CPGuard Malware Scanner: Complete Guide to Hosting Malware Detection

How to use CPGuard Malware Scanner to scan, detect, quarantine, and remove malware from your hosting server.

By CloudPicked Review Team•Updated June 17, 2026•10 min read

CPGuard Malware Scanner: Complete Guide to Hosting Malware Detection

What is CPGuard Malware Scanner?
How the Malware Scanner Works
Types of Malware CPGuard Detects
Quarantine Process When Malware is Found
Configuring Automatic Scan Schedules
Steps to Take After Malware is Detected
Hosting with Server-Level Malware Scanning
Proactive Measures to Prevent Hosting Malware

What is CPGuard Malware Scanner?

CPGuard Malware Scanner is the cornerstone module of the CPGuard security suite, engineered to detect malicious code, backdoors, PHP shells, cryptominers, web shells, and other dangerous files on hosting servers. It performs both scheduled server-wide scans and real-time scanning of newly uploaded files, catching threats as early as possible.

Scans every file on the server in detail
Detects PHP shells, backdoors, cryptominers, and web shells
Real-time scanning activates when new files are uploaded
Signature database updated automatically every day
Scan reports delivered to administrators by email immediately

How the Malware Scanner Works

The scanner reads every file on the server and compares its contents against a signature database containing millions of known malware patterns. Beyond signatures, CPGuard also applies heuristic analysis — examining code structure and behaviour — to catch new or obfuscated malware that has not yet been added to any signature database.

Signature-based detection: compares against known malware signatures
Heuristic analysis: identifies suspicious code patterns and behaviour
YARA rules: advanced pattern matching for complex malware families
ClamAV integration: uses the ClamAV engine as part of the scanning pipeline

Types of Malware CPGuard Detects

Hosting malware comes in many forms. CPGuard covers all major categories that affect web hosting servers:

Backdoors: hidden scripts that maintain persistent attacker access
PHP Shell / Webshell: browser-accessible server control interfaces
Cryptominers: code that hijacks CPU resources for cryptocurrency mining
Phishing Pages: fake login pages impersonating banks or popular services
Spam Scripts: mass-mail scripts that get the server IP blacklisted
Obfuscated Malware: encoded code that hides its true intent

Quarantine Process When Malware is Found

When CPGuard detects a malware file, it can automatically quarantine it — moving the file to an isolated location where it cannot execute or be accessed from the web. The admin receives an immediate email alert with full details of the detected file and its location. The file can then be permanently deleted or restored if it turns out to be a false positive.

Best practice: Do not delete quarantined files immediately. Always review them first — aggressive WAF rules occasionally produce false positives on legitimate files.

File is moved out of the web root immediately
Website continues running (only the infected file cannot execute)
Admin receives email alert with full file details
Files can be restored from quarantine if confirmed to be a false positive
Permanently delete from quarantine once malware is confirmed

Configuring Automatic Scan Schedules

CPGuard supports fully configurable scan schedules — daily, weekly, or hourly. Running daily scans during low-traffic periods (2–4 AM) is the recommended approach: it avoids affecting website performance during peak hours while still detecting malware within 24 hours of infection.

Configure daily, weekly, or hourly scans to suit your needs
Scan specific directories only for faster targeted checks
Run a full server scan when a breach is suspected
Scan results are logged for historical review and forensic analysis

Steps to Take After Malware is Detected

When malware is found, follow a systematic process rather than only deleting the identified files. Malware commonly creates multiple backdoors simultaneously, so cleaning just what the scanner found first often leaves the server vulnerable to immediate re-infection.

1. Quarantine or delete all malware files identified by the scanner
2. Review files modified during the suspected attack window
3. Change all passwords: FTP, control panel, email, WordPress admin, database
4. Update WordPress core, all plugins, and all themes to latest versions
5. Run a second scan to confirm the server is now clean
6. Submit a review request in Google Search Console if the site was blacklisted

Hosting with Server-Level Malware Scanning

Not all hosting providers include server-level malware scanning. Always ask before signing up. AsiaGB.com provides hosting and VPS with server-level security protections, SSD storage, DirectAdmin control panel, 24-hour Thai-language support, and 99% uptime — giving your sites a protected environment from day one.

Ask your provider whether server-level malware scanning is included
Good hosting detects malware and alerts you before your site is blocked
Choose providers with a strong security track record
Fast support response is essential when a security incident occurs

Proactive Measures to Prevent Hosting Malware

Prevention is always easier than recovery. These proactive steps should be in place regardless of whether CPGuard is active on your hosting server:

Keep WordPress, all plugins, and PHP updated at all times
Use a password manager and passwords of 16+ characters
Set correct file permissions: PHP files 644, directories 755 (never 777)
Maintain daily backups with off-site storage
Enable WAF on your hosting to block common attacks at the perimeter
Remove unused plugins and themes to reduce the attack surface

Frequently Asked Questions

Does CPGuard Malware Scanner scan all file types?

CPGuard scans all file types on the server, including PHP, HTML, JavaScript, and shell scripts. It prioritises high-risk file types like PHP but can be configured to scan all types comprehensively.

Will my website go down when malware is found?

Not necessarily. CPGuard can quarantine infected files without taking the website offline. The site continues running — the infected file simply cannot execute. The administrator receives an alert to review and remediate while the site stays up.

How accurate is CPGuard at distinguishing malware from legitimate files?

Accuracy is high but not 100%. False positives can occur, especially with obfuscated code or scripts that use patterns resembling malware. Always review quarantined files before permanently deleting them.

Does CPGuard require manual setup or does the hosting provider configure it?

The hosting provider's server administrator installs and configures CPGuard at the server level. End users simply use the dashboard available within DirectAdmin. If your provider has CPGuard, it is typically already active on your account.