Is SiteLock Providing Their Customers Access to All Accounts on GoDaddy Servers?

In looking over complaints about the web security company SiteLock a lot of things come up over and over, take for instance the end of a review of them from earlier this month at the website ConsumerAffairs:

Worst case scenario: a site will become infected with malware. Again, I get the auto-email with no clue to which site is infected. You have to upgrade your account to get it cleaned and then it never stays clean. It continues to get infected every few months and they do nothing to help you prevent or fix it. The one site that I’ve had this happen to, I ended up upgraded to the manual clean & monitoring service. Instead of them cleaning it when it happens, they send that email (you know the one, without any clue as to which domain it is referring) and then I have to call them to request it to be manually cleaned. AGAIN. They don’t just automatically do it, like the service implies. I cannot tell you what a frustrating phone call it is. They have no email or chat support and you are stuck to a phone call with someone who is trying to earn commission and has no interest in supporting you. DON’T USE THEM.

A lot of that isn’t surprising if you follow our blog, as we have discussed that usually when you get in contact with SiteLock you are dealing with a commissioned sales person (and how that looks to lead to untrue information being told to potential customers), the fact they cut corners when doing cleanups and leave websites insecure. It could actually have been worse as this review involved websites hosted at GoDaddy and we have previously discussed instances where websites cleaned through their partnership with SiteLock have left the websites broken.

What was new in this review was the claim of the prior paragraph of the review:

Once I find the account with the issue to reconnect, it is an absolute nightmare to do so. You have to enter the FTP info, then sift through EVERY SINGLE Godaddy site on the server to find yours (I’m not kidding, and I’m sure you can imagine there are a lot of sites on Godaddy’s server – why I have access to every single one of them via SiteLock seems like a security issue in itself). It’s an extremely tedious, SLOW and frustrating process.

It isn’t clear what level of access they are referring to there and what could be done with it, but there shouldn’t be any access to unrelated accounts at all (especially through a security service).

If you have more information on what access they are providing through that please leave a comment on this post or get in touch with us.

SiteLock and Bluehost Falsely Claimed a Website Contained Malware Due to SiteLock’s Poor Scanner

When it comes to the web security company SiteLock, one of the frequent complaints is that they and their web hosting partners falsely claim that websites have malware on them. After that happens the web hosting company frequently suspends access to the website and pushes the customer to hire SiteLock to clean up not existent malware. We thought it would be useful to look at an example of this we were recently consulted on, as those dealing with the possibility of a false claim should know a number of things when dealing with it.

This situation involved the web host Bluehost. Bluehost is one of many brands the company Endurance International Group (EIG) does business under. Some other major ones are A Small Orange, FatCow, HostGator, iPage,  IPOWER, and JustHost. The company’s web hosting brands are very open about having a partnership with SiteLock, what they have, at least in the past, refused to acknowledge publicly is that partnership involves EIG getting 55 percent of revenue for SiteLock services sold through that partnership (that information was disclosed to investors). That obviously raises some serious questions and it probably explains in large part a lot of the problems that arise from that partnership. What they also don’t disclose to their customers is that the majority owners of SiteLock are also a member of the board and the CEO of EIG, so they are well aware of SiteLock’s practices.

What we have repeatedly said is that if you get contacted by SiteLock or one of their web hosting partners claiming that the website is infected or otherwise is hacked, is that should not ignore it. While there are plenty of situations like the one discussed here where there is a false claim, the claim is also often true. For a hacked website, the longer you wait to do properly clean it up, the bigger the problem can be. Instead we recommend that you first get any information that SiteLock and or the web host will provide and then get a second opinion as to whether the website is hacked. We are always happy to provide that and we would hope that other security companies would as well (when someone contacts us about a hacked website we always make sure it is actually hacked before taking on a cleanup).

One of the reasons for getting a second opinion is that someone familiar with hacked websites should understand how to easily check the validity of the claims made. While someone not familiar with the situation might try doing checks that won’t necessarily be very useful. In this situation one the things the website’s owner did was to download a copy of the website’s files and run them through a malware scanner. That likely is going to fail to identify many files that contain malicious code because a malware scanner for a computer isn’t designed to detect those files (our experience is that scanners designed to scan website files don’t produce great results either).

