BashSecureFOR DIRECTADMIN SERVERS
A DirectAdmin malware scanner that keeps every user and domain in context.
Scan hosted websites for malware and hidden backdoors, observe dangerous PHP behavior as it happens, and patch vulnerable WordPress plugins without losing sight of the DirectAdmin user who owns each Web root.
✓ User-aware findings✓ Observe before blocking✓ Reversible recovery
DirectAdmin server malware protection
Security findings make better decisions when they include the owner, domain and application.
A DirectAdmin server can hold many users, resellers, domains and application roots. A suspicious file path alone does not tell the administrator who owns the site, whether other domains share the same user, or which application should be reviewed after containment.
BashSecure associates scanning, integrity changes, live PHP activity and vulnerable software with DirectAdmin account boundaries. The server operator can start from a fleet-wide view and narrow an incident to the affected user and domain without exposing unrelated customer information.
Detection remains separate from response. A scan records evidence before a file is moved. Live Defense can begin in Log mode before selected behavior is stopped. Vulnerability patching saves the installed copy before a verified official update is applied.
BashSecure in the DirectAdmin Web path
Stop dangerous execution while healthy sites keep serving visitors.
BashSecure connects a hostile request to the PHP script, hosted domain and DirectAdmin user involved, then retains the evidence needed for investigation.
INTERNET TRAFFICVisitors, bots and hostile requests
→BASHSECUREInspect · attribute · stop Dangerous execution ends here
→DIRECTADMIN USERSHosted domains remain separated
DirectAdmin-aware administration
See the complete server, then open the one user that needs attention.
The administrator gets a server-wide view without flattening every customer site into one unstructured list.
BASHSECUREDirectAdmin protection overview
Agent reportingOverviewFindingsUsersLive DefensePatchingQuarantine
USER / DOMAINFINDINGACTIONSTATE
shopdemostore.example
Executable content in media path/domains/store.example/public_html/media/banner.png
File isolatedQuarantinedportaldemoportal.example
Runtime command attempt/domains/portal.example/public_html/index.php
Request recordedObservedInterface preview. Usernames and domains are fictional examples.
DirectAdmin malware scanner
Inspect file content instead of trusting the filename.
BashSecure examines PHP, JavaScript, HTML and related website content for backdoors, Web shells and malicious code. A script does not become harmless because an attacker gives it an image extension. People looking for a DirectAdmin virus scanner receive website-focused inspection that follows each finding back to the correct user and domain.
Incremental daily protection
Recheck changed files during routine operation instead of repeatedly reading every unchanged Web root.
Scheduled full scans
Run a complete server or user review in a controlled window and preserve an honest completion state.
User boundary awareness
Keep findings associated with the DirectAdmin user, domain and application root that own the affected file.
Explicit incomplete results
Permission errors, timeouts and unreadable paths remain visible rather than producing a misleading clean result.
Live Defense for DirectAdmin PHP
Record what the request tried to do, not only the file it left behind.
Scheduled scanning finds malware already stored on disk. Live Defense observes PHP behavior while a request is executing. It can preserve the source address, requested URL, script path, DirectAdmin user and hosted domain behind a dangerous action.
Available but inactive
Keep runtime protection disabled while preparing an application or user policy.
Observe first
Collect real server evidence without terminating the customer request.
Stop confirmed behavior
Abort a selected dangerous action and retain the event for review.
Controlled malware removal
Contain the incident without destroying the evidence.
Safe DirectAdmin malware removal should preserve a recovery path and make every action attributable. BashSecure lets the administrator confirm the finding before customer files or active policy are changed.
Reversible quarantine
Move a confirmed malicious file outside the Web root while retaining its original path, owner, group, mode and recovery record.
User-level follow-up
Scan the affected user's domains after a live event suggests that more than one file may have been written.
Request attribution
Connect the source and URL to the executing script, hosted domain and DirectAdmin user involved.
Exact trust controls
Trust a reviewed file or checksum at the narrowest useful scope without disabling protection for other users.
Recorded operator actions
Keep quarantine, restore, patch and policy changes visible in the security history.
Exposure follow-up
Check vulnerable application components so cleanup also addresses the path used for reinfection.
DirectAdmin vulnerability scanner✓User and domain identifiedKnow exactly where the affected version runs. ✓Official package requiredReject unknown archives and unofficial mirrors. ✓Current copy saved firstPreserve the installed files before replacement. ✓Individual rollback retainedReverse one update without undoing unrelated work.
Fix the vulnerable plugin that made repeated cleanup necessary.
BashSecure inventories supported WordPress plugins across DirectAdmin users and compares installed versions with published vulnerability information. Affected, unaffected, unknown and unsupported states remain separate. Vulnerability exposure is never presented as proof that malware already exists.
When a supported official update is available, BashSecure saves the installed plugin before replacement. It downloads the recognized release, verifies it against published checksums, installs it and checks the result. Individual rollback remains available if the update changes site behavior.
VULNERABILITY PATCHINGUser and domain review
Official update verifiedDIRECTADMIN USERshopdemostore.example · fictional domain
catalog-blocksinstalled 2.8.1
Known vulnerabilityInput validation
Patch to 2.8.5Fictional plugin, username and domain shown for demonstration.
CMS core integrity
Report modified core files as evidence, not an automatic malware verdict.
