SiteLock Explained

How SiteLock protects your website

SiteLock protects websites in layers - scanning files and databases for malware, patching known CMS vulnerabilities and filtering malicious traffic before it reaches your site. Managing those layers is usually the hard part. Site Health is SiteLock's answer to that: one status that tells you how your website is doing, and a ranked list that tells you what to do next.

Site Health: your security status at a glance

• The Site Health dashboard distills your website's overall security posture into a single health score, shown as a visual health meter. You can tell whether your site is at risk without interpreting individual scan results or reading security logs — the underlying detail is still there when you want it, but it isn't where you have to start.
• Alongside the score sits the Prioritized Tasks queue: a next-best-action list, ranked automatically by priority, with visual indicators flagging what's urgent and a one-click path to the fix. Instead of a list of findings to triage, you get an ordered set of steps — and a health score that moves as you work through them.
• When something needs attention sooner, SiteLock sends real-time alerts by email as vulnerabilities are detected, with the actions to take included.
• Site Health is fed by the protection layers running underneath it. Core services include:

Malware scanning & removal

SiteLock uses a layered approach to detect, block, and remediate malware:

• Detection: SiteLock's daily website scans search for malware that most affect websites, including backdoors, web shells, SEO spam injections, defacements and card-skimming scripts. It connects to your server via  FTP, FTPS or SFTP over SSH to scan for malware and detect vulnerabilities. 
• Prevention: Using threat intelligence and firewall protection, SiteLock helps block known malicious traffic and reduce exposure to attacks that can lead to malware infections.
• Remediation: If a new threat is detected, SiteLock’s automatic malware removal capabilities help address threats quickly. Because cleanup can happen automatically, website owners don’t need to submit a ticket or wait on manual remediation. Some complex issues may still require additional intervention from SiteLock support depending on severity.

This same detect-and-remove process covers your website’s database as well as its files, on every plan, cleaning malware and spam injected into database tables without manual database work.

SiteLock also offers immediate malware remediation services through SiteLock 911, designed to fix damage already caused by intrusions by identifying and cleaning up infected files and removing malicious code.

Vulnerability detection & patching

While it's important to find and remove malware, SiteLock takes web security a step further to address vulnerabilities at the source. Using advanced remediation technology called SMART Patch, SiteLock scans websites for vulnerabilities and can automatically apply targeted patches for known issues—especially in CMS platforms including WordPress and Joomla. Patches are applied to the vulnerable files themselves and can be reverted if needed, so a site stays protected in the window before an official update can be installed. Vulnerability detection runs on every plan; automatic patching is included from the Pro plan up. 

Web application firewall (WAF) and CDN 

SiteLock's WAF and Content Delivery Network (CDN) work as a paired layer. Traffic routes through the WAF for threat filtering and through the CDN for delivery — so your site is protected and fast at the same time. Both are included on the Pro and Business plans.

SiteLock's web application firewall (WAF) adds an additional layer of security by analyzing incoming traffic and blocking malicious requests. This helps identify and stop cybercriminals as they attempt to exploit vulnerabilities and also prevents attackers from accessing backdoor files. It also blocks denial-of-service traffic before it reaches your site. The CDN serves your pages from the data center closest to each visitor, so the site loads faster and handles traffic spikes without strain.

SiteLock also uses bot behavioral analysis to distinguish between automated malicious traffic and legitimate web users. WAF security insights can be accessed from SiteLock's centralized dashboard. The CDN side sits in the same dashboard, with caching statistics and delivery controls alongside the security insights so what is being blocked and what is being served to your visitors are managed in one place.

Both are activated with a single DNS change, in about five minutes, with no software to install.

SiteLock vs other website security measures

SiteLock complements, rather than replaces, other security tools like SSL certificates, secure hosting, and regular updates.

The service supports comprehensive security through malware scanning and vulnerability patching but should not be confused with encryption and authentication services.

SSL/TLS certificates expand protection by encrypting data and verifying authenticity. SiteLock focuses on catching and neutralizing existing website threats, while SSL/TLS certificates aim to protect information in transit. 

Secure hosting protects the server your site runs on. SiteLock protects the site itself - the files, database, CMS and plugins that hosting providers generally leave to the site owner. Standalone WordPress security plugins cover some of the same ground, but run scanning and remediation on your own server rather than in the cloud, which can affect site performance.