When we were provided the information that the website’s owner had received, the first element that caught our eye was this result of SiteLock’s malware scanner:

What was shown was rather odd as the malware scanner claimed to have detected a defacement hack (labeled as “SiteLock-PHP-HACKEDBY-klw”), which isn’t malware. So at best the scanner was incorrectly labeling a hacked website as containing malware, when it had a different issue.

More problematic is that it looks like they might are flagging websites as being defaced just because they have text that says “hacked by” something. That could produce some rather bad false positives, since this post itself could be claimed to contain malware simply by using that phrase. They also mark that detection as having a severity of “Urgent”, despite that.

So was the website defaced as that scan seemed to indicate? The website was taken down by the point we were contacted, which wouldn’t need to be done just because there was a defacement and makes it harder for someone else to check over things (whether intentional or not, it seems like something that makes it easier to push someone to hire SiteLock to resolve the issue). Looking at the Google cache of the website’s homepage though, we were able to see what happened.

The website’s page contains a section that shows RSS feeds items from other websites. One of those websites had been impacted by a vulnerability in outdated versions of WordPress that allowed defacing posts and the results of that defacement was showing on this website:

That “hacked by” text on showing there didn’t mean this website was infected with malware or otherwise hacked and the website didn’t pose any threat. That is something that anyone from Bluehost or SiteLock familiar with hacked websites should have spotted by looking over the website for a few seconds, but clearly that didn’t happen, even when they suspended access to the website. Both of them have an incentive to not check to make sure the website is hacked, since they have monetary interest in selling security services in this situation even though they are not needed. As we mentioned recently it appears that when you are in contact with SiteLock you are dealing with a commissioned sales person, not a technical person, so they might not even understand what is actually going on either (one situation we looked at recently would strongly seem to indicate that as a possibility).

Looking at the files that Bluehost had listed as being infected, they were just cached copies of the content from the website that had the RSS feed section in them. So there wasn’t any malware in them.

It also seems that no one from Bluehost or SiteLock bothered to contact the other website to let them know that there website was actually hacked, seeing as it was quickly fixed after we notified them of the issue they had.

At this point the website’s owner is planning to move to a new web host, which doesn’t seem like a bad idea (we think that people should avoid web hosts that have partnered with SiteLock even if they have yet to run into this type of situation).

SiteLock Review Shows the Problem of Relying on Customer Reviews To Determine Quality of Security Companies

We have frequently mentioned the fact that many security companies don’t know and or care much about security. That not surprisingly leaves the public with a lot of bad options when they are looking for someone with security expertise to help them deal with a hacked website or other security issues. So how can they find one of the few companies that don’t fall in to one of those categories? We don’t know of an easy way, but we do know that looking at customer reviews of security companies isn’t a good way to do that.

We frequently are brought in to re-clean hacked websites after another company had been brought in to do that. While that isn’t always the company’s fault, we have found that in almost every instance the company doing the cleanup either didn’t know what they were doing or intentionally cut corners. We know that because we always ask in these instances if the previous company had determined how the website was hacked (since if the vulnerability hasn’t been determined and fixed it would leave the website open to being hacked again), and the response is almost always that trying to determine how the website never even came up. Considering that is one of three main components of a proper hack cleanup, that shouldn’t be the case. In more than a few cases even at that point the person we are dealing with said that the previous company did a good job, which doesn’t seem accurate considering they didn’t do things properly and the website was hacked again. If people think they did a good job at that point, we would assume that even more would have said that right after the original work was completed.

To give you another example of this we thought something we ran across involving web security SiteLock is worth highlighting. Here is a review of SiteLock from August of last year that comes from the BBB page for them:

Sitelock has been a great and affordable toll to achieve… security challenges, and enabled idbasolutions.com to offer our visitors peace of mind. In one and only incident in 2012, Sitelock emailed us as soon as they detected that some malicious software had infiltrated our comment pages…they quickly deleted all malicious code.

The problem with that review is that the website isn’t actually secure and hasn’t been secure for some time. The website is running Joomla 1.5, for which supported ended in September of 2012, over four years ago.

