Protect Your Website with SiteLock Website Security

SiteLock provides simple, fast and affordable website security to websites of all sizes. Founded in 2008, the company protects over 12 million websites worldwide. The SiteLock cloud-based suite of products offers automated website vulnerability detection and malware removal, DDoS protection, website acceleration, website risk assessments, and PCI compliance.

As a hosting provider you're responsible for the security and functionality of the server hosting your customers' sites, but not their individual sites. SiteLock provides comprehensive website security for all websites within a shared or dedicated server environment.

Yes, SiteLock is compatible with any hosting environment.

No. During a website scan, SiteLock downloads the relevant files via FTP to a secure server and performs scans there. There is no impact on the website content, code, bandwidth, or server resources, and no software needs to be installed on the server.

Servers have different layers for communication. The OSI model has seven layers. The firewall provided by most hosting companies is focused on layers three and four of the OSI model. These layers are set to always allow HTTP requests from port 80. Port 80 is set to always allow HTTP requests from web clients. This is what allows a site to be visible to the Internet. However, malware attacks today can be sent via an HTTP request through port 80. The difference between a safe request and a malicious request is the content being sent. A host's firewall does not examine the content being sent via port 80; it is merely interested in ensuring that the request is the correct type through the right port. If it is an HTTP request, it will be allowed through port 80. A web application firewall (WAF) works at Layer seven of the OSI model, which is the application layer. A WAF utilizes a general rule set to determine if the content being sent is safe or malicious.

SMART is the Secure Malware Alert and Removal Tool (SMART). SMART can be set to one of two settings: "Yes, automatically remove the malware found" or "No, just warn me." SMART performs an inside-out scan by connecting to the site via FTP and making a copy of the website files to download to a SiteLock secure server. SMART is able to identify and remove malicious code from the files. Once the scan is complete, if malware was removed, a clean copy of the file(s) will be uploaded to the server, replacing the infected file(s). If you choose to set SMART to "No, just warn me," you will only be notified of the malware found and have the ability to review the findings inside the dashboard.

The SiteLock product will be active once the user has paid for and configured the service(s). SiteLock Scanner Lite and SiteLock Find do not require configuration. SiteLock Premium and SiteLock Defend do require configuration. There are multiple scans included with each product, and many of the scans will not require configuration, as they run via HTTPS. Services that need to be configured include: (1) SMART - Instructions can be found inside the SiteLock Dashboard. "Settings" tab -> "Download Settings" tab. From the "Download Settings" screen, click on "Use the Wizard" at the top right. (2) Web Application Firewall (SiteLock Defend only). Instructions can be found inside the SiteLock Dashboard. From the "Dashboard" tab, click on the circle that says "TrueShield Configure." Once you click on the circle, you will be taken to another screen that has instructions on step-by-step setup. If you require assistance with setting up the Web Application Firewall (WAF), please call the SiteLock technical support team available 24/7/365.

SiteLock Scanner Lite and SiteLock Find run via HTTPS and scan what is web-visible. Your clients will not require any server access to use these products. For services such as Fix and Defend, they will require FTP, SFTP, or FTPS access so that SMART can access and download the website files to the SiteLock Secure Server. Additionally, in order to utilize the WAF, clients will require access to their DNS records.