Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My sites are hosted at a shared server at HostGator who have recently started sneakily pushing their customers to subscribe to SiteLock. I have a few client sites, and a sizable Wordpress site (1k+ pages) owned by me. Problem is, the site is prone to malware attacks and I have to spend a lot of time to clean up the system since HG doesn't provide any antivirus or file system monitoring tools like inotify which makes life easier.

Although these tools are costly, question is, should I subscribe to SiteLock and will it really help in hardening the security of the server? Are there any open-source alternative? What's your take?

Thank you.

share|improve this question

closed as primarily opinion-based by John Conde Nov 7 '15 at 5:10

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 1 down vote accepted

I work for SiteLock in their research group and I'll try to answer the technical aspects of the question as best I can.

SiteLock provides web application firewalls, malware scanning and removal, and manual cleaning services, along with other security related services. We protect many WordPress sites with scanning packages of over 5k pages. Depending on the package, we have tools that remove malware automatically and reliably.

I recommend getting the site at least on the free SiteLock WAF, which provides a layer of protection with only a couple of DNS changes. I would have to defer to a SiteLock security associate for the right scanning package for the site.

share|improve this answer
Thanks for the answer. – Ramnath Nov 3 '15 at 19:42

They seem far too automated to be much use. Good security needs to be more bespoke than what they offer. They seem to only offer warnings but no fixes (without paying, anyway), so I'm not sure how much better they are than the free scanners out there.

Good security for a Wordpress site would be to do things like backups, patching, and making sure third party plug-ins are professionally coded before installing them. There seems very little preventative measures in what they offer.

If malware is found, you need to try and track down how it got on*, rather than just deleting it. Again, this isn't a service they seem to offer as part of the main deal.

(* If your site is being hacked regularly, and is patched, that suggests to me there may be a back door somewhere)

share|improve this answer
Yes I rely on reliable plugins, have a defined process to cleanse the site and manually backup the sites on a monthly basis. But I believe something fishy is still going on. Remember, if there weren't any virus, the antivirus companies would have died. – Ramnath Nov 1 '15 at 10:58
People are usually going to need to hack a site before they can add a virus. That hacking is usually going to be down to an exploit in the code - certainly that is the case with most Wordpress hacks. No matter how well written the code, there are going to be potential problems. See : checkmarx.com/wp-content/uploads/2013/06/… – Richard B Nov 1 '15 at 12:23
You should perhaps run a comparison between your current files and the files on a core install - see if there is any dodgy code added anywhere. A diff check each month would flag up issues as well as (probably far better than) anything SiteLock seem to offer. – Richard B Nov 1 '15 at 12:27
Also note that most hacks are not about malware. The most common seem to be to add hidden links for black hat SEO. – Richard B Nov 1 '15 at 12:30

SiteLock is a service that is owned by a company called Endurance International Group, or EIG for short.

You can confirm thishere: https://www.linkedin.com/title/business-development-manager-at-endurance-international-group You notice John C Booker listed as the Sales Manager at SiteLock.

EIG owns dozens of well-known hosting brands, which you can find here: http://researchasahobby.com/full-list-eig-hosting-companies-brands/

If you take any of their hosting brands from that list and search online for complaints, or check their official Twitter feeds, you'll see lots of unhappy customers. Personally I dislike EIG, very much so. Some online research will uncover the many reasons why I don't think they are a very customer-focused company at all.

I have never used SiteLock, but judging on the quality of most of their hosting brands I would probably stay far away from SiteLock.

You can read some SiteLock-specific reviews here: http://sitelock.pissedconsumer.com/

Also, as a side note because I'll never remember where I read it, but there are complaints of SiteLock conducting themselves in some shady ways.

I read a review somewhere a few months ago from a client that was using SiteLock but decided it was too expensive for the budget she had for her small business website. She asked her host (iPage I believe, an EIG brand) to cancel the service. They hassled her a bit, but eventually cancelled the service. Within a day she received an e-mail from her host saying that the site was infected, and that she would need to purchase the more expensive SiteLock911 service to have the site cleaned up. Now I don't really know what happened here, as I wasn't involved, and I really wish I could find that article. But if that story was in fact true, I would be careful giving them my money.

share|improve this answer
So my assumptions are actually sounding logical. They won't provide any open source tools and will always insist to subscribe to SiteLock which is completely unethical. Problem is where will you migrate if you wish to? Almost all reliable hosting companies are now owned by EIG! And till date no authoritative body/agency showed the courage to speak against them I believe. – Ramnath Nov 1 '15 at 10:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.