You wouldn’t know that if you were to believe SiteLock, as of today they are claiming it is secure:

It would be easy for SiteLock to determine that the website was running outdated software and isn’t secure, as the source code of each page on the website contains the following line:

<meta name=”generatorcontent=”Joomla! 1.5 – Open Source Content Management” />

So the review’s claim that SiteLock services “offer our visitors peace of mind” is true, but it is because SiteLock is not telling the website’s visitors the truth.

Considering that SiteLock missed such an easy to spot issue, it isn’t hard to believe they might also miss more serious issues, and in fact our past experience shows that it isn’t a theoretical issue. So while the review is positive, the underlying reality is the opposite.

Considering that customers of security services are hiring them in the first place, it isn’t likely that many reviews come from someone who would actually be aware of a failure like SiteLock’s here, so many other reviews of them are probably unintentionally misleading others as well.

When You Get In Touch With SiteLock You Are Dealing With a Commissioned Sales Person

As we have found out more about the web security company SiteLock over time a lot of things that we previously heard and saw about them have come to make more sense.

One those things was we found out that is that when you get in touch with SiteLock you are likely dealing with a commissioned sales person. That seems to go a long way to explaining, for example, why when people who are already paying for SiteLock protection services get hacked that the response from SiteLock is to try to sell them additional services or even more expensive services similar to what they already have, as that person interest in selling them something, not in trying to resolve what went wrong with the protection SiteLock was supposed to be providing. That also leads to other issues, like dealing with someone that either doesn’t understand much about security, leading them to make rather ominous sounding claims, or saying things they know to be untrue to try to scare people in to spending more.

Something else we ran across recently seems to show how those commissioned sales people view potential customers, who in many cases have just had their websites hacked or  access to their website blocked based on a claim that the website is hacked (which is not always true), which seems in line with what we mentioned in the previous paragraph. In a review of the company by a salesperson on Glassdoor they said this:

If you are willing to work weekends you will make a TON of money!
My commission checks in sales range from minimum $3500-$7300.
The only company where we’ll never be able to call all the leads if we tried. So many untouched leads because the market for our product is so large.

So people who are dealing with a stressful situation are simply leads to them.

Not surprisingly with how they sell people on their services they have a lot of customers that are canceling as mentioned in another review on Glassdoor:

Company has a high churn rate with regards to customers which directly impacted bonuses of their employees. (Myself included) There were 2(back-to-back) months where our inbound sales team did not receive our commissions despite passing our monthly goal as a team entirely.

That is even though they make it rather difficult to cancel their service and even though you are apparently dealing with sales people even when you try to cancel the service.

Avoiding SiteLock

If your web host is pushing you to use SiteLock due to a claim that your website is hacked then your best bet, from everything we have seen and heard, is to simply avoid using them, as the commissioned sales people are only tip of the iceberg with the bad experience many people come away with. While they do push SiteLock, if you ask the web host they will let you know that SiteLock is not required to do the cleanup.

Seeing as your web host likely gets a majority of what you pay to SiteLock (one major web hosting company that is run by SiteLock’s owners disclosed to investors that they receive 55% of the revenue from their partnership) despite not doing the work, you are necessarily going to overpay when going with SiteLock.

For the type of low quality cleanups that we have seen them providing you can find an equivalent service from many other providers for much less than they charge and we provide a high quality cleanup that often costs less than SiteLock charges (we will first check to make sure your website is hacked, so you are not paying for an unneeded cleanup).

Don’t Ignore a Message From SiteLock or Your Web Host That Your Website Has Malware

When it comes to the poor state of web security we often find that security companies play an important role in that. That includes making up threats and telling people they need to take advanced security measure, while many, including those same companies are still failing to do the basics.

Another area we have seen this involves the security company SiteLock and their web hosting partners. We have written numerous posts about SiteLock’s bad practices, one of them being that they and their web hosting partners (who get paid handsomely to push their services) sometimes falsely claim that websites contain malware or have otherwise been hacked. What we have consistently said though is that you shouldn’t assume that the website isn’t hacked and recommended getting a second opinion (something we are happy to provide for free). Unfortunately people often conflate SiteLock’s many bad practices, with the idea that any claim by them or their partnered web hosts that a website is hacked as being false.

For example, yesterday we ran across someone on Twitter claiming that Bluehost was falsely stating a website had malware on it:

We asked how them how they determined that and the answer was they hadn’t actually done that:

We then tried to explain that while there are false claims made by them and the web hosting partners, the claims are often true and suggested that they get a second opinion from a security company (and letting them know we do that for free), at that point they blocked us.

