Run a scan and review results

In cPFence v4+, open Threat & Malware Detection to scan a server or website path. Administrators can run scans; support users need target-server access and scan/history/finding permissions. Stop, restore, quarantine, and delete have separate permissions. The target needs an eligible license and connection.

Scan Summary covers malware scans. Use the separate WordPress Integrity, Suspicious Activity and Rootkit Scans tabs for their checks and retained records.

Choose the server

Select Scan Summary and choose Local or one secondary server in Server scope. This selection controls New scan, history, details, and quarantine.

The sidebar’s server selection is separate bulk scope for Advanced Tools. New scan scans one server.

Scan Summary with Report missed malware, the scan summary cards, Bulk quarantine actions and Safe files. Servers and targets are blurred. Select the image for full size; use browser Back to return.

Start a scan

1. Click New scan and check the server in Start a new scan.
2. Choose Smart scan for selected file types, Full scan for eligible files under /var/www, or Custom path for one path beneath it.
3. For custom scanning, enter Path under /var/www or use Choose Account to Scan. Check the autofilled path; use an existing directory without symlinks.
4. Check the quarantine setting: automatic quarantine can move detected files out of the website.
5. Click Start scan, or Cancel to leave without starting.

Custom-path scan controls; identities and paths blurred. Select the image for full size; use browser Back to return.

Accepted work runs in the background. Only one Full or Smart scan runs at a time, and a Custom scan can run alongside it. A rootkit check waits until a Full or Smart scan finishes. Full and Smart can include enabled mail/integrity checks. Starting does not prove completion.

Review known-clean files before recovery

If a file was flagged incorrectly, verify its contents and add a narrow exception before restoring it. See identify and restore quarantined files.

Run a scan from the CLI

As root on the licensed target server, choose the command for your task:

Task	Command
Full scan	cpfence --full-scan
Smart scan	cpfence --smart-scan
One path	cpfence --custom-scan /var/www/EXAMPLE/public_html
Progress and results	cpfence --scan-status
Stop active full/smart/custom work	cpfence --stop-scan

Replace the custom path with your actual path. Follow the log path printed by the command; tail -n 25 -f LOG_PATH follows that file. Closing the terminal does not stop accepted background work. Scan time depends on files and available resources; no fixed completion time is promised. The compatibility detection history is /var/log/cpfenceav/infections.history; use the current scan record to confirm actions.

If a scan fails to start, follow scan startup troubleshooting.

Monitor the result

Watch the activity card and Recent scans. Refresh reloads records; navigating away does not cancel the scan.

Status	Meaning
Running	Work is active; wait or use Stop scan.
Clean	Completed with no recorded malware findings within its scope.
Infected	Completed with findings; inspect each action.
Failed	Review failure stage and diagnostics; findings can be partial.
Stopped	Cancelled; earlier file actions remain.
Interrupted	Did not finish normally; inspect diagnostics before retrying.

Stop scan confirms and stops this server’s active scan. It does not undo quarantine.

Use Search, Status, Mode, or Started since, then Apply filters to find a record. Needs attention is the number of files waiting for a decision right now; the other totals follow the selected period.

No active threats is not proof that every protection check completed. Review this server’s latest successful protection check. Protection reminders → Review settings opens settings for the named server; dismissing a reminder does not enable protection or resolve a finding.

Open Details to compare Findings, Quarantined, and each file’s Action. A finding does not prove quarantine succeeded. Beside each file, Preview shows its content and Report false positive sends it to cPFence support for review (see report a false positive). For errors, expand Diagnostics → Load bounded raw log. Details show at most the first 100 findings.

For row actions, interrupted results, or a file already removed during external remediation, follow resolve a malware finding.

Recorded scan outcome; identities and paths blurred. Select the image for full size; use browser Back to return.

Decide on unresolved files

Select Needs attention on Scan Summary, or Review unresolved files on the status card when it shows Action needed, to open Unresolved files. It lists every file on the selected server that still needs a decision.

