Cloud-Based, Comprehensive Website Security Solutions
Recognized as a global leader in website security, using proprietary technology to detect and remove malwares that found in websites. SiteLock offers channel clients industry-leading cloud-based solutions that quickly integrate into any existing product portfolio.
Designed to deliver affordable, immediately deployable website protection to organizations of all sizes and complexity, SiteLock solutions deliver an instant recurring revenue stream.
|Personal Website Owners||SMB’s||Web Development Agencies|
Prevent Blacklisting and Business Failure
SiteLock protects businesses from blacklisting by blocking malicious access, monitoring sites for security flaws. This which means keeping website online and business running.
Scanning & Malware Removal
SiteLock® SMART™ (Secure Malware Alert and Removal Tool) is a technologically advanced product with an acute ability to find and automatically remove malware found on website.
Mitigate DDoS Attacks
DDoS attacks are becoming the weapon of choice for hackers today. SiteLock provides comprehensive DDoS protection from the most sophisticated forms of DDoS attacks.
SiteLock performs web applications scanning to find outdated or vulnerable applications that hackers can utilize to gain access to your website and data.
SiteLock provides a complimentary Trust Seal to all websites utilizing SiteLock web security products. This badge instantly informs prospective clients that the site is safe, thus increasing trust and boosting conversions.
Enhance Website Performance
Website speed performance plays a huge role in generating a positive customer experience — which ultimately leads to higher revenue and increased customer loyalty. SiteLock advanced Content Delivery Network (CDN) greatly increases your website speed, while also using significantly less bandwidth.
Features FIND FIX PREVENT 911 Malware Scanning 25 Pages 500 Pages 500 Pages Unlimited Vulnerability Scanning (XSS, SQLi, & Application) One-time Daily Daily N/A File Change Monitoring N/A Automatic Malware Removal One-time Content Delivery Network (CDN) N/A TrustShieldTM Web Application Firewall N/A
Features FIND FIX PREVENT 911 Comprehensive Malware Scanning Daily Malware Scan N/A Automatic Malware Removal (SMART) 2GB/page 2GB/page 1-time Daily FTP Scanning N/A File Change Monitoring N/A Multi-Level Vulnerability Scanning Network Scan (Port Scan) N/A SQL Injection Scan 1-time Daily Daily N/A Cross Site Scripting (XSS) Scan 1-time Daily Daily N/A Website Application Scan 1-time Daily Daily N/A Reputation Management Blacklist Monitoring N/A Business Verification N/A Verifiable Trust Seal N/A Spam Verification N/A SiteLock Risk Assessment N/A Platform Scan (WordPress) N/A TrueSpeed Acceleration Static Content Caching N/A 38 Global Data Centers N/A Basic DDoS Protection 1 Gb/s N/A Support for SSL Websites N/A Traffic Statistics N/A TrueShield Web Application Firewall Bad Bot Blocking N/A SQL Injection Prevention N/A Cross Site Scripting Prevention N/A Blocks Access to Hackers’ Backdoor Files N/A OWASP Top 10 Threats Protection N/A Blacklisting of Clients, Countries and IPs N/A
1. I just registered my website and my network scan shows “No information available”. Why?
We are currently in the process of scanning your website, servers, and other hardware for vulnerabilities. This initial scan can take up to 24 hours. Please check back throughout the day. If you are still seeing this message after 24 hours, please contact support.
2. What is included in Business Verification?
Business Verification includes domain, business phone number and postal address.
3. How does the phone verification work?
Phone number provided is called within 1 hour after signing up. This automated call will provide user with a four-digit pin to insert within Dashboard. If first call goes unanswered, SiteLock will attempt to reach the user again within three hours. Customer can also request a call from within the Dashboard.
4. How long does the postal verification take? What should I look for in the mail?
The postal verification can take up to 7-10 business days, based on the postal service’s delivery. The letter you get looks like non-descript, so please keep an eye out for it so you are sure to open it on arrival. Once you have it, the code is enclosed on the letter.
5. What is SMART?
SiteLock’s SMART, or Secure Malware Alert & Removal Tool, performs deep internal website scans that will tell you when any file on your website changes, giving you full visibility to all activity on your site. If malware is detected, SMART can automatically remove it so that your website maintains a safe and secure environment for our visitors.