If the website did contain malware, which seems to be of decent likelihood, then their tweets help perpetuate the issue.

Ignoring the Evidence

What makes the false claims is even more problematic is that it feeds in to an existing belief that we have often seen with people assuming that claims that their website are hacked are not true, even when coming from parties that have no profit motive (like Google).

When it comes to SiteLock and their web hosting partners we see two very different scenarios.

In some cases access to the website is shut off immediately and they haven’t provide any evidence of the supposed hack that lead to that happening, which makes the claim legitimately seem questionable.

In others they actually provide evidence, which should be easily checked, but is instead ignored. Take for example, someone, also hosted with Bluehost, that contacted us recently. They had been sent the following email by their web host:

[redacted],
Your [redacted] account has been deactivated due to the detection
of malware. The infected files need to be cleaned or replaced with clean
copies from your backups before your account can be reactivated.

Examples: /home1/[redacted]/public_html/config.php.suspected
/home1/[redacted]/public_html/post.php.suspected

/home1/[redacted]/public_html/administrator/components/com_weblinks/tables/s
ession.php

/home1/[redacted]/public_html/components/com_content/models/articles.php

To thoroughly secure your account, please review the following:
* Remove unfamiliar or unused files, and repair files that have been
modified.
* Update all scripts, programs, plugins, and themes to the latest
version.
* Research the scripts, programs, plugins, and themes you are using
and remove any with known, unresolved security vulnerabilities.
* Update the passwords for your hosting login, FTP accounts, and all
scripts/programs you are using. If you need assistance creating secure
passwords, please refer to this knowledge base article:
https://my.bluehost.com/hosting/help/418
* Remove unused FTP accounts and all cron jobs.
* Secure the PHP configuration settings in your php.ini file.
* Update the file permissions of your files and folders to prevent
unauthorized changes.
* Secure your home computer by using an up-to-date anti-virus program.
If you’re already using one, try another program that scans for
different issues.
You may want to consider a security service, such as SiteLock, to scan
your website files and alert you if malicious content is found. Some
packages will also monitor your account for file changes and actively
remove malware if detected. Click here to see the packages we offer:
https://my.bluehost.com/cgi/sitelock

Please remove all malware and thoroughly secure your account before
contacting the Terms of Service Department to reactivate your account.
You may be asked to find a new hosting provider if your account is
deactivated three times within a 60-day period.

Thank you,

Bluehost Support

http://www.bluehost.com
For support, go to http://my.bluehost.com/cgi/help

Over a month later they were notified by SiteLock that the website had been deactivated. Even then they didn’t look at the files that Bluehost had provided as examples of the malware infection, while questioning if they were really hacked.

When we took a look at the names of the files and their locations mentioned in that email, we noticed one of them wouldn’t normally be in that location in a Joomla website. That isn’t something we expect that the average person would know, but it does show how easy it should be for someone that has actual expertise with dealing hacked websites using the software running your website to double check the claims for you.

Looking at the content of the files, we think that even a layman would think that something was off with them. And for us it was obvious by just looking at them that they really were part of a hack and not a false positive, so we could easily confirm that the claim was actually true in this case.

Get a Free Consultation From Us

If you are have been contacted by SiteLock or a web host (whether a SiteLock partner or not) claiming your website is hacked, feel free to contact us to have a free check done to see if the website is really hacked and if it is we will provide you with a free consultation on how you can best deal with the issue.

If your web host is pushing you to use SiteLock you should be aware of a number of items before making any decisions and you should know that we can provide you with a better alternative for cleaning up the website for less money.

Cancelling SiteLock Services Sounds Like It Is Just As Bad As Everything Else With Them

Yesterday we looked at an example of the web security company SiteLock trying to mislead someone on what leads to websites being hacked to get them to purchase a reoccurring service with a long term commitment instead a one-time service. Using their one-time cleanup is also a bad option since it doesn’t include fixing vulnerability that allowed the website to be hacked, while costing more than we charge in many instances for a proper cleanup that actually includes the work to secure the website (you can also get a lower quality cleanup from many companies for much less that SiteLock charges). If you make the mistake of signing up for one of SiteLock’s ongoing services you are in for more problems based on what we have seen mentioned by their customers.

