\"uh-toc\" style=\"background:#ffffff;border:1px solid #E5E7EB;border-radius:16px;padding:20px 22px;margin:0 0 34px;box-shadow:0 4px 12px rgba(13,31,60,0.08);\">\n<div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#176EA5;margin-bottom:10px;\"><i class=\"fas fa-list\" style=\"color:#00D4FF;\"><\/i> In this guide<\/div>\n<ol style=\"margin:0;padding-left:20px;columns:2 260px;column-gap:28px;line-height:1.9;\">\n<li><a href=\"#what-clamav-does-on-a-cpanel-server\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">What ClamAV does on a cPanel server<\/a><\/li>\n<li><a href=\"#requirements\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Requirements<\/a><\/li>\n<li><a href=\"#step-1-install-clamav-in-whm\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 1: install ClamAV in WHM<\/a><\/li>\n<li><a href=\"#step-2-choose-what-users-can-scan\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 2: choose what users can scan<\/a><\/li>\n<li><a href=\"#step-3-scan-email-with-exim\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 3: scan email with Exim<\/a><\/li>\n<li><a href=\"#step-4-keep-the-definitions-up-to-date\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 4: keep the definitions up to date<\/a><\/li>\n<li><a href=\"#option-1-the-one-command-scan-helper\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 1: the one-command scan helper<\/a><\/li>\n<li><a href=\"#option-2-scan-from-the-command-line\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Option 2: scan from the command line<\/a><\/li>\n<li><a href=\"#schedule-a-daily-scan\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Schedule a daily scan<\/a><\/li>\n<li><a href=\"#what-to-do-when-clamav-finds-something\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">What to do when ClamAV finds something<\/a><\/li>\n<li><a href=\"#troubleshooting\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Troubleshooting<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"uh-post-content\" style=\"color:#1F2937;font-size:16px;line-height:1.75;\">\n<h2 id=\"what-clamav-does-on-a-cpanel-server\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-server\" style=\"color:#00D4FF;\"><\/i> What ClamAV does on a cPanel server<\/h2>\n<p style=\"margin:0 0 18px;\">ClamAV is a free, open-source antivirus engine. On a cPanel server it can scan:<\/p>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><strong>Website files<\/strong> in home folders and <code>public_html<\/code>, for malware and web shells.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Email<\/strong>, including messages stored in mailboxes and, through Exim, messages sent by your users.<\/li>\n<li style=\"margin:0 0 8px;\"><strong>Uploads<\/strong> through FTP and other file transfer methods, if you turn that on.<\/li>\n<\/ul>\n<p style=\"margin:0 0 18px;\">ClamAV is strongest on email and known malware files. For PHP malware, add <a href=\"https:\/\/underhost.com\/blog\/how-to-install-linux-malware-detect\/\">Linux Malware Detect<\/a>, which uses ClamAV&#8217;s engine with signatures written for hosting servers. cPanel also suggests ImunifyAV as an alternative scanner, so compare the two before you choose.<\/p>\n<h2 id=\"requirements\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-clipboard-check\" style=\"color:#00D4FF;\"><\/i> Requirements<\/h2>\n<ul style=\"list-style:none;padding-left:0;\">\n<li style=\"margin:0 0 8px;\">\u2713 Root access to WHM on a VPS or dedicated server.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Enough memory. cPanel recommends at least 3 GB of RAM when ClamAV is installed, because the virus database is loaded into memory.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Spare disk I\/O for scans. Run large scans outside busy hours.<\/li>\n<\/ul>\n<h2 id=\"step-1-install-clamav-in-whm\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 1: install ClamAV in WHM<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Log in to WHM as root.<\/li>\n<li style=\"margin:0 0 8px;\">Open <strong>cPanel &gt; Manage Plugins<\/strong>. You can also search for &#8220;Manage Plugins&#8221;.<\/li>\n<li style=\"margin:0 0 8px;\">Tick <strong>ClamAV for cPanel<\/strong> and click <strong>Save<\/strong>.