diff --git a/lib/php-scanner.sh b/lib/php-scanner.sh
index 151d3f3..be0e3ea 100755
--- a/lib/php-scanner.sh
+++ b/lib/php-scanner.sh
@@ -483,34 +483,47 @@ find_domain_access_log() {
 
     case "${SYS_CONTROL_PANEL:-unknown}" in
         cpanel)
-            local owner
-            owner=$(find_domain_owner "$domain")
-            if [ -n "$owner" ]; then
-                # Try access-logs directory first (follows symlinks)
-                local log_file
-                log_file=$(find -L "/home/${owner}/access-logs" -type f -name "*${domain}*" 2>/dev/null | head -1)
+            # cPanel standard locations for access logs
+            # Primary: /var/log/apache2/domlogs/DOMAIN (or DOMAIN-error_log, etc)
+            # Secondary: /home/USER/access-logs/ (symlink to above)
+            local log_file
 
-                # If not found, try Apache domlogs directory directly
-                if [ -z "$log_file" ] && [ -d "/etc/apache2/logs/domlogs" ]; then
-                    log_file=$(find "/etc/apache2/logs/domlogs" -type f -name "*${domain}*" 2>/dev/null | head -1)
+            # Try standard cPanel domlogs directory FIRST (primary location)
+            log_file=$(find "/var/log/apache2/domlogs" -maxdepth 1 -type f -name "*${domain}*" 2>/dev/null | head -1)
+
+            # If not found, try user's access-logs directory (symlink, follows)
+            if [ -z "$log_file" ]; then
+                local owner
+                owner=$(find_domain_owner "$domain")
+                if [ -n "$owner" ] && [ -d "/home/${owner}/access-logs" ]; then
+                    log_file=$(find -L "/home/${owner}/access-logs" -maxdepth 1 -type f -name "*${domain}*" 2>/dev/null | head -1)
                 fi
-
-                # If not found, try public_html
-                if [ -z "$log_file" ] && [ -d "/home/${owner}/public_html" ]; then
-                    log_file=$(find "/home/${owner}/public_html" -maxdepth 2 -type f -name "access_log*" 2>/dev/null | head -1)
-                fi
-
-                echo "$log_file"
             fi
+
+            # Try alternative cPanel path
+            if [ -z "$log_file" ] && [ -d "/etc/apache2/logs/domlogs" ]; then
+                log_file=$(find "/etc/apache2/logs/domlogs" -maxdepth 1 -type f -name "*${domain}*" 2>/dev/null | head -1)
+            fi
+
+            echo "$log_file"
             ;;
         plesk)
-            find "/var/www/vhosts/${domain}/statistics/logs" -type f -name "access_log*" 2>/dev/null | head -1
+            # Plesk standard locations
+            # Format varies: /var/www/vhosts/DOMAIN/logs/ or /var/www/vhosts/system/DOMAIN/logs/
+            find "/var/www/vhosts" -path "*/logs/*" -name "*access*" -o -path "*/system/${domain}/logs/*" 2>/dev/null | head -1
             ;;
         interworx)
-            find "/home/*/public_html/${domain}" -type f -name "access_log*" 2>/dev/null | head -1
+            # InterWorx standard location: /home/USER/var/DOMAIN/logs/
+            find "/home/*/var/${domain}/logs" -type f -name "*access*" 2>/dev/null | head -1
             ;;
         *)
-            find /var/log -type f -name "*${domain}*access*log*" 2>/dev/null | head -1
+            # Standalone/unknown - search common locations
+            local log_file
+            log_file=$(find "/var/log/apache2/domlogs" -maxdepth 1 -type f -name "*${domain}*" 2>/dev/null | head -1)
+            if [ -z "$log_file" ]; then
+                log_file=$(find "/var/log" -maxdepth 2 -type f -name "*${domain}*access*" 2>/dev/null | head -1)
+            fi
+            echo "$log_file"
             ;;
     esac
 }