How to Install ClamAV on cPanel for Virus Scanning

What ClamAV Does (and Doesn't)

Via WHM's plugin manager, then scan from either cPanel or SSH:

1. WHM — Home → cPanel → Manage Plugins; find ClamAV for cPanel and install (server administrators, or your own VPS with root).
2. Verify — the *Virus Scanner* icon appears in every account's cPanel under Advanced.
3. Scan from cPanel — open Virus Scanner, choose scope (Scan Mail, Scan Public Web Space, Scan Entire Home Directory or the whole account), run, review the report.
4. Scan via SSH — clamscan -ri /home/username for a recursive, infected-only listing of the account.
5. Automate — a cron entry for weekly clamscan runs with mail-to-admin output.

ClamAV is the baseline, not the whole wall — the layering notes below explain what pairs with it. Infection response beyond scanning sits on the website security services page, and the cleanup playbook in the clean hacked website guide.

Installing via WHM Manage Plugins

The questions below cover the practical decisions: whether cPanel already includes a virus scanner on your plan, how to scan only the mail directory when quota is tight, what to do with the infected files ClamAV finds, whether ClamAV or Maldet is the better PHP-malware catcher, and how to schedule scans so they happen weekly rather than when memory strikes. Each answer names the exact screen, command or cron line involved — the same ones our engineers use on managed servers — so the protection runs itself after one setup session.

Scanning From cPanel

cPanel is the Linux control panel: files, mailboxes, databases, SSL and one-click installs live there. The login is separate from the WebJi® client area, where invoices and tickets live. If a mailbox exists in cPanel and mail still fails, check MX and the mail client ports before you recreate the account.

Scanning via SSH (clamscan Commands)

Root (or sudo) on a VPS means you patch the OS, the firewall and the web server yourself unless the plan is managed. Shared hosting does not include root, on purpose. If you only need WordPress, a managed or shared plan is the smaller job.

Automating Scans With Cron

A cron job should call the exact script the app documents, on the interval it documents, and write output to a log you can read. A job that emails you every minute means the path or the PHP binary is wrong. Disable overlapping runs for anything that imports or sends mail.

Layering: ClamAV + Imunify/Maldet

Two practical notes on cron-scheduled scans: it interacts directly with caching and database response, and misconfiguration is the most common cause of 'hosting is slow' tickets. WebJi® support checks it as part of standard migrations.