What the ClamAV plugin adds to cPanel
The cPanel ClamAV plugin installs the Clam AntiVirus engine, a signature database and a scanning interface on a server you control. It gives each cPanel account a Virus Scanner icon and gives root a scheduled scanner in WHM.
This is a server-owner job. On shared hosting the provider installs it once for the machine, and an account holder cannot add it. You need root WHM on a VPS or dedicated server running cPanel & WHM 110 or later on AlmaLinux 8 or 9, CloudLinux 8 or 9, or Ubuntu 22.04 or 24.04.
- Scans files and mailboxes on demand and on a schedule.
- Signature-based detection, updated by freshclam from ClamAV mirrors.
- No licence fee. The plugin ships with cPanel.
Install ClamAV from WHM Manage Plugins
The whole install is one checkbox and a wait. Expect three to eight minutes on a normal VPS while packages and signatures download.
- Log in to WHM as root on port 2087. A reseller account cannot see this menu.
- Use the search box and type
plugins, or open Home, then cPanel, then Manage Plugins. - Find
clamavin the list and tick Install ClamAV for cPanel. Choose Install and keep updated so upgrades run with cPanel updates. - Confirm and wait for the task to finish. Do not reload the page mid-install.
- When the row shows Installed, open Plugins, then ClamAV Scanner to see the engine and signature versions.
Confirm the install and the signature date
The plugin can finish while the signature download fails, which leaves a scanner with no database. Check the date, not just the status.
- In WHM open Plugins, then ClamAV Scanner. The page should show a version and a signature date within the last day or two.
- Over SSH as root, run
clamscan --version. It prints the engine version and the signature count. - Log in to any cPanel account and look under Advanced for the Virus Scanner icon.
- You know it worked when that icon opens a scan form and the WHM page shows a fresh signature date.
Run a scan from cPanel and from SSH
The account-level icon is enough for one site. For a full server sweep, the command line is faster because clamdscan reuses the loaded signature database.
- Single account, from cPanel: open Virus Scanner, choose Scan Public Web Space or Scan Entire Home Directory, run it and read the report.
- Single account, from SSH:
clamdscan -r --infected /home/USER/public_htmland read the infected list it prints. - Whole server, off-peak:
clamscan -r -i --log=/root/clamscan-$(date +%F).log /home. Run it undernice -n 19so web traffic keeps priority. - Schedule it monthly with cron:
0 3 1 * * nice -n 19 clamdscan -r -i /home >> /var/log/clamav-monthly.log 2>&1.
Read the report as a list of paths. A hit under a cache or upload folder is usually a malicious upload, not a server compromise, but treat any hit in a PHP file as urgent.
Keep the signature database fresh
ClamAV is only as good as yesterday's signatures. The plugin schedules freshclam, but a blocked outbound connection or a locked database stops updates silently.
- Run
freshclammanually after the install and read the output, not just the exit code. - Confirm outbound HTTPS 443 and DNS resolution work from the server; mirrors are reached over HTTPS.
- Check the signature date in WHM weekly. A date older than three days means updates are failing.
- Restart the daemon after a manual database change:
systemctl restart clamd.
Common ClamAV failures and fixes
Five failures account for almost every install that looks fine and scans nothing.
| Symptom | Cause | Fix |
|---|---|---|
| No Virus Scanner icon in cPanel | The feature is not enabled for that package or theme | WHM, then Feature Manager, then enable Virus Scanner for the package, then save |
| Signature date stuck or empty | freshclam cannot reach the mirrors, or another freshclam holds the lock | Run freshclam by hand, read the error, allow HTTPS 443 out, wait for the lock to clear |
| clamd will not stay running | The database is missing or unreadable by the clamav user | Run freshclam first, then systemctl restart clamd and read the journal for the file it names |
| Scan stops on a large home directory | Default file-size and recursion limits | Add --max-filesize=100M and exclude cache folders, or scan one account at a time |
| Server slow during the scan | Full scan at peak with no IO priority | Move the cron to 02:00 to 04:00 and wrap the command in nice -n 19 |
What ClamAV does not protect against
ClamAV matches known signatures. It does not stop a new PHP backdoor from being uploaded, block a vulnerable plugin from being exploited, or clean an infected database. Treat it as one layer beside updates, a WAF and tested backups.
On cPanel hosting the provider runs that layer for the machine. On your own VPS, pair it with server backups you have restored at least once, and keep PHP and the control panel patched. Email support@webji.services with the scan log if a hit names a file you do not recognise.
Frequently Asked Questions
Can I install ClamAV from cPanel instead of WHM?
No. Installation happens in root WHM under Manage Plugins. A cPanel account only gets the Virus Scanner icon after the server owner installs the plugin and enables the feature for the package.
Is the ClamAV plugin free on cPanel?
Yes. It ships with cPanel and WHM at no extra licence cost. You pay only in server resources while a scan runs and in the bandwidth used to download signatures.
How long does a ClamAV scan take?
A single public_html folder usually finishes in a few minutes. A whole /home tree with mail can take one to three hours, which is why it belongs in a nightly cron window rather than a working afternoon.
Where does cPanel store the ClamAV signatures?
Inside the cPanel third-party tree, under the clamav share directory. You do not edit it by hand. Run freshclam to update and check the signature date in WHM, then ClamAV Scanner.
Why is the Virus Scanner icon missing from cPanel?
The plugin is installed but the feature is not enabled for that package. Open WHM, then Feature Manager, find Virus Scanner and enable it for the package, then ask the user to reload cPanel.
Does ClamAV block malware before it runs?
Not for web uploads. It scans files and mail on demand or on a schedule, so an infected file can sit on disk between scans. A WAF, file permissions and prompt updates stop more attacks than the scanner does.