In the past we have had people comment and discussed that these service don’t protect websites from getting hacked and SiteLock explaining the solution is to pay them even more.

At least in some instances people are being charged without receiving any invoice or other notice of the ongoing charges.

Then there is trying to cancel, which we have seen numerous complaints from their customers about.

First off, according to their customer agreement you have to call in to a cancel the service:

All cancellation requests must be submitted by calling our Customer Care Department at (415) 390-2500 and must be made prior to the expiration of the Service term.

In one customer’s complaint they mentioned something that really isn’t that surprising to hear about what happens when you call:

It is not possible to each the billing department except by phone and when you call you are connected with a telemarketer that try’s to upsell you and they become rude when they realize there is not going to be a sale.

The “billing department” is actually a salesroom.

You might be waiting a long time to even get to that as one review on SiteLock’s BBB page reported that:

I tried to cancel my account and it is nearly impossible. Was on hold for over 45 minutes and the person said they did and low and behold….billed the next 2 months.

And here is another complaint with someone taking even more time

I’ve spent two hours, over 4 phone calls attempting to cancel the service by phone. I’m currently on another extended hold waiting for a ‘cancellation agent’.

(While it sounds like making you call is about trying to make it difficult to cancel or try to sell to you again, it turns out that for a web services business they don’t seem to be very web savvy, as one of their web hosting partners list that you need to call SiteLock to have their CDN’s cache of your website manually cleared as well.)

If that isn’t bad enough if you don’t cancel at least thirty days prior to end of the subscription period you are going to being paying for another one according to their customer agreement:

Such cancellation must be made at least thirty (30) days prior to the end of Customer’s current subscription period.

Considering that these are web services that should easily be turned on and off, this sort of lead time doesn’t make sense.

In other instances people have complained about various cancellation fees as well, even though with what the services include that doesn’t seem like it would be a reasonable thing.

SiteLock Misleads Potential Customers About Why Websites Get Hacked To Lock Them In To Long Term Commitments

One of the oddest claims that we have seen related to the web security company SiteLock was that they “don’t control how the hosts sell their services to customers”, which came from a journalist and seemed to be based on their conversation with a SiteLock employee. It’s odd because in what kind of partnership would one partner not have any control over how their services are being sold, but especially in the case of SiteLock’s partnerships where they are paying the web hosts a lot of money to partner with them (one web hosting company disclosed to investors that they get 55% of the revenue of sales of SiteLock services) and when many of the partnered web hosting brands are run by SiteLock’s owners. The other thing that made this so odd is that from everything we have seen the problematic way their services are sold usually involves sales made by SiteLock themselves. The web hosts just push their customers to SiteLock and then when their customer gets in touch with SiteLock they are put in touch with a commissioned sales person, which is where the problems really start.

We have seen and heard plenty snippets of what that involves in the past, but we recently ran across an example of an email from SiteLock that shows how they try to trick people into overpriced services. Not surprisingly considering that they are willing to tell people things that are not true even when the truth doesn’t seem to be a big deal, much of what they said is far from the truth.

Let’s start from the beginning of the email:

It looks like the issue your website is having is more than just infected files and you’re goign to need a manual clean. I recommend the SecureSite plan. I recommend this plan because you’re going to need several cleans during this process (of being under a targeted attack) but the malware itself isnt the biggest issue. The biggest issue the vulnerability that is allowing a hacker (or bots controlled by a hacker) to inject code or infect your files.

SiteLock makes a big deal of their automatic malware removal and how that sets them apart, but what we often see is they tell people that it won’t handle the issue on their website and they are going to need a manual clean, which comes with an additional cost. In one case they also claimed that a website couldn’t be automatically cleaned “without risking bringing down our site”.

A real problem with automated malware removal is that when cleaning up malware or other malicious code what is found can often provide important information on how the website was hacked, so if the cleanup is fully automated the cleaner is potentially going to miss important information needed to get the website secured. Normally SiteLock doesn’t actually determine how the website is hacked, so that doesn’t matter, but not doing that leaves the website open to the possibility of being hacked again. While doing that is actually a basic part of a cleanup, as will come up later SiteLock will charge even more money to do that (for a lot of cleanups they charge more to just remove the malicious code than we do for a proper cleanup including getting the website secured).

