The fix, in one snippet
unzip -l outer.zipIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scanner opens zip, 7z, rar, tar and gzip containers in memory and, for every entry that is itself an archive by magic bytes, recurses, up to a depth of five and a cap on total decompressed bytes. It reports the deepest chain (for example invoice.zip → docs.iso → scan.lnk), the depth, and the type of the innermost file. Depth three or more fails; a chain that passes through ISO, IMG or VHD images is flagged specifically, because those containers historically dropped the Mark of the Web (Microsoft changed this in late 2022, but older systems remain affected). Limits: password-protected inner archives and some solid rar archives cannot be opened, in which case the report says the inner content is unscanned rather than clean.
Why it matters
Every scanner has a recursion limit (ClamAV's MaxRecursion is 17 by default; mail gateways are often lower) and an attacker who nests one level deeper than the gateway gets a payload through unexamined. Nesting also strips the Windows download marking that triggers SmartScreen and the Office macro block: the zip-inside-ISO-inside-zip chains used by Qakbot, Emotet and IcedID in 2022 existed for exactly that reason. A chain of archives each holding a single file is almost never how legitimate software or documents are distributed.
How to fix it
Do not unpack it on your main machine. If you expected a nested archive (vendored source tarballs inside a release zip are the usual legitimate case), extract each layer in a sandbox or virtual machine and scan each layer separately. On Windows, after extraction, check Properties for the Unblock checkbox: its absence on a file that came from the internet means the marking was lost. List before extracting:
$ 7z l -r invoice.zip
Date Time Attr Size Compressed Name
2026-08-02 09:14:10 ....A 4194304 1201332 docs.isoAdministrators: configure the gateway to quarantine on recursion limit rather than pass the file through. Related checks: decompression bomb and archive contains an executable. Guides: archives and zip bombs and scanning downloads before opening.
Where this fits
Deeply nested archive is check 15 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Windows shortcut (.lnk) file (high), where the file is a Windows shortcut (.lnk), which can run any command line under any icon and any name, and is a favourite disguise for malware droppers. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Deeply nested archive closes one route in. Immediately below it: Executable program file, where the file is an executable program (Windows PE, macOS Mach-O, Linux ELF, an installer or a script) that will run with your privileges if opened; PDF contains embedded files, where the PDF carries one or more attached files inside it, which can be executables, scripts or further documents that a reader can extract and open; Password-protected archive, where the archive's contents are encrypted with a password, so neither Scan.now nor your antivirus can inspect what is inside before you extract it.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Deeply nested archive (medium severity)
Scanner check id: archive-nestedThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 14, 2026
Archives and Zip Bombs: Why Compressed Files Need Their Own Scan
Archives hide malware from casual inspection, can be password-protected to defeat scanners and can expand to terabytes to crash them....
Read the guide
8 min read · Updated Sep 17, 2026
How to Scan Downloads Before Opening Them (and What Your Browser Already Does)
Browsers, operating systems and online scanners each check downloads differently. What happens between clicking a link and opening the...
Read the guide