Skip to content
Client area

Help Centre › Security and Armor

How do I scan my website for malware in cPanel?

Every Tremhost web hosting plan runs Imunify360, which scans your files for malware at server level. In cPanel, open Imunify360 under Security to see what it has found; if it lists infected files, or your site shows pages you never wrote, ask us or send the domain to Armor SOS for a free triage.

  1. Log in to cPanel from the client area.
  2. Under Security, open Imunify360. If you can’t see it, type Imunify in the search box at the top of cPanel.
  3. Open the malware scanner section. It lists any infected files with their path and what happened to each, for example cleaned, quarantined or only detected.
  4. If your screen offers a button to start a scan, run one. Large sites can take a while.
  5. If anything is listed, take a screenshot and open a support ticket with the domain.

Other checks worth doing

  • Virus Scanner: some cPanel accounts also have a Virus Scanner icon. If yours does, scan the whole home directory.
  • Google: search site:yourdomain.com and look for pages you never wrote, such as gambling, pharmacy or loan pages. Check your domain on Google’s Safe Browsing site status page.
  • WordPress: look under Users for administrators you didn’t create, and under Plugins for plugins you didn’t install.
  • On a phone: open the site over mobile data while logged out. Some hacks redirect only phone visitors and hide from logged-in owners.

A clean scan doesn’t prove a site is clean. Scanners catch known malicious files, but can miss a backdoor hidden in the database or a rogue admin account. If customers report strange pages or redirects, believe them.

If something is found

  • Don’t delete the site or restore a random backup. You can restore the infection with it and lose the evidence of how they got in.
  • Change your cPanel, WordPress, FTP, database and email passwords from a device you trust.
  • Send the domain to Armor SOS. Triage is free the same working day, Monday to Friday, 08:00–17:00, and the cleanup is quoted before any work starts.

Tired of doing this yourself? Managed WordPress includes malware scanning and removal, from $15 a month.

Still stuck? Open a support ticket or message us on WhatsApp +263 73 563 9917, Monday to Friday, 08:00–17:00 CAT.

Updated 6 November 2026. Something here out of date? Tell us.

Ask us on WhatsApp