There is always going to be a vulnerability that allowed a hacker in, otherwise how would the hack have even happened.

The claim that website is being targeted isn’t actually true, unless you count every hack as being a targeted one. The explanation of how the website is being targeted doesn’t make sense:

You are being targeted by this hacker, they already know how and where the vulnerability exists and they will not stop sending bots to you until your website is destroyed or until the bots “hit a wall”. Typically about 4-5 months of rejected attempts the hacker will send the bots elsewhere as they’re usually after low hanging fruit. They’re hacking 10s of thousands of sites at a time and usually the goal is stealing traffic or placing malware on your site to get onto peoples computers to steal information. After the vulnerability is fixed, they’ll move on, I wish I could elaborate on what’s causing this right now but I don’t want to just guess, the data in the manual clean will give me exactly the information I need whether it’s having our technicians recode entry fields on the website or if something needs to be done on a server level via your host.

From dealing with many hacked websites we get the sense that this is written by someone who has no idea what actually happens with hacking attempts on websites, which they probably don’t, since it was coming from a sales person not a technical person.

The reality is that most hackings are not targeted at specific websites; instead hackers try to exploit the same vulnerability across many websites, which is often referred to as a mass hack. Either the website is vulnerable and the hacker will take further actions once they successfully exploit the vulnerability or they will move on to other websites. Often times there look to be numerous different people or groups trying to exploit the same vulnerability, so a vulnerable website might get hacked more than once (that is good reason to promptly deal with a hacked website once you become aware it has been hacked).

Hackers are not usually interested in destroying websites. The closet we see with that are defacements hacks where a hacker causes a website’s pages normal content to be replaced with a message from the hacker. The website’s content would normally not be destroyed by that. In other cases hackers are interested in using the website to do something else, say sending spam emails, which wouldn’t destroy it at all. Of course if you are trying to scare people, then telling hackers are trying to destroy their website would make sense.

Another part of shouldn’t really make sense even if you are not familiar with hacked websites. The email claims that “Typically about 4-5 months of rejected attempts the hacker will send the bots elsewhere as they’re usually after low hanging fruit.” Why would a hacker keep trying to exploit a vulnerability for months on end when either the vulnerability is exploitable or isn’t? The answer would seem to be that they are trying to lock you in to a six month commitment to one of their services, again this coming from a salesperson.

After the manual clean we will also your host (if your website is suspended) so that they can re-instate the account if you’ve been deactivated, we will also take care of any blacklisting issues (Google, Norton, AVG, Avast, Bing , Yahoo, etc… if there is a warning screen stating that your website is malicious or that it has malicious content). You do have the option of purchasing a one time clean from us but typically within 24 – 72 hrs, you’ll need another clean due to the bots attacking you. One time cleans are also $300 per clean, per domain and vulnerability fixes are the same price of $300 per domain.

A proper one time cleanup would actually involve determining how the website has gotten hacked and making sure it is fixed. Their pricing is just outrageous. If you want a poor quality cleanup that doesn’t involve doing things properly, you can spend a lot less than $300. For many websites we charge less than $300 to do things properly, meanwhile SiteLock wants $600 to do that. The idea that they would even sell a service that they know leaves a website vulnerable is rather troubling.

I would also be happy to review the services with you after 6 months to make sure that bot traffic has decreased, I encourage you to reach out to me so we can determine whether you’re still being targeted. I can proudly say that 100% of my customers that follow my recommendations (after the clean, as far as general maintenance) not only are malware free and no longer the victim of a targeted attack but also likely will not have a need for unlimited cleans and can explore other options (we have nearly 70 different products and services).

Here we get to them trying to get you to a six month commitment, the price of this wasn’t mentioned, but we have recently had people mention that they are trying get them to sign up for services that are $100 a month (in some instances it is even higher than that). That would be the same price as their overpriced cleanup and securing service, but with the added difficulty of trying to cancel the service at six months. The fact that they offer a service with unlimited cleanups is a good indication that they don’t properly secure websites, since if you do a proper cleanup the website shouldn’t be able to be exploited through the same issue again at all.

Considering that very few websites are ever targeted by hackers, the person receiving this email likely was never targeted in the first place.

