RootScan: malware protection for cPanel & WHM

Run "sudo rootscan update" on the server (or press Update now in WHM, under Plugins, RootScan). RootScan checks a signed notice from rootmanage.com, downloads the new version, checks its checksum, saves the old version, installs, and tests that the new one starts. If anything fails, the old version is put back by itself. Your licence, settings, quarantine and firewall lists are kept. "sudo rootscan update --rollback" goes back to the previous version later, and you can switch on automatic updates for small versions. If you have version 2.0 or older, install the newest package once (the install command in your dashboard); after that the update command is there.

Yes. Every RootManage account can take one free key. It covers one server with up to 10 cPanel accounts and has every feature on this page except RootScan Email and white-label, which are part of the paid plans. There is no trial period and no card is asked for. If your server has more than 10 accounts, or you run more servers, choose a paid plan.

Create a RootManage account, confirm your e-mail address, and open Dashboard → RootScan. Your key is created for you and the install command is shown next to it.

RootScan is a security tool that installs inside WHM and cPanel. It finds web shells, back doors and injected code in hacked websites, cleans them, watches for new attacks every few minutes, and can add a server firewall and web rules. Server owners see every account in WHM, and each account owner can scan and clean their own site from cPanel.

No. RootScan is a separate product made by RootManage. It covers malware scanning and cleaning, WordPress checks, a log-based firewall and ModSecurity rules. It does not include the large threat-intelligence network, kernel-level protection or the vendor rule sets of a big commercial product, and it is new: it has not had years of use on thousands of servers. Use it together with updates, backups and a network firewall.

cPanel and WHM with the Jupiter theme. Plesk and DirectAdmin are not supported yet.

Scanning only reads files. When you press Clean, injected code is cut out of the file, a changed WordPress file is replaced by the genuine one, or a file that is only malware is moved to quarantine. A backup of every change is kept and Undo puts the file back exactly as it was. Nothing is deleted unless you press Delete. Automatic cleaning is off until you switch it on.

No. The firewall and the web rules are off until you turn them on in WHM, and both have a safe first mode (monitor only / detect only) that logs what they would do without blocking anything. Turning the firewall on adds your own address to its allow list first, and it never blocks private addresses, the server's own addresses or Cloudflare.

To RootManage, only the licence check: your key, a hashed server id, the hostname, the server addresses, the RootScan version, the number of cPanel accounts, whether RootScan's own program files are unchanged, and a few counts (threats found, addresses blocked, whether the firewall is on) that you see in your dashboard. If you press "Report false alarm", the file's fingerprint (a hash) and the rule name are sent so the rule can be fixed; never the file name or the file. File names and file contents are never sent. For WordPress checks the server downloads public checksum lists from WordPress.org, which reveals only the WordPress and plugin versions you use. If you set up Telegram or a webhook, alerts go there.

RootScan keeps working from its last confirmed licence for 7 days. After that, scanning pauses until the server can confirm the licence again. Licence answers are digitally signed, so they cannot be faked or edited.

No, and it does not claim to be. RootScan Email works on behaviour and reputation: it finds which account and which website folder is sending an unusual amount of mail, freezes that account's queued messages and (if you choose hold mode) switches its outgoing mail off in cPanel, checks whether the server's mail IP is on the main spam blacklists, and grades every domain's SPF, DKIM and DMARC with the exact fix. It looks at the headers and text of queued outgoing messages for common spam signs (a quick check, not a trained spam filter) and it does not filter incoming mail, so it makes no catch-rate claims. It is part of the paid plans (Pro and Unlimited), runs on your server, and only alerts unless you turn hold mode on.

You can read it, but it is not open source. RootScan is plain PHP and it runs as root on your server, so you should be able to see what it does: open the files in /opt/rootscan, or read them before you install. The licence (LICENSE.txt in the package) lets you read, audit and test the code and use it on every server you hold a key for, including the free plan. One exception: the code of the paid features (RootScan Email and white-label) is delivered encrypted, and only a server with a valid paid licence receives the key, so those parts are not readable on the free plan. It does not allow reselling or redistributing RootScan or its rules, offering it as a service, removing the licence check, using paid features without the paid plan, or building a competing product from it.

A hacker who only controls a website cannot change RootScan: it runs as root and its files belong to root. It also guards itself. Every night it checks its own files (changed or extra files, wrong owners or permissions, a missing schedule, or no scan for days) and e-mails you if anything looks wrong; "rootscan verify" shows the same on demand. It closes the usual hiding tricks: shells in folders named tmp, mail or node_modules, very large padded files, programs stuck on the end of a picture, files built to break pattern matching, and CGI, Python or JSP shells. When it cleans or restores a file it does so as that account's own user and never through a symlink, so a swapped folder cannot make it write somewhere else. No software can promise more than this: someone who already has root on the server can change anything, RootScan included, which is why it reports changes and why the server itself must be kept updated.

Cleaning the files is not enough if the attacker left a way back in. RootScan looks for the usual ones: a PHP file loaded before every page (auto_prepend_file in .htaccess or .user.ini), pictures set to run as PHP, redirects that only fire for visitors from Google, must-use plugins, suspicious cron jobs, and a WordPress administrator that was not there before (it keeps a list of administrators per site and tells you about a new one or a changed e-mail address). It can also block PHP from running in the uploads folder of every WordPress site with one button, and it checks that visitors who say they are Googlebot really are, so real search engines are never blocked and fake ones are.

No. Every scan, the PDF reports, the outgoing-mail check, the database check, the Telegram commands and the cleaning run on your own server, using its own CPU. RootManage only confirms the licence, delivers rule and program updates and receives the few counts shown in your dashboard. That is also why RootScan keeps working when RootManage cannot be reached for a few days.

Yes, when you press the button. The database check looks for injected scripts and hidden frames in WordPress posts and settings; cleaning removes only the injected part and saves the old text, so Undo puts it back. Plugin updates are downloaded from WordPress.org only, checked, backed up and swapped in; Undo brings the old version back. Neither happens by itself unless you turn on automatic cleaning.

Yes. Some plugins use functions that look like attacks, so a finding is a reason to look, not proof. Findings are marked Malicious, Suspicious or Review, WordPress files that match WordPress.org are never flagged, and you can ignore a file you have checked. A firewall can also block the wrong address, which is why it starts in monitor mode and has an allow list.

No. A key works on one server. Each server can use one free key, and only one free key can be used from one internet address. These limits are checked on rootmanage.com, and the licence is checked again every few hours. Servers with more accounts need a paid plan.