# Settings

> Automatic actions, real-time protection, scan schedule, CPU limit, exclusions, notifications and license of Pyxsoft Antimalware.

Source: https://www.pyxsoft.com/docs/anti-malware/pyxsoft-antimalware-settings
Updated: 2026-11-10

---

The **Settings** tab gathers everything that changes how Pyxsoft Antimalware behaves. Changes are not applied until you click **Save changes** at the bottom; **Discard** drops them. The bar shows how many unsaved changes there are.

| Section | Where it is explained |
|---------|-----------------------|
| Automatic actions | [Below](#automatic-actions) |
| Real-time protection | [Real-Time Protection](./pyxsoft-instant-scanner#turning-it-on-or-off) |
| Scheduled scan | [Scans](./pyxsoft-global-scanner#scheduled-scan) |
| Performance | [Scans → CPU limit](./pyxsoft-global-scanner#cpu-limit) |
| Exclusions | [Below](#exclusions) |
| Allowlist | [Quarantine and Allowlist](./pyxsoft-antimalware-quarantine#allowlist) |
| Notifications | [Below](#notifications) |
| License | [License](./pyxsoft-antimalware-license) |

## Automatic actions

What the scanner does when it finds something, in real time and in scans.

![Automatic actions settings: Known malware set to Move to quarantine, Suspicious file set to Report only, the Auto Clean switch turned on, Dangerous symbolic links set to Delete the link, and the switches to allow links to the system and external links, both off](https://www.pyxsoft.com/_astro/am-settings-actions.xblVNVyh.png)

| Setting | Options | Default |
|---------|---------|---------|
| **Known malware** | Move to quarantine, Report only, Delete, Allow (no action) | Move to quarantine |
| **Suspicious file** — flagged by the heuristics, no signature; includes phishing kits | Report only, Move to quarantine, Delete, Allow (no action) | Report only |
| **Auto Clean** — remove only injected code instead of the action above | On / off | See [Auto Clean](./pyxsoft-antimalware-auto-clean) |
| **Dangerous symbolic links** — broken, or pointing to system or external directories | Delete the link, Report only, Ignore | Delete the link |
| **Allow links to the system** | Don't treat links to system directories as dangerous | Off |
| **Allow external links** | Don't treat links outside the account as dangerous | Off |

*Report only* leaves the file where it is and lists it as unresolved in [Detections](./pyxsoft-antimalware-detections). *Allow (no action)* records the detection without listing it as unresolved. *Delete* cannot be undone; quarantine is the safer choice because a quarantined file can be restored. Suspicious files are reported by default because heuristics can flag legitimate code.

**Restore defaults** puts every automatic action back to its default.

## Exclusions

Paths, names or accounts that are never scanned, besides the fixed cPanel ones (mail, logs, tmp…).

![Exclusions settings: no exclusions yet, a kind selector set to Path, a path field with the example /home/account/public_html/cache, an Add button and the hint "A directory excludes everything inside it"](https://www.pyxsoft.com/_astro/am-settings-exclusions.CGZ429Dl.png)

| Kind | Example | Notes |
|------|---------|-------|
| **Path** | `/home/account/public_html/cache` | A directory excludes everything inside it. Must start with `/`. |
| **Name or pattern** | `*.mp4`, `node_modules` | `*` and `?` match any file or directory name, anywhere. No `/`. |
| **Account** | `account` | The account is skipped by the full scan; scanning it by hand still scans it. |

Exclude only what you trust: malware is often hidden in cache and upload directories. To stop a single false positive, [mark the file as safe](./pyxsoft-antimalware-detections#resolving-detections) instead — the allowlist only skips that exact content.

## Notifications

![Notifications settings: the alert email field with info@pyxsoft.com, the language of the emails set to English, the monthly summary switch turned on and a Send test button](https://www.pyxsoft.com/_astro/am-settings-notifications.DgPg0auB.png)

Pyxsoft Antimalware sends:

- An email for **each real-time detection**.
- A **summary after each scan** that finds something.
- An email when Pyxsoft Labs **confirms as malware** a file that was only suspicious.
- An email when the **license stops being valid** (see [License](./pyxsoft-antimalware-license)).
- Optionally, a **monthly summary** on the 1st, if the previous month had detections: files scanned, detections and scans, with no file lists.

**Alert email** is a single address, without a name (`admin@example.com`). Leave it empty to use the WHM contact email. **Language of the emails** can be English or Spanish. **Send test** sends a test email to check the address works.

Emails are handed to the server's own mail server on `127.0.0.1:25`: Exim on cPanel. On a server without a panel they are sent by the Pyxsoft license server from `alerts@pyxsoft.com`, to an address verified from a link, or by the server's own mail server if you choose it: see [Command line](./pyxsoft-antimalware-command-line#how-the-alerts-are-delivered). The emails have no links to the server: they say where to review each alert and name the server.