This comprehensive scan performs daily inside-out, as well as outside-in, checks of your website that go beyond most surface scans. SMART is included in FIX, PREVENT and 911.
6. How long does a typical SMART scan take?
Depends on the size of the site. Typically, SMART scans are complete with 24 hours.
7. What is required to set up SMART? How do you configure SMART?
To configure SMART:
- Log into your Premier Partner Central.
- Look for your SiteLock subscription, login to SiteLock management portal.
- Click the “Settings” link in the top menu next to the SiteLock logo.
- On the “Settings” page, click the “SMART Settings” tab.
- Enter your site’s FTP address into the field labeled “FTP host address” (this information can be found in the Control Panel).
- vEnter your FTP username for this site into the “User ID” field.
- Enter your site’s FTP password into the “Password” field.
- Select “Yes, remove malicious code automatically” from the “Automatically remove malware” dropdown box.
- Select “Normal (1 connection)” from the “Select a speed for FTP file downloads” dropdown box.
- Leave the “Root Directory” field blank.
- Leave the “(S)FTP Port number” field blank.
- Leave the “Maximum Download Time for your website data synchronization” dropdown box in the default position (30 minutes/day).
- Select how frequently you want the scan to run from the “Scan Frequency” dropdown.
- Click the “Submit” button.
- When the box pops up asking if you want to run the scan now, click “Yes”. Your scan will be queued and you can check the results of the scan in the SiteLock dashboard.
1. My network scan shows a lot of vulnerabilities. I thought my site was safe. How can I fix this?
You have several options to remediate network vulnerabilities. When you open the detail section, you will see a list of all open ports. If you believe that we have identified these ports in error, click the “Report False Positive” link at the top of the box. The resulting page will allow you to mark any ports as false positive, or mark lower priority ports, to ignore them. You can also take advantage of our Expert Services team, who can help you resolve security issues.
2. The malware scan came back with results for my site. What does this mean? How can I fix it?
The malware scan will notify you of any pages or links on your site that have been listed as distributors of malware (viruses, spyware, identity theft scams, etc.). If you are on these lists, many browsers and search engines will ‘black-list’ your site, meaning Internet users will not be able to see it in search results and it will be flagged if they navigate to your site. To get your site cleaned up and off of these lists, remove offending links and clean your website to make sure there are no viruses or spyware present. Another option is to let us help you. SiteLock offers its Expert Services to help you remediate these issues.
3. The email scan came back with results for my site. What does this mean? How can I fix it?
The email scan will notify you if your website or servers are sending or referenced in spam emails. If you are identified on these lists, many email programs will ignore or classify emails from your site as spam. This means your customers and users will not get email from you in many cases. To get your site off these lists and re-open communication with your customers, you must get off of these email ‘blacklists’.
4. My SSL scan failed. How can I fix this?
If your business requires SSL encryption of data, you need an up-to-date certificate to ensure that your customers’ data is safe. The SSL scan will show as failed if your certificate is out of date. You need to renew your certificate with your SSL provider.
5. SiteLock has completed the scan of my site, but the number of pages is less than I expected. What happened?
There are two possible explanations. First, check the limits of the package you have purchased. Certain limits apply to our packages. If that is not the reason, it may be that our “spider” cannot find all of the pages on your site. In many cases, this can occur if there are portions of your site not linked in some way to your home page. Since our spider works primarily by “crawling” from link to link on your site, unlinked pages are sometimes missed. To help us get a more comprehensive scan, you can place a “sitemap” file on your site, which will tell our spider where to look. For details on how to create this file, please visit http://www.sitemaps.org
6. I recently signed up for SiteLock and noticed that we are getting some empty submissions from some of the forms on our web site (Contact us, etc.).
SiteLock probes your site to determine if fields and forms on your site are vulnerable to attempts by hackers looking to exploit these forms to gain access to your data. This will result in attempts to submit forms on your website with encoded data.
If you wish to stop receiving these e-mail’s or entries, you may want to do some validation on the fields within your form to ensure that data is being submitted in the correct formats before triggering e-mail’s or database inputs. Since we insert data that would not likely be valid for any fields on your site, these validation measures should stop you from getting these empty e-mail’s or entries. It’s also good coding and security practice to make sure your site’s visitors are providing the correct data in the expected formats. If you need help with form validation, contact our Support team.
