In looking over things for a possible future post about the web security company SiteLock we have noticed that one of the features prominently promoted by its hosting “partners” when selling SiteLock’s services is vulnerability scanning. For example, at HostGator, one of their hosting “partners” that is also run by the owners of SiteLock, vulnerabilities scans of varying frequency are included in each package:
It also promoted on their page for the services as helping to prevent hacks:
What is missing on the “partners'” websites or SiteLock’s as far as we can tell is any evidence on the claimed effectiveness of their vulnerability scanning. Vulnerability scanning of the type that it appears SiteLock does, doesn’t have a reputation for being of much value. In a study (PDF) from 2014 that looked at vulnerability scanners tied to security seals (SiteLock has one of those and its accuracy has been poor from what we have seen), it was found that two of the 8 vulnerability scanners tested detected none of the vulnerabilities that existed on a website set up with a number of vulnerabilities, which was due to those scanners using third party software that “are not meant to discover vulnerabilities in web applications”. Five of the six remaining scanners only discovered a third or less of the vulnerabilities that existed.
If their vulnerability scanner was in fact detecting vulnerabilities we would expect to have seen evidence of it elsewhere. SiteLock claims that as of 2015 they were “serving over 1 million WordPress customers”. If there vulnerability scanning was actual effective we would expect that would have found quite a few vulnerabilities in plugins based on the number of vulnerabilities we see being discovered in WordPress plugins while collecting data for our Plugin Vulnerabilities service. But we are only aware of two vulnerabilities that they have discovered in recent times and both of those don’t appear to have been discovered during the running of their vulnerabilities scanner. By comparison over at the blog for our Plugin Vulnerabilities service we have over 90 posts for vulnerabilities we have discovered this year (some of the post include multiple vulnerabilities, so the total number of vulnerabilities is even higher). If their vulnerabilities scanner was discovering other vulnerabilities in plugins on website, even if SiteLock were not aware of it, we would expect to see some mentions of that in changelogs of the impacted plugins or discussions of the vulnerabilities and yet what we haven’t seen any reference to their scanning having identified any vulnerabilities and the vast majority of vulnerability disclosures and fixes we have reviewed can be traced back to a source that wasn’t their scanner.
Whether you are looking at SiteLock or another provider of security services and products you should look for evidence from the provider that products can perform as claimed, as we often see claims made that seem rather unbelievable and from some of the claims we have taken a look into they often turn out to be at least widely inaccurate.
A Better Alternative to SiteLock For Cleaning Up a Hacked Website
If your web host is pushing you to hire SiteLock to clean up a hacked website, we provide a better alternative, where we actually properly clean up the website.