Anti-Virus and Malware Protection for Linux

You said, "In order to be protected from viruses in real time" which is a key point.

If you think through this, you'll quickly determine this is very difficult.

Consider all the ways a person might login to your system...

Apache, WordPress (wp-admin + xmlrpc), pop3, imap4, smtp, ssh, sftp, mysql.

Then you'd have to check all data flowing across all these pathways.

It's unlikely you could come up with a correct way to even guess at how to do this + if you could, likely most of your machine resources would go toward packet scanning, rather than income generating work.

All this said, their are a few primary ways to make your machine hacker resistant.

1) Keep every tiny bit of software updated on your machine. Even with WordPress, install something like the Companion Auto Update plugin to keep all your WordPress site code updated.

Better to fix minor update side effect breakage, than have to cleanse 1000s of hacked files of Malware.

2) With Ubuntu, updates are super easy apt-get update && apt-get -y upgrade is all that's required.

If a Kernel update installs, be sure to reboot your machine.

3) Updates, mean all updates, this includes either running an LTS version (5 years support) or installing all major OS upgrades.

4) Only allow access to your machine in a secure manner.

Only run HTTPS sites.

Only run SFTP, never FTP.

Keep openssl libraries updates (see #1 above).

Wrap any open port with an SSL cert - IMAP, POP, MySQL, whatever. If the port is open, encrypt the traffic.

5) Run auditd or some similar system + ensure all file changes are correct.

6) Partition all Apps from machine level OS.

I do this by running Ubuntu Bionic + SNAP LXD at machine level, then any App code (like LAMP Stacks) inside LXD containers.

This way security is stringent, as the only way in to the machine is ssh via a key.

If one site in one container is hacked, no real problem occurs because the hacked site can only effect sites in the container.

Also, inside containers, I run firewall rules which block all actions taken by Malware, such as integrating a hacked machine into BotNets to send SPAM or attack other machines.

This step is essential, because no matter how smart you think you might be, armies of 1,000,000s of hackers working out machine attacks all day will always be smarter than you. Eventually you will be hacked. Your only hope is to block actions Malware takes. This will keep your containers + machines online, because when ISPs see attacks against other machines originating from your machine, they will shutdown your machine + normally require a reinstall from scratch.

If you're new to hardening machines, might be worth taking time to research how people running 1000s of sites manage their security.