When it comes to web security companies, our experience has been that most of them don’t seem know and or care about security, which we think that goes a long way to explaining why web security is in such bad shape. One company that fits that bill for that is SiteLock, as can be seen in just few of our previous posts on them, whether its them failing to properly clean websites, to claiming website was secure when it contained malicious code to compromise credit credentials, to falsely claiming that WordPress websites have vulnerabilities due not understanding how WordPress handles security. More recently SiteLock has sets itself apart from the average bad security company in our eyes, by combining that with activity that looks more like outright scamming.
In looking into SiteLock one of the things that has stood out for us is that they have partnerships with with so many web hosts. Based on their poor track record when it comes to security we assumed that that the partnerships had to do with money being paid to the web hosts and not on those web hosts feeling that SiteLock providing a quality service. This seemed even more true as the complaints have piled up against SiteLock, which have frequently also cited their partnered web hosts. If it wasn’t about money, they easily could have found another security company to partner with that wouldn’t damage their reputation in this way.
As we discussed yesterday, it turns out that part of the actual explanation for why some web hosts had partnered with SiteLock has a more troubling explanation. The CEO of Endurance International Group, which provides web hosting services under a variety different brand names (including A Small Orange, Bluehost, FatCow, HostGator, HostMonster, iPage, and IPOWER) is also one of the majority owners of Sitelock (a board member of Endurance International Group is the other majority owner along side them).
While looking into that situation we found confirmation that at least with that company, they are getting a portion of the fees for SiteLock’s services. As noted here in the prepared remarks for earning conference call in May of last year Endurance International Group disclosed that they get a majority of the SiteLock fees from their partnership (PDF):
The revenue share between Endurance and IBS for Sitelock has been set at 55%/45% in favor of Endurance.
That goes a long way to explaining why web hosts are willing to get involved with SiteLock, despite the potential damage to their reputation. Consider this comment on one of our previous posts:
Listen to this: Bluehost persuaded me to get Sitelock security for my website and I stupidly paid $500 for a year. This was in January. Yesterday, Sitelock alerted me to malware on my site that could result in terrible consequences. They would remove the malware for a one-time fee of $300! I contacted them to say, “WHAT WAS THE $500 for??” and a hostile character calling himself “sean” told me it was for “scanning.” This company needs to be stopped from continuing their predatory practices.
The web host would be getting $275 a year without having to do any work, versus the $131.88 they would receive for what they claim is their most popular shared web hosting plan at its normal price (for which they would also have the expenses associated with provide the web hosting).
This also seems to go a long way to explaining why SiteLock’s services sometimes come with extremely high prices, since they are getting less than half of the fee being paid.
If you wondering how much money we are talking about, the conference call remarks also listed the payout they made to SiteLock in financial year 2014:
Revenue share payments to IBS related to Sitelock totaled $5.4 million in FY14.
