HF PanelMalware
See the malware found in your websites, clean or quarantine files, put a file back, and set your own scan policy if your host allows it.
The Malware screen lists the suspicious files the malware scan found in your websites, what was done about them,
and the files kept in quarantine. Files are checked by ClamAV and by HF Panel's own checks for PHP web shells,
injected code and spam redirects in .htaccess.
Where: Control Panel › Security › Malware
Figures
| Figure | What it shows |
|---|---|
| Open findings | suspicious files that still need a decision, and the time of the last scan (UTC) or not scanned yet |
| In quarantine | files kept in quarantine, and after how many days they are deleted for good |
| When something is found | what the scan does with new findings (see Policy) and how often it runs |
Scan your websites
- Click Scan my websites.
The scan runs in the background. You can start one at most every 10 minutes. The policy may also scan every day or every week.
Deal with findings
The Findings table shows the File (inside web/), the Threat and which check found it, its Severity,
when it was Found, and its Status. Click Show history to see older findings too.
| Severity | Meaning |
|---|---|
| High | a web shell or code that runs what a visitor sends |
| Medium | encoded or injected code, a spam redirect, or another ClamAV finding |
| Low | the harmless EICAR anti-virus test file |
| Button | What it does |
|---|---|
| Clean | for injected code: removes the injection and keeps the file. The original goes to quarantine first. |
| Quarantine | moves the file out of your website so it can't run; you can put it back |
| It's safe | marks the file as safe, after you confirm. It is never reported or touched again. Only do this for your own code. |
| Delete now | deletes the file for good, after you confirm |
| Put back | for a quarantined file: puts it back, after you confirm |
Clean appears only for files that can be cleaned: PHP code put in front of a file's own code, added after its
end, or put into its first line, and spam redirect rules in .htaccess. An infected WordPress core file is replaced
by the clean copy of the same WordPress version. A file that is malware from start to end (a web shell) can only be
quarantined or deleted.
Tip: after a finding, update WordPress, its plugins and themes, and change your passwords. Malware usually gets in through an outdated plugin.
Quarantine
The Quarantine card lists the files moved out of your websites and the originals of cleaned files. They are kept outside your home folder, where nothing can run or change them, with their owner, permissions, date and SHA-256 checksum.
| Column | What it shows |
|---|---|
| Why | Moved to quarantine, or how the file was cleaned (Injected PHP code removed, Spam redirect removed, WordPress core file replaced); automatic when the policy did it |
| Kept since / Deleted on | when it was kept, and the day it is deleted for good |
| SHA-256 | the start of the file's checksum (hover to see all of it) |
- Put back opens a dialog. The file goes back where it was, with its owner, permissions and date. If a file with that name is there now (always the case for a cleaned file), tick Overwrite the file there now; otherwise the panel refuses so nothing is lost.
- Delete now deletes the kept copy for good, after you confirm.
Quarantined files are only ever deleted when you click Delete now or when the number of days your host set has passed.
Policy
The Malware policy card shows what your host set: what the scan does when something is found, how often it scans, and the skipped paths.
If your host allows it, you can set your own:
| Field | What it does |
|---|---|
| When something is found | Report only (you decide), Quarantine (new findings are moved to quarantine) or Clean and quarantine (files that can be cleaned are cleaned, the rest are quarantined) |
| Scan | Daily, Weekly or Off |
| Skip these paths (one per line, below web/) | folders or files the scan ignores, e.g. example.com/public_html/cache; * and ? match any characters |
Leave a choice on As the server to follow your host. Click Save.
Emails
You get an email when new malware is found. Each Monday you also get a Weekly malware report if something was found, cleaned or quarantined in the last 7 days. Choose which emails you get in Notifications.