SiteLock Provides More Evidence That They Are Not Being Truthful About Who Provides Their CDN and WAF Services

Back in November we discussed evidence we had found that indicated that the web security company SiteLock’s TrueSpeed CDN and TrueShield Web Application Firewall services were actually provided by another company Incapsula, while SiteLock made it sound like they are providing them directly. At the time we mentioned that is “troubling as all of the customer’s website’s traffic is going to be running through a company that they don’t have a relationship with or are even likely to know is involved”. It is also troubling to think that a security company would be lying to their customers like that, since a big part of security is trust. If they are lying about something like this, where we don’t see why they even would need to, you reasonably have to wonder if there is something they wouldn’t be willing to lie about.

A recent post on SiteLock’s blog provided further confirmation that these services are actually provided by Incapsula while at the same time making it sound like SiteLock is providing them directly. In the December 18 post SiteLock TrueShield Updates they let their customers know of new IP addresses being used by those services that some of their customers would need to whitelist. Those IP addresses are

107.154.129.0-107.154.129.255
107.154.192.0-107.154.192.255
107.154.193.0-107.154.193.255
107.154.194.0-107.154.194.255
107.154.195.0-107.154.195.255
107.154.196.0-107.154.196.255

If you look up who those belong to it is Incapsula: example 1, example 2, and example 3.

In the post there is no mention of Incapsula, but they is plenty that would make you think that SiteLock is actually providing the services. In a large font they refer to the IP addresses being used by the services as “ours”:

If you are adding our IP addresses for the *FIRST TIME* 

In explaining why the new IP addresses are being added they mention their servers and IP address, despite those pretty clearly being Incapsula’s instead (emphasis ours):

The SiteLock servers periodically make requests for updated content from your website’s hosting server. This ensures that we are delivering the freshest content to your visitors. During periods of high traffic, we may make more frequent requests for content than during off-peak periods. Cloud technology of this kind uses a finite number of unique IP addresses to fulfill these requests, making this behavior appear as a security threat to some firewall services. This can be due to the large number of requests from a disproportionately low number of perceived unique visitors. Whitelisting or creating firewall exceptions for our servers’ IP addresses prevents your other security systems from blocking legitimate traffic relayed through our servers.

If we were not already familiar with a litany issues with SiteLock (you can see some of those by looking over our previous post about them) we would say this would be a good reason to avoid them, but with all the others you should have more reasons to avoid them then you should possibly need.

Two of The Top Three Reasons SiteLock Promotes For Web Hosts To Partner With Them Are Revenue Related

When it comes to people being taken advantage of by the web security company SiteLock, their web hosting partners seem to play a critical role, as it looks like a lot of their business comes through them instead of people going directly to SiteLock. What seemed to us to be the likely explanation of why the web hosts would partner with SiteLock despite them being quite bad at being a security company and their sales practices, was the web hosts getting paid to push their services.

What was surprising to us when we ran across it is how much money they are getting, one of SiteLock’s web hosting partners, the Endurance International Group, disclosed to investors that they get 55% of the revenue from the SiteLock partnership (it also turns out that the web hosting company is also run by one SiteLock’s majority owners). So people that get pushed to their service end up paying at least twice as much as the service they are really getting costs.

That obviously raises some serious questions about the arrangement, but what seems of more concern is that from what we have seen their web hosting partners don’t disclose the financial arrangement. (What they will sometimes say instead is that SiteLock is a trusted partner, which doesn’t point to the web host being someone you can trust.)

When a web host tells their customer that should hire a certain company to clean up your website, we don’t think it is unreasonable that they should be told the truth about why that recommendation is being made.

With one of the web hosts owned by the Endurance International Group, HostGator, we found that the wouldn’t even acknowledge that they are getting any money out of the partnership when it was pointed out their parent company has already disclosed this fact to investors.

While the web hosts are not upfront about this, when SiteLock is promoting the partnerships program to web host they are. Here is the list of the “Top Three Reasons to Partner with SiteLock” from the page about their program:

The first two items listed are revenue related:

Generated $20
Million in Partner
Revenue

and

Dedicated SecurePartner
Support on Sales and
Marketing Efforts

So that gives a pretty good idea of what these partnerships are really about, if it wasn’t clear already.