1. How can I allow my client to manage their SiteLock subscription?
During subscribing the SiteLock service, you can assign your client to a user account. Your client then can manage their service through https://wam.manage.name. Note that the client can manage all the sites under the same user account, hence it is advisable to assign different user account for different client.
2. I own several websites. What do I need to protect them?
SiteLock is sold as a subscription per domain. You would purchase a separate subscription for each website that you would want to protect.
3. My business contains multiple domains or websites. How can I monitor them all?
You can manage and monitor all your sites and domains under the same dashboard if they are using the same user account.
4. What is Malware?
Malware, short for malicious software, can be installed on your website by hackers who are able to find weaknesses on your web server. A typical website may have thousands of potential vulnerabilities for malware injection.
Once placed on a website, malware can then be used to spread viruses, steal personal or financial data, and even hijack computers. It is not easily detected and may infect your customers’ computers after they visit your website. Ultimately, this negatively affects your business reputation and can result in lost business.
5. How does SiteLock protect my online reputation?
SiteLock’s patent-pending 360-degree scan helps you make sure your website and communications are reaching your visitors as intended in three key ways:
- Malware blacklist monitoring: We monitor search engine and proprietary lists of sites reported as malware to make sure visitors arrive at your site, not a “Red Screen” warning from their browser or search engine
- E-mail spam blacklist monitoring: We compare your e-mail address, domain name, and e-mail server to industry and proprietary lists used by popular e-mail programs to identify which messages to mark as “Spam”. This ensures that your e-mails reach your customers’ inbox – not their spam folder.
- SSL Scanning: If you have an SSL certificate installed on your site for data encryption, we will scan that certificate to verify that it is not expired or otherwise out-of-compliance with web browser expectations. This prevents users from seeing warnings about data security when they visit your site.
Failure to keep up with and monitor any of these items can result in lost customers, abandoned visits to your website, and wasted marketing and website design efforts.
6. What is Application Scanning?
Application scanning will verify the applications you’ve installed on your website against known vulnerabilities. As application versions age (like Joomla 1.5 or WordPress 3.0), hackers will find ways to attack these programs. The publishers then update them with newer versions, which you need to upgrade to in order to stay safe. SiteLock verifies your version against catalogs of vulnerabilities to ensure you are running safe software on your site. If we discover a vulnerability in our testing, we report it to you immediately and can help you secure your site.
7. How does SiteLock protect my data?
SQL injection, is an extremely damaging attack in which hackers will attempt to access information stored in your database, such as customer data or user ID’s and passwords. SQL stands for Structured Query Language and is the programming language understood by databases. By inserting commands from this programming language into fields on your website’s input forms, hackers can gain access to the database records of vulnerable sites, stealing credit card data, passwords, e-mail addresses and any additional data available in the database.
SiteLock SQL injection scanning reviews all of the files and applications on your website to detect any injections that have been inserted in your website code. If we identify an infiltration, we will notify you immediately via email. Your SiteLock dashboard will show a list of infected pages, and our Expert Services team can help you repair your website.
8. How do I renew my subscription?
You can enable the Auto-Renew option for your subscription. The service will be automatically renewed monthly or annually (depending on your subscription model). Please make sure you have sufficient balance within your account to ensure the service will not be unsubscribe due to low balance.
If you choose not to use the auto renewal feature, you can renew the service any time before the subscription ends via your partner central.
9. Can I upgrade my subscription?
Yes, you can upgrade your subscription to a higher tier package anytime.
10. Can I terminate my subscription?
Yes, you can terminate your subscription any time, however please note that the subscription fee is non-refundable.
SiteLock Trust Seal Installation
1. I am having trouble getting the SiteLock Security Certificate to display on my site.
First, we need to determine where you are installing your shield. Are you trying it on a page stored on your local computer or on a live web site?
If you are using a local computer for development, then you need to add http: before the several instances of ‘//shield.sitelock.com’ in the code so that it looks like http://shield.sitelock.com. The original code should work on any live web site and any major browser, but you need to make the adjustment above to display it on your computer.
To show the SiteLock badge on your site, please log in to your dashboard – available from your Premier Partner Central. At the bottom of the dashboard is the badge section. Choose a badge format, save your preference, and then copy and paste the code into your site wherever you want the badge to display.