1. Use Search file or folder or Signature, then Apply filters, to narrow the list. Use Previous and Next for more pages.
2. For each file, choose Quarantine (remove it from the website and keep a copy), Mark as safe (keep it and stop warning) or Delete (remove it for good).
3. To act on many files at once, select them, or select every file on the page, then choose Quarantine selected or Mark selected as safe. A progress bar shows the work.
4. Read the confirmation and choose Move to quarantine, Mark as safe or Delete permanently, or Cancel to leave the files unchanged.

If a file no longer exists, its row offers Mark fixed instead. To clear every finding whose file is already gone, choose Mark deleted files fixed on that status card; cPFence checks each file first and keeps scan history.

Unresolved files on a server where every file has been handled; each row offers Quarantine, Mark as safe and Delete when files need a decision. Select the image for full size; use browser Back to return.

Safe files

Select Safe files on Scan Summary to see the files and folders you marked as safe. cPFence leaves them where they are and skips them in scans.

If you are no longer sure about a file, choose Scan again, or select several and choose Scan selected again. Its warning comes back under Unresolved files and future scans check it again.

Two safe files selected for Scan selected again. Paths are blurred. Select the image for full size; use browser Back to return.

Review files before recovery

Select Bulk quarantine actions on Scan Summary, or use Advanced Tools → Restore Quarantined Files, for the selected single server. The Files quarantined card shows how many files are in quarantine. Search and Preview stored content before selecting files and clicking Restore. Check the server/count in confirmation; Cancel keeps files quarantined.

Restore returns stored bytes to the original path. Existing destinations and missing payloads prevent recovery. Select Also mark as safe to keep the restored file and skip it in future scans; you can undo this under Safe files. Without it, the file can show Restored — action required. Returning malware can expose the site again. Delete permanently removes a detected file without quarantine recovery.

Follow exclusions and quarantine for the complete recovery steps.

Report a false positive or missed malware

Report a false positive

1. Open the scan’s Details and select Report false positive next to the file.

Preview and Report false positive appear beside each file. Paths and server are blurred. Select the image for full size; use browser Back to return.

2. Check the summary: file, signature, server, detection time and scan. The flagged file is attached in a ZIP with the password infected and sent only to cPFence; files over 5 MB are cut to their first 5 MB. Your license key and main server IP are included so support can identify your installation.
3. Optionally name the Plugin, theme or application and explain Why is this safe?
4. Enter your Reply email and select Send report.

The file, signature and scan details are filled in automatically. Identifying values are blurred; nothing was sent. Select the image for full size; use browser Back to return.

Support reviews the signature and, if it is a false positive, fixes it for every server. The file then shows Reported to cPFence with the date. A report does not create an exception: to keep a known-safe file now, use exclusions and quarantine.

If the detection is no longer in scan history, select Can’t find it? Send a manual report on Scan Summary, or Send a manual report in Advanced Tools, and include the signature ID, file path and the plugin or theme it belongs to.

Report missed malware

1. Select Report missed malware on Scan Summary.
2. Choose the File: the malicious file itself, up to 5 MB, not a ZIP or password-protected archive.
3. Enter your Reply email and select Check and send.

Upload the malicious file itself, not an archive. The reply email is blurred; nothing was sent. Select the image for full size; use browser Back to return.

cPFence first checks the file against the installed signatures. If cPFence already detects it, the form says so and nothing is sent. Otherwise the file goes only to cPFence support, in a ZIP with the password infected, and you receive a reference number.

Earn $1 credit for each confirmed report

For each report cPFence confirms as real malware found on your server that it did not detect, $1 is added to your account credit in the client area, and you get an email when it is applied. Test files, public samples and duplicates don’t qualify. See Missed Malware? We’ll Credit You $1.

Scan several servers

Use Advanced Tools → Run Full Scan Across Servers, Run Smart Scan Across Servers, or Run Custom Scan Across Servers. Check sidebar bulk targets and confirmation, then read every server’s output.

Submission is not completion; unavailable or rejected servers leave partial coverage. Check each server’s final Scan Summary record. Stop All Running Scans acts on bulk targets and is broader than Stop scan.