About RootScan
RootScan is a separate product that installs inside WHM and cPanel. It scans the websites on your server, quarantines or cleans what it finds, watches for new attacks every few minutes and can add a firewall and web rules. It is free for up to 10 accounts, and paid plans add RootScan Email, white-label branding and more accounts.
It runs on your own server, so scans and cleaning use your server and not ours. Each server has its own licence key, created when you register.
What it does
- Scans every account for web shells, backdoors, injected code and known vulnerable plugins
- Cleans infected files with an undo, restores genuine WordPress files or quarantines what it cannot clean
- Watches for new attacks every few minutes and sends alerts by e-mail, Telegram or webhook
- Optional server firewall, web rules (ModSecurity) and bot verification
- Health score, server audit, monthly PDF reports and a Timeline of what probably happened
- RootScan Email (paid plans): mail reputation, outgoing spam watch and an e-mail quarantine
What it does not do
- It does not stop a hacker who already has root on the server: it reports changes, it cannot prevent them
- The firewall and web rules start switched off (monitor mode), so nothing is blocked until you turn them on
- It is not an incoming mail filter
Schedule: Quick scan every 5 minutes, with full scans, reports and licence check-ins on a schedule
How it updates
RootScan updates itself on request. In WHM press Update now, or run the command below. It downloads the new version, checks its checksum, keeps a backup and rolls back by itself if something fails. If you switch on auto-update, updates within the same major version (for example 2.x to 2.x) install at night.
sudo rootscan updateRootScan version history
- v2.9.0NewImproved
Paid features delivered per licence, and everything from 2.2 to 2.8 reaches every server
The first version since 2.1.1 that goes to every installed RootScan. It brings in all the features built in 2.2.0 to 2.8.0 (listed below) and changes how the paid features are delivered.
Available to everyone since 12 October 2026.
What changed
- RootScan Email and white-label branding are delivered to servers that have a valid paid licence when the licence is checked, instead of being part of the downloaded package
- A paid server needs a licence check-in less than 3 days old to keep the paid features on
- Right after an update RootScan checks the licence, so a paid server gets its features at once
- Includes everything from 2.2.0 to 2.8.0, which are described in the entries below
How it affects you
- Free plan: nothing is taken away. The scanner, cleaner, firewall, web rules and reports for up to 10 accounts keep working
- Paid plans: Email and white-label keep working as long as the server can reach rootmanage.com at least once every 3 days
- A server on 2.1.1 or older jumps several versions at once, so read the entries below to see what is new
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.8.0ImprovedSecurity
Paid features packaged so only a paid licence unlocks them
The paid features (RootScan Email and white-label) were moved out of the open part of the package and are unlocked only by a valid paid licence. It also bundles the licence notice, the web rules fix and the bot-protection switch from 2.7.x.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- RootScan Email and white-label are unlocked by the licence and not by a setting on the server
- Free servers receive the same engine, without the paid parts working
- Includes the licence notice (2.7.2) and the web rules fix and bot-protection switch (2.7.1)
How it affects you
- Free plan: no change in what you can do
- Paid plans: no change in what you can do, as long as the licence is valid
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.7.2Notice
Licence notice and terms added
A plain-language licence notice now ships with RootScan, so it is clear what you may and may not do with the files.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- A LICENSE.txt with the terms is included in the package
- Every code file carries a short copyright line
- The installer shows the terms, and the public FAQ explains whether the code can be read
How it affects you
- No change in how RootScan works
- The code stays readable, but RootScan is not open source
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.7.1FixedNew
Web rules fix found on a real server, and a bot-protection switch
On a real cPanel server Apache refused the RootScan web rules file. This version fixes that, and adds an on and off switch for bot protection.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- Fixed: Apache rejected one web rule with a "missing closing parenthesis" error. The rules are now written correctly
- If Apache still refuses a rule, RootScan now adds the rules one at a time, keeps the ones that are accepted and tells you which one was left out
- New: a Bot protection ON/OFF switch in the Firewall tab, and the command rootscan fw bots on|off
- Guard now only checks bots when the firewall is switched on
How it affects you
- Servers that could not install the web rules now can
- Bot protection can be turned off without touching the rest of the firewall
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.7.0NewSecurity
Persistence checks, WordPress administrator watch, PHP-in-uploads blocking and bot verification