<\/li>\n<li style=\"margin:0 0 8px;\">Wait for the installation to finish. The virus definitions are downloaded as part of the install.<\/li>\n<\/ol>\n<p style=\"margin:0 0 18px;\">Check that it works:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>\/usr\/local\/cpanel\/3rdparty\/bin\/clamscan --version<\/code><\/pre>\n<h2 id=\"step-2-choose-what-users-can-scan\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 2: choose what users can scan<\/h2>\n<p style=\"margin:0 0 18px;\">Open <strong>Plugins &gt; Configure ClamAV Scanner<\/strong> in WHM. Choose the default scan types, such as mail, public web space and public FTP space, and save. You can also allow scanning per package or per account. Users then run scans from the <strong>Virus Scanner<\/strong> page in cPanel.<\/p>\n<h2 id=\"step-3-scan-email-with-exim\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-envelope\" style=\"color:#00D4FF;\"><\/i> Step 3: scan email with Exim<\/h2>\n<p style=\"margin:0 0 18px;\">Open <strong>Service Configuration &gt; Exim Configuration Manager<\/strong> and, in the Basic Editor, look for the malware scanning options under the <strong>Security<\/strong> section. Turning on scanning of outgoing messages helps stop a hacked account from sending infected email from your server. Save, and send a test message to confirm mail still flows.<\/p>\n<h2 id=\"step-4-keep-the-definitions-up-to-date\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 4: keep the definitions up to date<\/h2>\n<p style=\"margin:0 0 18px;\">Virus definitions are updated by <code>freshclam<\/code>. Update them by hand when you want the newest signatures before a scan:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>\/usr\/local\/cpanel\/3rdparty\/bin\/freshclam<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">If freshclam reports an error, check that the server can reach the internet and that the disk is not full.<\/p>\n<h2 id=\"option-1-the-one-command-scan-helper\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Option 1: the one-command scan helper<\/h2>\n<p style=\"margin:0 0 18px;\">The helper script finds ClamAV, updates the definitions, and scans one folder at low priority, so websites stay responsive. It only reports infected files. It never deletes or moves anything.<\/p>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Save the script below as <code>clamav-scan.sh<\/code> on the server, for example in <code>\/root<\/code>.<\/li>\n<li style=\"margin:0 0 8px;\">Check the ClamAV version and definitions:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo bash clamav-scan.sh check<\/code><\/pre>\n<ol start=\"3\" style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Scan a folder, for example one account&#8217;s website:<\/li>\n<\/ol>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>sudo bash clamav-scan.sh scan \/home\/USER\/public_html<\/code><\/pre>\n<h3 style=\"color:#0D1F3C;font-size:21px;line-height:1.3;margin:26px 0 10px;\">The helper script<\/h3>\n<p style=\"margin:0 0 18px;\">Read the script before you run it. It does not download anything except virus definitions.<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>#!\/usr\/bin\/env bash\n# clamav-scan.sh\n# Finds ClamAV (the cPanel plugin or the system package), updates the virus definitions,\n# and scans a folder. It only reports infected files. It never deletes or moves anything.\n#\n# Usage (run as root):\n#   sudo bash clamav-scan.sh check                   show the ClamAV version and definition date. Default.\n#   sudo bash clamav-scan.sh scan \/home\/USER         update definitions, then scan the folder.\n\nset -u\n\nMODE=\"${1:-check}\"\nTARGET=\"${2:-}\"\n\nsay()  { printf '%s\\n' \"$*\"; }\nhave() { command -v \"$1\" &gt;\/dev\/null 2&gt;&amp;1; }\n\nif [ \"$(id -u)\" -ne 0 ]; then\n  say \"Run this script as root (sudo bash clamav-scan.sh $MODE).\"\n  exit 1\nfi\n\n# cPanel installs ClamAV in its own folder; otherwise use the system package\nif [ -x \/usr\/local\/cpanel\/3rdparty\/bin\/clamscan ]; then\n  BIN=\/usr\/local\/cpanel\/3rdparty\/bin\n  say \"ClamAV source: cPanel plugin\"\nelif have clamscan; then\n  BIN=\"$(dirname \"$(command -v clamscan)\")\"\n  say \"ClamAV source: system package\"\nelse\n  say \"ClamAV is not installed.