BashSecure can compare WordPress, Joomla and Drupal core files with the official release. A mismatch may be a backdoor, a local customization or a version problem. Keeping integrity changes separate helps the administrator choose the right response.
WordPress core comparison
Identify missing and modified core files within each DirectAdmin user's site.
Official package evidenceJoomla and Drupal checks
Review supported CMS core differences without mixing findings across domains.
Multiple application familiesControlled official restore
Replace a confirmed modified core file only after the administrator approves the recognized version.
Deliberate remediationDirectAdmin account structure
Preserve the hierarchy administrators already use.
Server-wide security still needs to respect reseller, user and domain ownership during investigation and recovery.
Complete server coverage
Review scan completion, Live Defense events, quarantine, vulnerable components and response history across every discovered user.
- Filter by user or domain
- Find incomplete scans
- Compare protection modes
- Control recovery actions
Keep ownership visible
Understand which reseller relationship owns an affected user without granting broader security authority by accident.
- Clear account hierarchy
- Focused incident routing
- No mixed customer data
- Server policy retained
Investigate the right Web roots
Follow the user's own domains, applications and files while unrelated accounts remain outside the incident view.
- Own domains and paths
- Account-scoped evidence
- Clear remediation target
- Private customer context
Lightweight by design
Protect a busy DirectAdmin server without turning security into its largest workload.
Shared hosting servers already balance Web traffic, PHP workers, databases, mail, backups and control-panel tasks. BashSecure reduces repeat work with changed-file scanning, supports idle I/O priority and can throttle when server load rises.
Full sweeps remain scheduled and operator controlled. After a live event, user-aware filtering allows a focused investigation instead of immediately forcing every hosted account through another complete scan.
SCAN PROFILEDirectAdmin shared hostingActive
Controlled rollout
Build an evidence baseline before enabling active response.
Start with complete visibility, observe real application behavior and enable enforcement only where reviewed evidence supports it.
Discover users and Web roots
Map hosted domains and complete a baseline scan without changing files.
Confirm the first findings
Separate malware evidence, integrity changes and vulnerable software.
Run Live Defense in Log
Understand normal PHP behavior before selected runtime blocking begins.
Approve response policies
Enable Kill, quarantine, patching or source response at the right scope.
BashSecure plans
Licensing for one server or a hosting fleet.
Every plan runs the same malware scanning and Live Defense runtime protection. Pick a plan by how many hosting accounts you need to cover.
Basic
Up to 10 hosting accounts
$12per month
Get BashSecure
- Malware scanning across every hosted account
- Live Defense runtime protection (Off, Log or Kill)
- Reversible quarantine
- Attack source, request and script attribution
- Up to 10 hosting accounts
- Unlimited domains
Most popular
Premium
Unlimited hosting accounts
$23per month
Get BashSecure
- Everything in Basic
- Vulnerability Patching for WordPress plugins
- Core file integrity monitoring
- Unlimited hosting accounts
- Unlimited domains
Price per server, per month, excluding VAT. Cancel anytime. Talk to us.
DirectAdmin malware scanner questions
What to know before protecting a DirectAdmin server.
What is a DirectAdmin malware scanner?
A DirectAdmin malware scanner checks hosted website files for malicious code, backdoors and Web shells while retaining the user and domain that own each path. BashSecure adds live file monitoring, PHP runtime protection, attribution, reversible quarantine and vulnerability patching.
Can BashSecure scan every DirectAdmin user?
BashSecure is designed for server-wide coverage while organizing findings by user and domain. Administrators can review completion across the server and focus investigation on one account without mixing unrelated customer data.
Is BashSecure a DirectAdmin virus scanner?
BashSecure provides the malicious-file inspection often intended by that phrase, but it is built for hosted websites, PHP applications and server account boundaries rather than as a general desktop antivirus product.
Can it detect malicious PHP hidden in an image file?
Yes. BashSecure examines content rather than trusting the extension alone, allowing executable code and suspicious behavior to be identified even when a filename appears harmless.
Does BashSecure delete detected files automatically?
No. Detection is the safe default. A confirmed malicious file can be moved into reversible quarantine while its original path, ownership, permissions and recovery information are preserved.
How does Live Defense work with DirectAdmin?
Live Defense observes PHP runtime behavior and links an event to the source address, URL, script path, hosted domain and DirectAdmin user. It can begin in Log mode and stop selected behavior only after Kill is enabled.
What does the DirectAdmin vulnerability scanner check?
BashSecure inventories supported WordPress plugins and compares installed versions with published vulnerability information. Affected, unaffected, unknown and unsupported states remain separate so uncertainty is not presented as safety.
Can vulnerability patches be rolled back?
Yes, for supported official updates. BashSecure saves the current plugin, verifies the recognized release with published checksums and keeps individual rollback available if the update affects the website.
Does a vulnerable plugin mean the site contains malware?
No. Vulnerability is exposure, while malware is evidence of compromise. BashSecure reports them separately so the administrator can patch risk without making an unsupported infection claim.
Is BashSecure suitable for shared DirectAdmin hosting?
Yes. Changed-file scans, idle I/O priority, load-aware throttling and user-focused investigation help security operate alongside normal hosting workloads and many customer accounts.
BASHSECURE FOR DIRECTADMIN
Find the malicious file. Stop the live request. Keep the right user in view.
Bring malware scanning, PHP runtime defense, attribution, quarantine and reversible vulnerability patching into one DirectAdmin security workflow.