What the third one is supposed to refer isn’t entirely clear, SiteLock does refer to itself as the Global Leader in Website Security (which is far from the truth):

Partner with the
Global Leaders Across
the Industry

We think that web hosts getting involved in this is a good sign that you should avoid them (you can check out our list of web hosts who partnered with SiteLock if you want to to that).

If you are unfortunately at the point where your web host is pushing you to SiteLock, you should take a look at our post on what you should know in that situation before doing anything else.

SiteLock Uses The Fact That They Cut Corners With Their Hack Cleanups To Try To Upsell Customers

Over two years ago we noted that SiteLock wasn’t doing a basic part of a proper hack cleanup, properly securing the website, which usually mainly involves making all of the software of the website is brought up to date. That situation hasn’t changed, as just about three months ago we were brought in to fix a website after SiteLock cleanup had broken it. In that case not only had the software not been updated, but SiteLock had also failed to attempt to determine how the website was hacked. If they had done that they would have spotted part of the cause of the hack was one of their web hosting partners, GoDaddy, allowed remote access databases that were set not to allow it. When you consider that SiteLock often charges $300 for a cleanup, which is more than we charge for many cleanups where we do those things, their customers are really getting ripped off.

It turns out that SiteLock doesn’t recommend using their one time hack cleanup service, not because they are not doing things properly, but so they can charge customers even more money and keep charging for something that should have a one time cost.

In a complaint with BBB (https://www.bbb.org/phoenix/business-reviews/internet-services/sitelock-llc-in-scottsdale-az-1000018625/reviews-and-complaints) one of their customers describe the situation:

After my business website was hacked on or before December 29, 2015, I was advised by my web hosting company to contact its security partner, Sitelock. Sitelock offered me two options: a one-time cleaning for $300, or cleaning plus monitoring for $90/month.

 

I was again told I chose the wrong product (he said they don’t recommend the $300 cleaning to anyone).

So instead of paying $300 for a low quality cleanup they wanted them to pay $1080 a year for monitoring and continuous cleanups. There are multiple issues with that. Some of those revolve around the reason they recommended against the one time cleanup:

I was then told I chose the wrong product (the $300 cleaning) because I had an active hacker who went right back to work on my site.

A proper one-time cleanup should prevent the active hacker from getting “right back to work on my site”. But if you don’t determine how the website was hacked and fix that (as websites don’t just get hacked, something had to have gone wrong for that to occur), as well as making sure the website is otherwise secured, then it isn’t surprising that a hacker could get back in.

Since SiteLock’s continuing service doesn’t do those things either, the best they can do is to keep detecting the hacker has accessed the website and clean things up after the fact. Having a hacker repeatedly get access to your website is not something that should be happening, even if it could be quickly cleaned up each time. What if a hacker gets access to customer data, once that has been taken a SiteLock clean up won’t undo that. There is also the issue that SiteLock doesn’t exactly have the best track record of detecting hacks, so they might not even spot was is going on to clean it up.

If you are spending $1080 a year on security it would be spent doing things that would actual prevent the website from being hacked, SiteLock doesn’t provide a service that does those things (probably because it would require actually doing a lot of work).

Based on all that you might not be surprised to hear that the one time cleanup done on that website had another problem. The website was messed up, which SiteLock excused based on this:

The hack affected many of the core platform and theme files (985 files total – attached).  The site’s appearance after the… clean had been completed was due to the compromised core and theme files.

A proper hack cleanup would have properly fixed the compromised files so you wouldn’t be left a website with appearance issues (that was also one of the issues with the website hosted with GoDaddy earlier and earlier instance with a GoDaddy hosted website).

At this point you might be wondering why this person’s web host had a security partnership SiteLock considering how bad they are. The reason at some web hosts is in part that SiteLock’s owners also run the web hosts (something that web hosts don’t acknowledge publicly) and the other big reason is that the web hosts get a significant amount of money pushing SiteLock services. In the case of one of them, the web hosts disclosed that they get 55% of the revenue from SiteLock services sold through the partnership. Which in the case of that ongoing service, would work out to $594 a year, without requiring them to do any work. The one time cleanup would get them $165. If you do have a hacked website and are getting pushed to SiteLock, beyond obviously avoiding them, you should take a look at a previous post we wrote that goes into more detail as to what you should know in that situation.