This version looks for the tricks attackers use to stay on a server, watches WordPress administrators and can recognise real search-engine bots.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- Persistence checks: auto-prepend settings in .htaccess, .user.ini and php.ini, pictures set to run as PHP, redirects shown only to search engines, very long lines, mu-plugins and db.php files
- WordPress administrator watch: RootScan remembers the administrators of each site, flags a new one as high severity and flags a changed e-mail. It only reads the database and shows masked values
- New card in Web rules: block PHP in uploads folders for all sites, or only some, with an off switch and an optional nightly refresh. Also rootscan harden
- Bot verification: Googlebot, Bingbot, Applebot, YandexBot and Baiduspider are confirmed by a reverse and forward DNS check, and fake bots are counted as abusive
How it affects you
- More hidden problems are reported, so a server can show new findings after the update
- Real search-engine bots are never counted against you
- Blocking PHP in uploads can break a plugin that runs PHP from there, so use the off switch if a site breaks
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.6.1Fixed
False "listed" results in the mail reputation check
The mail reputation check reported blacklist listings that were not real on a server whose DNS answered every question with the same address.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- Answers of 127.0.0.1 and wildcard resolver answers are now treated as "no answer" and not as "listed"
How it affects you
- Fewer false alarms in RootScan Email (paid plans)
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.6.0Improved
RootScan Email tab redesigned as a quarantine table
The Email page in WHM was rebuilt with the layout of a mail quarantine, with sub-tabs and bulk actions.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- Sub-tabs: Quarantine, Activity monitor, Statistic, Reputation and Settings
- Quarantine table with account, received date, reasons, sender, recipients, subject and the PHP script that sent it, with sorting, search, 25 per page and bulk release, freeze and delete
- A view panel shows the headers, the start of the message and why it was flagged
- The reasons come from RootScan's own checks, not from a trained mail filter
How it affects you
- Easier to review and release held mail
- Only on paid plans, because RootScan Email is a paid feature
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.5.0Security
Hardening release: RootScan protects itself
This version makes it harder for an attacker to use RootScan against a server or to switch it off without being noticed.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- Files in customer folders are now changed as the account user, never as root through links or special files
- New command rootscan verify and a nightly e-mail if RootScan's own files, permissions, cron entries or pages have been changed
- The installer sets strict ownership and permissions on every file
- The scanner also looks inside nested folders and very large files, finds PHP hidden at the end of pictures, flags attempts to evade a scan and finds CGI, Python and JSP shells
How it affects you
- You may get a "RootScan files changed" e-mail if someone edits them, which is the point of the check
- Someone with root on the server can still change anything. RootScan reports it, it cannot prevent it
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.4.0NewImproved
RootScan Email becomes part of the paid plans, with more checks
RootScan Email is now a paid feature, and gained checks for stolen mailbox passwords, bounce floods and per-account limits.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- RootScan Email, white-label and the mail PDF sections are part of the paid plans. Every other feature stays in the free plan
- A sample of the message is read before an automatic hold, so a newsletter is reported and not held
- Alerts for a stolen mailbox password and for a flood of bounces
- Per-account hourly sending limits
- A SpamAssassin check, described honestly as a check and not as an incoming mail filter
- Delisting links, an hourly re-check and a "clean again" notice
- Ignore a rule in one folder, with a note
How it affects you
- Free plan: the Email tab shows that Email is part of the paid plans
- Paid plans: more mail problems are caught early
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.3.0New
RootScan Email: mail reputation, queue and account hold
The first version of RootScan Email protects a server's mail reputation, which is what keeps your customers' mail out of spam folders.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- Mail reputation: blacklist checks, reverse DNS, SPF, DKIM and DMARC with a grade for each domain
- Exim queue shown as a quarantine, with freeze, thaw and remove, and a way to hold an account's outgoing mail
- Finds the folder a spam script runs from. The default action is to alert, and holding is opt-in
- A Timeline for each infection (what probably happened and a recovery checklist), an A to F grade, plain-text explanations of each finding, rootscan pause and rootscan status --json
How it affects you
- Needs Exim, which cPanel uses
- Nothing is held automatically unless you choose that
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.2.0NewImproved
White-label, monthly reports, restore from backup and WordPress checks
A large feature release. It was tried by the owner on a real VPS before the later versions were built.