\"\n  say \"On cPanel: WHM &gt; cPanel &gt; Manage Plugins &gt; ClamAV for cPanel.\"\n  say \"Without cPanel: dnf install clamav clamav-update (EPEL), or apt install clamav.\"\n  exit 1\nfi\n\nsay \"== Version and definitions ==\"\n\"$BIN\/clamscan\" --version\n\n[ \"$MODE\" = \"check\" ] &amp;&amp; exit 0\nif [ \"$MODE\" != \"scan\" ]; then\n  say \"Unknown mode: $MODE. Use check or scan.\"\n  exit 1\nfi\nif [ -z \"$TARGET\" ] || [ ! -d \"$TARGET\" ]; then\n  say \"Give a folder to scan, for example: sudo bash clamav-scan.sh scan \/home\/USER\/public_html\"\n  exit 1\nfi\n\nsay \"\"\nsay \"== Updating definitions ==\"\nif [ -x \"$BIN\/freshclam\" ]; then\n  \"$BIN\/freshclam\" || say \"Definition update failed. The scan will use the definitions already installed.\"\nfi\n\nLOG=\"\/root\/clamav-scan-$(date +%F-%H%M).log\"\nsay \"\"\nsay \"== Scanning $TARGET (low priority, report only) ==\"\nnice -n 19 ionice -c3 \"$BIN\/clamscan\" -ri --log=\"$LOG\" \"$TARGET\"\nRC=$?\n\nsay \"\"\ncase \"$RC\" in\n  0) say \"No infected files found. Log: $LOG\" ;;\n  1) say \"Infected files found. Review the FOUND lines in $LOG before you change anything.\" ;;\n  *) say \"The scan ended with an error (code $RC). Check $LOG.\" ;;\nesac<\/code><\/pre>\n<h2 id=\"option-2-scan-from-the-command-line\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Option 2: scan from the command line<\/h2>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># Scan one account and list only infected files\n\/usr\/local\/cpanel\/3rdparty\/bin\/clamscan -ri \/home\/USER\n\n# Scan all accounts at low priority and keep a log\nnice -n 19 ionice -c3 \/usr\/local\/cpanel\/3rdparty\/bin\/clamscan -ri --log=\/root\/clamscan.log \/home\n\n# Move infected files to a quarantine folder instead of deleting them\nmkdir -p \/root\/quarantine\n\/usr\/local\/cpanel\/3rdparty\/bin\/clamscan -ri --move=\/root\/quarantine \/home\/USER<\/code><\/pre>\n<div style=\"background:#FFF7ED;border:1px solid #FDBA74;border-radius:16px;padding:20px 22px;margin:24px 0;\">\n<h3 style=\"margin:0 0 10px;color:#9A3412;font-size:20px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#F97316;\"><\/i> Be careful with &#8211;remove:<\/h3>\n<p style=\"margin:0;color:#7C2D12;line-height:1.7;\">The <code>--remove<\/code> option permanently deletes infected files and emails. Scan without it first, review the report, and keep a backup. Moving files to a quarantine folder is safer.<\/p>\n<\/div>\n<h2 id=\"schedule-a-daily-scan\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-angle-double-right\" style=\"color:#00D4FF;\"><\/i> Schedule a daily scan<\/h2>\n<p style=\"margin:0 0 18px;\">cPanel recommends a daily root cron job outside busy hours. For example, to scan all websites at 03:30 every night:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># crontab -e (as root)\n30 3 * * * nice -n 19 ionice -c3 \/usr\/local\/cpanel\/3rdparty\/bin\/clamscan -ri --log=\/root\/clamscan-daily.log \/home\/*\/public_html<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">Check the log each morning, or send it to your email.<\/p>\n<h2 id=\"what-to-do-when-clamav-finds-something\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-info-circle\" style=\"color:#00D4FF;\"><\/i> What to do when ClamAV finds something<\/h2>\n<ol style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">Read the log. Each infected file is listed with the name of the signature it matched.<\/li>\n<li style=\"margin:0 0 8px;\">Check whether it is a real threat. Old backups, archives and email attachments are common finds.<\/li>\n<li style=\"margin:0 0 8px;\">Move the file to quarantine, or replace it with a clean copy from a backup.<\/li>\n<li style=\"margin:0 0 8px;\">Find how it got there: an outdated plugin, a weak password, or an infected computer used to upload files.<\/li>\n<li style=\"margin:0 0 8px;\">Update the site, change passwords, and scan again. See our <a href=\"https:\/\/underhost.com\/blog\/top-cpanel-security-tips-to-keep-your-hosting-environment-safe\/\">cPanel security tips<\/a>.