In most CMS tools, such as WordPress, Joomla Drupal, etc., you can simply place the code for the SiteLock Trust Seal in the Footer code of the website.
SiteLock TrueShield WAF
1. What is SiteLock TrueShield WAF?
A Web Application Firewall (WAF) protects websites from attempts by malicious bots or hackers to break in to your website. Attacking websites through the applications (like your blog or shopping cart) has become the leading way for hackers and cybercriminals to bypass traditional security measures to steal data or traffic. Thousands of websites are compromised every day.
If hackers are able to access your sensitive information or administrative area though the web applications they can do extensive damage. They can steal data, deface or destroy your website, use your server to launch attacks on other sites, or worse.
TrueShield WAF protects websites from malicious traffic and blocks harmful requests. By using TrueShield you can protect your site from bots and targeted attacks with a 5-minute setup. Additionally, TrueShield will eliminate spammers and scrapers from attacking your website.
2. How can I use TrueShield to protect my online business?
Purchase and set up a PREVENT plan that includes TrueSpeed, a global content delivery network (CDN) and advanced acceleration to increase your website’s security while optimizing its speed.
3. What is SiteLock TrueSpeed CDN?
A Content Delivery Network (CDN) is a large distributed system of servers that are deployed in multiple data centers across the world. This system of servers delivers webpages and other Web content to a user based on the geographic locations of the user, the origin of the webpage, and where the content delivery server is located. The closer the CDN server is to the user geographically the faster the content will be delivered to the user.
SiteLock TrueSpeed CDN is an additional feature of the TrueShield firewall, which provides your customers the fastest and most secure experience when visiting your website.
4. What is the setup process for TrueShield/TrueSpeed?
First, select the necessary version to protect your online business from malicious traffic and bots. TrueShield Basic is included with any website scanning package or select a higher version from here. Once a plan has been selected, SiteLock uses the domain supplied to automatically identify if SSL support is needed. If detected, SiteLock will lead you through a simple process for activating SSL support. SSL support is included in TrueShield Premium and Enterprise versions. You will then be asked to change your DNS settings and route traffic through SiteLock’s network, rather than directly to your web server IP. Once you complete the DNS changes, traffic to your website through SiteLock’s network.
5. By using TrueShield/TrueSpeed, does SiteLock host my website? Will I need to change my hosting provider?
SiteLock does not host your website. SiteLock only serves as a proxy, standing between the website and malicious traffic to prevent attacks. Your hosting will stay the same. The only thing you are changing is the A record and a CNAME in your DNS records.
6. Will there be any downtime when setting up TrueShield WAF? Will it slow down my website?
We make sure you won’t lose even a single visit. SiteLock has a globally distributed network of datacenters (POPs) that ensures that every user and website are serviced by the closest POP. TrueSpeed CDN ensures that your site run faster and consume less computing and bandwidth resources by caching site data and applying other acceleration techniques.
7. Can I turn TrueShield WAF on/off anytime?
Yes. From the SiteLock dashboard, you can choose to disable and enable TrueShield/TrueSpeed anytime you want. When TrueShield is disabled, visitors will not pass through TrueShield and will reach your website directly.
8. Is SiteLock TrueShield PCI Compliant?
Yes, TrueShield is a PCI-certified cloud Web Application Firewall & CDN.
9. How does TrueSpeed CDN optimize a website?
- Dynamic content caching – TrueSpeed caches web site content on its proxies in order to return resources faster to users and reduce page load time, bandwidth and server load. TrueSpeed Premium and Enterprise not only cache static content but can also identify content dynamically, which can be cached while it remains unchanged.
- Compression – An average website page is 100KB to 500KB, depending on its content, structure, functionality and the resources it contains. For content-rich applications, the simple task of transferring the page to the browser can take a long time. Common web servers and browsers support content compression. Configuring the compression of resources on your web server requires complicated settings, technical expertise, and substantial processing power from your web server. TrueSpeed compresses this content for you, even when sent uncompressed from your server.
- Minification is the process of removing all unnecessary characters from source code, without changing its functionality. These unnecessary characters usually include white spaces, new line characters and comments, often used to add readability to the code but not required for its execution. By removing these characters, TrueSpeed minimizes your website’s size, making it lighter and reducing loading time.
