Security
Scanning For and Removing Malware
Every hosted site is scanned for malware automatically each night, and you can run a scan yourself at any time from the site's Security tab.
Understanding what the scanner does, and just as importantly what it does not do, is the difference between a site that is genuinely clean and one that looks clean.
Running a Scan
- Go to Websites and open the site.
- Open the Security tab, described as "Vulnerability scanning, malware detection, IP blocking, and login hardening."
- Find the Malware scan card.
- Click Scan now.
The button changes to "Scanning" while it runs. Scans read every file under your site's web root and can take several minutes on a large site.
A scan also runs automatically every night without you doing anything, so the result on the card is never more than a day old.
Reading the Result
Clean. The card reports the number of files scanned, phrased as "Clean" followed by the file count. Nothing suspicious was found.
Threats found. The card reports how many, and lists each detected file with its path and a Quarantine button.
Failed. The scan could not complete. Try again, and if it keeps failing, open a support ticket.
No results yet. No scan has ever run on this site. The card says "No scan results yet. Click Scan now to run the first scan."
A Scan history section below keeps the last ten scans so you can see when a site went from clean to infected, which is often the fastest way to narrow down when a compromise started.
Quarantining a File
Click Quarantine next to a detected file. The file is moved out of your site into a quarantine area on the server, so it stops executing but is not destroyed.
Quarantine is the only remediation the scanner offers. There is no "clean", "disinfect", or "repair" action, because there cannot safely be one: a legitimate file with malicious code injected into it cannot be restored to its original state by a scanner that has never seen the original. Getting the original file back is what your backups are for.
Quarantine also has no self-service restore. If you quarantine a file you needed, recover it from a backup rather than looking for an undo button. See Restoring From a Backup.
Automatic Quarantine
On Managed WordPress plans, files found during the nightly scan are quarantined automatically and flagged in the panel with an Auto-quarantined badge. An alert appears on your dashboard telling you how many files were dealt with and that no manual action is required.
On every other plan, detection is automatic but quarantine is not. You need to open the Security tab and click Quarantine on each detection yourself.
If nobody checks the panel regularly, automatic quarantine is one of the strongest arguments for a managed plan. A detection on an unmanaged plan sits there until a human notices it.
What the Scanner Cannot Find
This is the part that matters most, and it is the reason a clean scan is reassuring rather than conclusive.
The scanner matches files against known malicious code. It does not:
- Read your database. Injected spam links, rogue administrator accounts, and modified options all live there and are invisible to a file scanner.
- Detect a legitimate file that has been modified. A single line added to a real theme file may not match any known signature.
- Detect a rogue account or scheduled task, which is configuration rather than code.
- Detect a stolen credential. If someone has your password, they need no malware at all.
- Assess whether a plugin is vulnerable. That is a separate vulnerability scan, also on the Security tab.
A clean scan on a site that is redirecting visitors, sending spam, or showing content you did not write does not mean the site is clean. It means the infection is not in a file the scanner recognises. Compare against a known-good backup instead. See What to Do If Your Site Is Hacked.
The Right Way to Clean an Infected Site
Quarantining detected files is containment, not a cure. The reliable cure is a restore.
- Take the site offline with password protection while you work.
- Quarantine everything detected, to stop it executing immediately.
- Find when the infection started, using the scan history and your error logs.
- Restore from a backup taken before that date, to staging first, then to live once you have checked it.
- Change every credential: application administrators, database, SFTP, SSH.
- Update everything, because the way in was almost certainly an out of date component.
- Scan again to confirm.
- Take a fresh backup of the clean site.
What to Do If Your Site Is Hacked walks through each of those in full.
The Other Protections on the Security Tab
The malware scan is one card among several, and the others are worth turning on while you are there.
Vulnerability scan checks your installed plugins and themes against a public vulnerability database, so you find out that a component is exploitable before it is exploited.
Login brute-force protection watches WordPress sign-in attempts and blocks an address automatically after repeated failures within a short window.
IP block list lets you deny a specific address or range at the web server.
Country filtering restricts access by country where your audience is genuinely regional.
Hotlink protection stops other sites embedding your images and consuming your bandwidth.
PCI-DSS hardening, on WooCommerce sites, applies a set of configuration changes in one action: disabling file editing from the dashboard, forcing an encrypted admin session, and blocking a legacy remote interface commonly used in attacks.
The Platform Firewall
Separately from anything on this page, a managed web application firewall runs in front of every site and blocks common attack patterns such as SQL injection, cross-site scripting, and path traversal before they reach your application.
It is centrally managed. There is no per-site rule list, no toggle, and no blocked-request log for you to browse. If a legitimate request of yours is being blocked, that is a false positive and support can add an exclusion: email support@kapsulehost.com with the exact URL, the time, and what you were doing.
Troubleshooting
The scan keeps failing. Very large sites can exceed the scan time limit. Remove old archives and unused installs from the web root, then try again. Contact support if it persists.
A file I know is safe was detected. False positives happen, particularly with minified JavaScript and licence-checking code. Do not quarantine it if you are certain, and tell support so it can be looked at.
I quarantined the wrong file and the site broke. Restore that file from a backup.
The scan is clean but my site was blacklisted by a search engine. The infection may be in the database, or the listing may be stale. Clean the site properly, then request a review through the search engine's own tools.
I want to scan more often than nightly. Run Scan now whenever you like. There is no limit.
Malware keeps coming back. You have not closed the way in. Restore from a clean backup rather than cleaning in place, change every credential, and update everything.