<\/li>\n<\/ol>\n<h2 id=\"troubleshooting\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-exclamation-triangle\" style=\"color:#00D4FF;\"><\/i> Troubleshooting<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;min-width:600px;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Problem<\/th>\n<th style=\"padding:14px;text-align:left;\">Likely cause<\/th>\n<th style=\"padding:14px;text-align:left;\">Fix<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\"><code>clamscan: command not found<\/code><\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">cPanel installs ClamAV outside the normal path<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Use the full path, \/usr\/local\/cpanel\/3rdparty\/bin\/clamscan.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Scans are very slow or the server is overloaded<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Large folders and limited memory or disk speed<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Scan one account at a time, use nice and ionice, and scan outside busy hours.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">freshclam errors<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">No network access, rate limits, or a full disk<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Check the network and disk space, then try again later.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">High memory use<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">The virus database is loaded into memory<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Add RAM, or consider ImunifyAV instead.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<div aria-hidden=\"true\" class=\"uh-section-divider\" style=\"width:min(100% - 32px, 1080px);margin:44px auto;display:grid;grid-template-columns:1fr 32px 1fr;align-items:center;gap:18px;pointer-events:none;\"><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(0,212,255,0.40),rgba(23,110,165,0.24),transparent);\"><\/span><img alt=\"\" decoding=\"async\" height=\"32\" loading=\"lazy\" src=\"https:\/\/cdn.underhost.com\/android-chrome-192x192.webp\" style=\"width:32px;height:32px;display:block;border-radius:8px;filter:drop-shadow(0 0 14px rgba(0,212,255,0.30));\" width=\"32\"\/><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(23,110,165,0.24),rgba(0,212,255,0.40),transparent);\"><\/span><\/div>\n<\/div>\n<div class=\"uh-blog-cta\" style=\"background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;padding:36px 24px;border-radius:20px;text-align:center;margin:44px 0;box-shadow:0 20px 40px -15px rgba(13,31,60,0.32);\">\n<h2 style=\"margin:0 0 12px;font-size:28px;line-height:1.25;color:#ffffff;\">Need help with this?<\/h2>\n<p style=\"font-size:17px;margin:0 auto 22px;color:#EAF6FF;max-width:720px;line-height:1.7;\">Want malware scanning and clean-up handled for you? Our server management team can set up scanning and respond to infections.<\/p>\n<p><a href=\"https:\/\/underhost.com\/server-management.php\" style=\"background:linear-gradient(90deg,#00D4FF,#0077FF);color:#ffffff;padding:13px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;\">See server management plans<\/a><a href=\"https:\/\/customerpanel.ca\/client\/\" style=\"background:transparent;color:#ffffff;padding:12px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;border:1px solid rgba(255,255,255,0.32);\">Contact @CustomerPanel<\/a><\/div>\n<div class=\"uh-faq-section\" id=\"faq\" style=\"margin:34px 0;scroll-margin-top:90px;\">\n<h2 style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:0 0 18px;border-bottom:2px solid rgba(0,212,255,0.22);padding-bottom:10px;\">Frequently asked questions<\/h2>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Is ClamAV free on cPanel?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. ClamAV for cPanel is a free plugin you install from Manage Plugins in WHM.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Where is clamscan on a cPanel server?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">In \/usr\/local\/cpanel\/3rdparty\/bin\/, together with freshclam and clamdscan.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Does ClamAV detect PHP malware?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">It finds some, but it is strongest on email and known malware files. Add Linux Malware Detect, or use ImunifyAV, for better coverage of website malware.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">How much memory does ClamAV need?