In dealing with people with hacked websites we are often reminded that things that seem like they should be easy to understand about security products and services are often not for a lot of people. What plays at least some role in that, and maybe a lot, is that the security industry frequently makes misleading and outright false claims.
We recently had someone that contacted us about a hacked websites who seemed to be unaware that monitoring for malware or other types of website hacks would not prevent the website from being hacked or clean it up if it did get hacked. In their case they said they were relying on monitoring from SiteLock and Wordfence.
What monitoring tries to do is detect evidence of malware or another hack after it has occurred. Since it comes in to play after the hacking it wouldn’t be possible to stop it from occurring. Despite that we have seen providers of monitoring services promote them as being able to stop or protect a website from being hacked. Either these providers don’t understand what they are providing or are lying about it, neither of which is a good option.
If there were monitoring solutions that were effective at doing what they are actually trying to do they might be a good option as additional measure beyond doing the basics for high profile websites that are at elevated risk of being targeted by hackers. We have yet to see any such service that presents evidence, much less evidence from independent testing, that they are effective though, which seems like it should be a baseline for using such a service at all. What we have seen of monitoring solutions and other tools to detect malicious code in years of dealing with the cleanup hacked websites is that they have a limited, at best, ability to spot malicious code on a website.
For the average website what should be the focus is doing the things that will actually make websites secure instead of hoping that a security service is going provide even a fraction of what the extraordinary claims they often are promoted with would lead people to believe they are capable of.