Website security
find it before your visitors do.
SiteLock scans for malware and vulnerabilities, removes what it finds, and puts a firewall in front of the site.
Most hacked sites are not targeted. They are found by automated scanners looking for a known vulnerability in an out-of-date plugin, and the owner finds out when Google flags the site or the host suspends it. By that point the damage — to rankings, to reputation, to customer trust — is already done. Scanning exists to shorten the gap between compromise and discovery.
what you get
Daily malware scanning
Scans pages and files for injected code, and tells you what changed rather than only that something did.
Automatic malware removal
On the higher plans, known malware is removed automatically when found, instead of waiting for someone to read an alert.
Vulnerability scanning
Flags out-of-date plugins, themes and platform versions with known exploits — the route in for the overwhelming majority of compromises.
OWASP protection
Guards against the common attack classes — SQL injection, cross-site scripting and the rest of the OWASP list.
Web application firewall
Filters traffic before it reaches the site, blocking known-bad requests and bots probing for weaknesses.
Trust seal
A verified security badge for checkout and contact pages, where hesitation costs you the sale.
plans
Live pricing from our billing system.
Showing monthly pricing.
Defend
Find, fix and prevent threats with website acceleration
£38.64/mo
Emergency
Immediate emergency assistance in the event of a compromise to recover your website.
£154.57/mo
Domain search
need a domain to go with it?
Check availability across every extension we sell. Renewal prices shown next to registration prices.
common questions
My host already has security. Why would I need this?
Host-level security protects the server and its other tenants. It does not inspect your application — an out-of-date plugin with a known exploit is your responsibility, not the server's, and it is the way most sites are actually compromised. The two operate at different layers and neither replaces the other.
Will it slow my site down?
Scanning runs against files and pages rather than in the request path, so visitors are unaffected. The firewall does sit in front of traffic, but it is designed to add only a few milliseconds — far less than the plugins most sites already run.
What actually happens if malware is found?
You are alerted with the specific files affected. On plans with automatic removal, known malware is cleaned without waiting for you to act. On scan-only plans you get the detail needed to clean it yourself or hand to whoever maintains the site.
Does this work on WordPress?
Yes, and WordPress is where it earns its keep. The plugin ecosystem is enormous, plugins are abandoned by their authors regularly, and a vulnerability disclosed publicly is being scanned for within hours. Vulnerability scanning gives you the window to update before that reaches you.
Can it fix a site that is already hacked?
It can remove known malware, which is often enough. What it cannot do is close the hole that let it in — if an out-of-date plugin was the route, the site will simply be reinfected. Cleaning and patching have to happen together, which is why the vulnerability scanning matters as much as the removal.
not sure it is what you need?
Ask us. We would rather talk you out of something that will not help than sell it to you.