SiteLock SMART (Secure Malware Alert & Removal Tool)
1. How quickly will it remove any issues?
If the customer has turned ‘auto-clean’ on then the fix is instantaneous, and we upload the file back up to the customer’s site on completion.
If auto-clean is off, then they have the option of fixing it by clicking a button or cleaning the site themselves based on the report that they see in the detail screen.
2. What issues does SMART look for?
- Signature based malware scans
- Links to bad places
- Fuzzy logic scans.
- We look for certain ‘things that look suspicious’.
- Some of these may actually be advance warning on new malware, e.g., code that has been obfuscated through 5 or more layers of obfuscation so that it is not humanly readable.
- They may be bad practices (e.g. there is code that sends email right next to code that takes a credit card)
- Known malware from signatures / database
- We look for certain ‘things that look suspicious’.
3. Will we only need the ftp login and not the cPanel?
Only the ftp login. This should be entered in the settings section for SMART.
4. What is the biggest difference between the current scan and the SMART?
- The current or ‘Outside-In’ scan finds ‘bad things’ showing up on the website when we pull it up. This shows the ‘EFFECT’ of the malware infection.
- SMART is an ‘Inside-Out’ scan where we examine the source code for the “CAUSE” of the problem.
Together, the two types of scans provide a holistic approach to keeping the customer safe.
5. What packages will the scan be available for?
There are 2 plans that include the SMART scanner. The FIX plan and the PREVENT plan both include the SMART Scan tool to remove malware automatically.
6. Will the scan work with all website platforms?
SMART works with any technology, as long as they give us the FTP access we need. It probably works best with sites that are built using PHP (WordPress, Joomla, etc.)
7. Is there a “page” or site size limit to what SMART can handle?
- As far as the customer is concerned, “Yes there is”, and it is driven by the limits set on the plan that they are on.
- Per GB by Plan –
- FIND – 0
- FIX – 2GB
- PREVENT – 2GB
8. Will the SMART Scan run through ALL website files (even the ones that do not pertain to the domain we are scanning)?
- There are 2 concerns at play here:
- Can the customer guide us to the correct place?
- Will there be plan abuse where the customer signs up for one site and then has us scan their entire list of 15 sites?
- To address concern (a.i) above, we have provided two settings:
- FTP creds; and
- Doc Root/Website root directory
Together, these are sufficient for the customer to lead us right to the folder that contains just the files for the website under contract.
- To address concern (a.ii)
- There is no way to be absolutely prevent this sort of abuse at the moment.
- 0ur size limits should give us some sort of relief from this kind of abuse should it occur.
- One of the options for synchronizing files between us and the customer involves our placing a PHP file on their site. This is an option that the customer has. Encouraging the customer to enable this option gives us a better chance of fighting plan abuse.
- Going forward, if we find that this sort of plan abuse is rampant, we will look at designing a solution to it. At this time, we prefer to focus on code that achieves better scans, than on preventing plan abuse.
9. Will we be able to manually run Smart Scan in the same way we run Forced Scans now?
- Yes. From the details screen for SMART as well as from the dashboard view.
- Will Smart Scan create logs / audit trails to document its work? (THIS IS A MUST-HAVE!!)
10. How long will it take for a problem to be removed through the SMART?
- If we have a good malware signature in our database, then we fix it as soon as we find it.
- Sometimes, we do not have a signature, but the source code cannot be cleaned automatically. In these cases, we point to the issue, but removal requires manual intervention – perhaps by Expert Services, or by the customer themselves.
11. Can we force the scan like we do with our regular scans?
12. Is there anything that could prevent us from performing the scan?
- Yes. The FTP may not work (due to bad URL or credentials) which would prevent us from starting.
- Even if we do start, we might only be able to do part of a site on the first day because there are so many files that we
- Either could not download them all; or
- Blew our quota on how much time we spend on a site.These numbers vary, and the important thing is that we will resume the next day, or next period
- The host may terminate our connection because they have strict limits on how much bandwidth a customer can consume.
- There may be a server exception on the customer’s end when we try
to download or upload the source files.
Whatever be the cause of the error, we will display it in the detail screen for SMART and the user should have a good idea of what to do next. In the case of server errors, they may call into support and those tickets might require some investigation to resolve.
