Malware scanning, vulnerability notices and AI bot blocking
5 min read
How Zefily scans sites for malware and quarantines it, checks packages and WordPress plugins for known vulnerabilities, tells you when updates are waiting, and blocks AI crawlers with one switch.
A firewall and automatic security updates are the minimum for a server on the internet, and every Zefily server gets them from the first minute, along with CrowdSec, SSH hardening and kernel hardening. But most real incidents on web servers do not come through a closed port. They come through a vulnerable plugin, an infected upload, or an update that nobody installed. This post covers the tools Zefily adds for exactly those cases.
In short
- Malware scanning with ClamAV on demand, daily or weekly, with a quarantine that takes infected files out of your sites.
- Upload scanning checks every file the moment it is written, wherever it comes from, and quarantines infected files at once.
- Vulnerability scans check installed packages against the OSV database and WordPress core, plugins and themes against WPVulnerability.
- Security notices tell you when security updates have waited more than two days or a Node.js version has a security release.
- Block AI crawlers (GPTBot, ClaudeBot, CCBot, PerplexityBot, Bytespider…) with one switch per site; search engines are not affected.
Malware scanning and quarantine
On a server's Security tab, Scan now runs ClamAV over every site's files. ClamAV is installed the first time and its signatures are kept current. Scan automatically repeats the scan every day or every week, and when a scan finds something, the organization's owners and admins get an email and a notification listing the files.
Finding malware is half the job; the other half is getting it out of reach. With Move what scans find to the quarantine turned on, every scan takes the files it finds out of the sites into a directory only root can read, so they can never run or be loaded again. From the Quarantine list you can:
- Restore a file to where it was, with its owner and permissions, when it turns out to be a false positive,
- Delete the quarantined copy for good.
If the quarantined file was part of a plugin, the plugin may stop working. That is the right outcome: update or reinstall it from a clean source, then scan again.
Scanning needs a server with at least 2 GB of memory.
Upload scanning: catch it on the way in
Scheduled scans find what is already there. Scan files as they are uploaded catches it on the way in: every file written in a site is checked the moment it is saved, whether it arrives over SFTP or FTP, from the file manager, a deploy, a plugin installing code, or a visitor's upload form. Infected files go straight to the quarantine, and owners and admins hear about it within the hour.
It runs ClamAV's scanner as a service, which keeps about 1.3 GB of memory in use, so it can be turned on for servers with at least 4 GB. Files over 25 MB and Git's internal files are skipped.
Known vulnerabilities, before someone else finds them
Packages. The same Scan now checks every installed package against the OSV database, which carries the Debian and Ubuntu security advisories. The result lists vulnerable packages worst first, with their CVE identifiers and CVSS scores. Most are fixed by the updates waiting on the Updates tab.
WordPress. Each WordPress site's core, plugins and themes are checked against the WPVulnerability database, which gathers CVE, WPScan, Wordfence and Patchstack data. A red badge shows how many known vulnerabilities a site has, with their severity and the version that fixes them.
Our own stack. Zefily builds and ships its own nginx and PHP packages, and watches the security releases of everything it installs for you, so security fixes for PHP, nginx, OpenLiteSpeed and PostgreSQL install with the automatic updates, not only the operating system's.
Notices when something waits for you
Automatic updates should handle security fixes on their own. When they do not, you should hear about it. Every day Zefily checks each server and tells owners and admins, by email and in the panel:
- when security updates have been waiting for more than two days (automatic updates are off or failing), with the list of packages,
- when an installed Node.js version has a newer security release.
A notice repeats at most once a week and stops when the cause is gone. The server's security score and the weekly digest sum up the rest.
Blocking AI crawlers, countries and bad traffic
Not every visitor is welcome. On each site's Rules pane:
- Block AI crawlers refuses GPTBot, ClaudeBot, CCBot, PerplexityBot, Bytespider and other crawlers that collect content for AI models. Search engines are not affected, and Zefily keeps the list up to date.
- Countries blocks the countries you list, or allows only the ones you list (on nginx).
- Blocked addresses refuses addresses and networks on the whole site.
Behind Cloudflare, the rules see the visitor's real address. For application attacks, the web application firewall (ModSecurity with the OWASP Core Rule Set) can run in detect only or block mode per site.
And underneath it all
These tools sit on top of the model the whole platform is built on: every change to a server is a job signed by the panel and by a separate signing service, and risky actions need your passkey. Read why.
Frequently asked questions
Does Zefily scan websites for malware?
Yes. Zefily scans every site's files with ClamAV on demand, daily or weekly, emails owners and admins about what it finds, and can move infected files to a root-only quarantine. Upload scanning can also check every file the moment it is written.
What is a malware quarantine?
A directory only root can read, where infected files are moved out of your sites so they cannot run or be loaded. From the quarantine list you can restore a file (for a false positive) or delete it for good.
How much memory does malware scanning need?
Scheduled and on-demand scans need a server with at least 2 GB of memory. Real-time upload scanning keeps ClamAV's scanner running (about 1.3 GB) and needs at least 4 GB.
How do I block AI crawlers like GPTBot and ClaudeBot?
Open the site's Rules pane in Zefily and turn on Block AI crawlers. The server answers those crawlers with 403, while search engines keep indexing the site.
Does Zefily check WordPress plugins for vulnerabilities?
Yes. Core, plugins and themes are checked against the WPVulnerability database, and the site shows how many known vulnerabilities it has, their severity and the fixed version.
Will I be told if security updates are not installed?
Yes. If security updates have been waiting for more than two days, owners and admins get an email and a notice in the panel with the packages; it repeats at most once a week until the updates are installed.
Start free with one server and run your first security scan today. The details are in the security center documentation.