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">cPanel recommends at least 3 GB of RAM on a server with ClamAV installed.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Should I use &#8211;remove?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Only after you have reviewed a scan report and have a backup. Moving files to quarantine with &#8211;move is safer.<\/p>\n<\/div>\n<\/div>\n<p><!-- uh-related-start --><\/p>\n<div style=\"background:#F4F8FC;border:1px solid #DCE7F3;border-radius:14px;padding:18px 22px;margin:32px 0 8px;\">\n<h2 style=\"margin:0 0 12px;font-size:22px;\">Related guides<\/h2>\n<ul style=\"margin:0;padding-left:20px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/install-clamav-in-centos-with-cpanel\/\">Updated MARCH 2025: How to Install and Configure ClamAV Antivirus on a VPS or Dedicated Server<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/skip-whm-setup-wizard-on-new-servers-install\/\">Skipping the WHM Setup Wizard on Automated Installs: Test First<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/the-best-way-to-use-cloudflare-with-cpanel-whm-for-better-performance\/\">The Best Way to Use Cloudflare with cPanel &amp; WHM for Better Performance<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/ssh-cpanelwhm-command\/\">cPanel and WHM Scripts: How to Find and Use Them Safely<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/install-gmp-cpanel-centos-servers\/\">How to Install GMP on a cPanel Server (EasyApache 4)<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- uh-related-end --><br \/>\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"Is ClamAV free on cPanel?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. ClamAV for cPanel is a free plugin you install from Manage Plugins in WHM.\"}}, {\"@type\": \"Question\", \"name\": \"Where is clamscan on a cPanel server?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In \/usr\/local\/cpanel\/3rdparty\/bin\/, together with freshclam and clamdscan.\"}}, {\"@type\": \"Question\", \"name\": \"Does ClamAV detect PHP malware?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"It finds some, but it is strongest on email and known malware files. Add Linux Malware Detect, or use ImunifyAV, for better coverage of website malware.\"}}, {\"@type\": \"Question\", \"name\": \"How much memory does ClamAV need?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"cPanel recommends at least 3 GB of RAM on a server with ClamAV installed.\"}}, {\"@type\": \"Question\", \"name\": \"Should I use --remove?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Only after you have reviewed a scan report and have a backup. Moving files to quarantine with --move is safer.\"}}]}<\/script><\/p>\n<h2 id=\"sources\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-book\" style=\"color:#00D4FF;\"><\/i> Sources<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/docs.cpanel.net\/whm\/plugins\/configure-clamav-scanner\/\">cPanel documentation: Configure ClamAV Scanner<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/docs.clamav.net\/\">ClamAV documentation<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Protect your server from malware and viruses by installing ClamAV on WHM. Follow this guide to install, update, and scan your system for threats.<\/p>\n","protected":false},"author":1,"featured_media":5113,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,202,203],"tags":[125,108,136,127,109],"class_list":["post-3553","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-control-panels","category-cpanel-whm","category-security","tag-tag-backups","tag-tag-cpanel","tag-tag-exim","tag-tag-malware-protection","tag-tag-whm"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=3553"}],"version-history":[{"count":9,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3553\/revisions"}],"predecessor-version":[{"id":6944,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3553\/revisions\/6944"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/5113"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=3553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=3553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=3553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}