Built and tried on our own servers first. It reached every customer on 12 October 2026 as part of RootScan 2.9.0.
What changed
- White-label branding (paid plans) and monthly PDF reports, sent on the 1st of the month
- MailWatch counts spam in the Exim log inside the 5-minute check
- Telegram commands, in a private chat only
- False-alarm report: only the file's fingerprint and the rule id are sent to us, never the file
- Restore a clean copy of a file from an uncompressed cPanel backup when cleaning
- WordPress plugin update with a backup and an undo (needs the PHP zip module)
- WordPress database check for injected scripts, with clean and undo. It talks only to the local MySQL (needs pdo_mysql)
- An "Ask an expert" button, fleet alerts by e-mail when a server has been quiet for over 26 hours or reports malicious files, and referral links
How it affects you
- Some features need a PHP module that your server may not have, and RootScan says which one is missing
- Nothing in the database is changed without a backup and an undo
What to do. Update with sudo rootscan update, or press Update now in the WHM RootScan page. If you turned on auto-update, updates within the same major version install at night by themselves.
- v2.1.0NewFixed
Self-update, a modern WHM design and fixes from the first real install
RootScan can now update itself. This version also fixes problems found when it was first installed on a real cPanel server.
Public release on 10 October 2026.
What changed
- New: rootscan update, with --check and --rollback. It checks a signed notice and a checksum, keeps a backup and rolls back by itself if the update fails
- New: an Update now banner in WHM and an optional auto-update for the same major version, at night
- New: a licence card showing your plan, end date and days left, and a redesigned WHM interface
- Fixed: the installer stopped when the cPanel theme was not the one it expected, because cPanel uses jupiter. The cron job and licence key were never set up
- Fixed: the WHM "page expired" error
- RootScan now sends counts-only statistics when it checks in, and the dashboard shows them per server
How it affects you
- Servers that stopped at the installer can finish the install now
- Future updates are one command, with no re-download or re-install
What to do. On 2.0.x, run the install command from your dashboard once. After that, sudo rootscan update does the rest.
- v2.0.0New
RootScan 2.0: scanner, cleaner, firewall, web rules and a free plan for everyone
A new generation of RootScan, with many more checks and tools, and a free plan of 10 accounts for every registered user.
Public release on 10 October 2026.
What changed
- 67 detection rules, and vulnerable plugin, theme and core checks for WordPress, Joomla and Drupal
- Cleaner: removes injected code, restores genuine WordPress files or quarantines, always with an undo
- A quick scan every 5 minutes for new attacks
- Health score, exposure checks, a server audit and end-of-life PHP checks per account
- Firewall (CSF or an ipset chain) with allow and deny lists, country and port rules, and lock-out protection
- ModSecurity web rules that are tested with the web server before they are used and rolled back if the test fails
- Alerts by e-mail, Telegram and webhook, weekly reports, results shared with cPanel users, and rootscan doctor and rootscan audit
- Free plan: 10 accounts on 1 server, for every registered user. The licence is checked with signed answers
How it affects you
- The firewall and web rules start switched off (monitor mode), so nothing is blocked until you turn it on
- Version 1 servers need the new install: it is a new generation, not an in-place patch
What to do. Download the package from your dashboard, unpack it as root and run the installer.
- v1.1.0New
RootScan goes live (versions 1.0.0 and 1.1.0)
The first versions of RootScan: a WHM and cPanel add-on that scans for hacked websites, with a licence key for each server.
Version 1.0.0 was kept for a few days next to 1.1.0.
What changed
- Installs inside WHM and cPanel
- Scans websites for web shells and injected code and quarantines what it finds
- A licence key for each server, created in your dashboard
- Public page, dashboard and downloads on rootmanage.com
How it affects you
- Versions 1.x were replaced by 2.0.0 on 10 October 2026
What to do. Move to 2.0.0 or later from your dashboard.
Questions about RootScan updates
How do I update RootScan?
Run sudo rootscan update, or press Update now in the WHM RootScan page. Use sudo rootscan update --check to see whether a new version exists, and sudo rootscan update --rollback to go back to the previous one.
Will an update break my server?
Every update keeps a backup of the previous version and rolls back by itself if the new one fails its checks. The firewall and web rules keep your own settings across updates, and they stay off until you turn them on.