13. Will the customer need to set their ip permissions, so we are able to get to the FTP?
Depends on the hosting setup. If our FTP consistently fails, then we might need a discussion with the host.
14. Will we alert the customer about an issue on their site that SMART has found or we will just remove anything on the back end and will not bother the customer?
When a customer buys SMART, they are expected to look at the scan results in the SMART detail screen periodically – there is no action required of us as an Expert Service or Sales organization.
15. Is it safe for us to have the customer’s ftp info on hand all the time?
For SMART, this FTP info is held in our secure database. This is a responsibility that we take very seriously.
16. Does the Smart Scan create backup files?
SiteLock keeps backups of a downloaded website for up to 7 days. Once it has reached that time frame, the files are discarded.
17. Will our system email the customer if we are unable to connect to their FTP?
- There could be multiple problems with FTP downloads:
- We were unable to connect because of credential issues (wrong username or password, incorrect URL)
- We timed out when we tried to download the files
- Something on the customer’s server went awry and the server had an error.
- Yes, we alert a customer if the FTP server was unable to connect, or any other specific error. However, SMART Scan will not alert a customer if there is a time-out issue when trying to scan all of the files.
18. Will we be changing the customer’s ftp password for security purposes and if yes, how often?
No, we will not.
19. Will the scan slow down the site?
- The very first time that we scan a site, we will take some time to download the files from that site. This may be take a while and have a small effect on the site, especially for the larger sites. As the days go by, we will be downloading fewer files, because we are only going to pull down changed and new files to our server. This should reduce the impact we have on the server.
- All the actual scanning happens on our servers, so the customer’s site
will not be affected.
20. How often will the scan run?
This is configurable in the settings section. Customers can choose daily, weekly etc.
21. How long will one scan take?
- This depends upon the size of the site – how many files there are etc. Each file is scanned very rapidly.
- The scan happens on our site, so the total wait that the user will experience when he initiates a scan is: Time to download + time to scan + time to upload.
22. Will we be able to see the scan results in the Dashboard?
23. Will Smart Scan also scan the customer’s database? If so, how would it’s changes be backed up?
At this point, we do not scan the contents of the database.
24. Will it benefit a customer who is on a dedicated server?
25. Will we be scanning the server apps or just website apps?
Website apps, not server side. This scan identifies known frameworks of code, such as Joomla, Drupal, or WordPress and checks whether the core files in the framework differ from the files on the server.
26. Will it advise the customer that they still need to submit to Google’s StopBadware?
SMART does not check blacklists.
27. Will it do any vulnerability penetration testing?
Penetration testing is not part of the SMART product.
28. How will they be able to tell if the scan actually fixed the issue with the site?
- When a customer logs in to the dashboard and navigates to the detail section for SMART, they will see a report that tells them the things that we found, and the things that we fixed.
- Some things that we found may not be fixable through code, or it might be dangerous to try and fix them through code. In this case, the customer will need to clean that section of their code manually (Expert Services).
29. What benefit does Expert Services serve if we have a SMART scan to remove issues automatically?
- There are new kinds of malware that are found every day. There may be a short period of 24 to 48 hours during which SMART is not aware of these new attacks. However, our Experts are always aware of the latest attacks and can therefore fix the sites manually.
- The urgency to restore the site will be driven by the customer’s needs and the nature of the site. The fastest way to get a site cleaned and restore may still be to use the EMERGENCY scan.
30. Why can’t SMART remove everything?
SMART looks for known malware within the code base. New hacking scripts and malicious codes are created each day. Another reason that SMART might not remove malware on a site is because of the risk involved. For example, a site heavily infected with malware embedded in the coding may break the site. If the scanner finds that removing the code would affect the functionality of the site, it will leave it there and just warn the customer of its findings. This is where SiteLock’s Expert Service cleaning services for a fee would be the best alternative to fixing the site.
31. What are the limitations to SMART?
SMART is intended to automatically detect and remove malware within a website. Malware is identified via a signature-based scan. We check source files against a growing database of millions of signatures.
Although SMART removes the vast majority of malware from websites, SMART does not provide a guaranteed fix. Depending on the type of infection on the client’s site, SMART may not be able to correct an issue. SMART will not remove any new or unknown hacks that we do not know of. SMART serves as a great first option to resolving issues because it is cost effective and most cases can resolve all issues.