Security Scanning

Malware Scanning & Quarantine

BlitzPress uses ClamAV and Linux Malware Detect (maldet) for on-demand malware scanning.

Scan Types

Type	Scope	Speed	When to Use
Quick	Common attack paths only	Fast (1-2 min)	Routine checks, suspicious activity
Full	Entire website directory	Slow (5-15 min)	Post-breach investigation, thorough audit
Custom	Specific directory	Varies	Targeted scan of suspicious path

Quick Scan Paths

Quick scans check the directories most commonly targeted by attackers:

• wp-content/uploads/ — most common injection point
• wp-content/plugins/ — vulnerable or nulled plugins
• wp-content/themes/ — backdoors in theme files
• wp-includes/ — core file modifications

Scanners Used

• ClamAV (clamscan) — signature-based detection using ClamAV’s database of known malware
• Linux Malware Detect (maldet) — behavior-based detection specialized for web-hosted malware, PHP shells, and obfuscated code

Scan Results

After a scan completes, the panel shows:

• Total files scanned
• Number of infected files
• List of threats with file path, threat name, and which scanner detected it
• Scan duration

Quarantine

Infected files are moved to a quarantine directory at /usr/local/maldetect/quarantine/. From the panel you can:

• View quarantine — list all quarantined files for a site
• Restore — move a file back to its original location (if it was a false positive)

Virusdie Integration

In addition to on-demand scanning, every site has a Virusdie agent installed at the webroot. Virusdie provides:

• Real-time file monitoring
• Automatic malware cleanup
• Website firewall