1. Does this solution support only specific CMS Platform?
No, it supports many varieties of CMS including but not limited to WordPress, Joomla, Drupal, Magento, as well as any MySQL, Maria DB-driven CMS. It also works on websites without any CMS.
2. How secure it is for user to share their FTP/SFTP Password for Web Clean, Patch & Backup?
Website Inside-out Scan, Malware Removal, CMS Patching, Database Cleaning, and Website & DB Backup/Restore will require the Application to have SFTP/FTP access. Every user have a dedicated dashboard upon login with their secured credentials, they can configure the application with their SFTP/FTP credentials for all functionalities to work properly.
3. Does this solution guarantee to remove all types of Malware or Vulnerabilities on a User website?
There isn’t any malware remediation solution in the market that guarantees 100% malware removal. The SiteLock Malware Signature database have more than 10+ million entries, which allows nearly 98% success rate of Malware Remediation. However, new malwares keep popping up into the web world, for any new signature, SiteLock will keeps identify the remediation and test them rigorously. The backup feature in the SiteLock is an ideal complimentary solution in these packages, which allow the user a business continuity and integrity solution, in case an unknown malware or vulnerability brings the website down and thereby ensuring continuous uptime for their website and business.
4. Can the Malware Scanning, Remediation or Patching impacts my website performance and cause downtime?
No, the Scanning, Remediation and Patching is all done via Cloud Agent offline away from the origin server. File Inspection, Analysis, Remediation etc. is all done in SiteLock’s Infrastructure thereby not impact Website Performance. Scans are generally done within 10-15 minutes everyday whereas complex remediation/patching is observed to be done in 2-4 hours.
5. I am concerned about my website data. Does this solution comply with GDPR?
We vouch for our User’s Data and do not tamper, steal or illegitimately share the data, code with anyone, which can be detrimental to user’s business or reputation. While the focus is to secure a users Website, SiteLock do have exposure to every file to the website, database and web-environment, however, they all are utilised under the objective of Web Security. The process and procedure are same as any other Web Security Solution in the market. The processes and guidelines are in complete compliance with GDPR.
6. If the process is entirely automated, what does a user needs to do or notified?
User intervention are not required for 95%-98% of Malware Remediation and Patching instances whereas for special cases we may have to reach out to user to need their involvement. The platform will email users every time a Malware has been remediated with the details on what was the issue and what changes SiteLock has done.
7. What is threat assessment? How does it work?
Threat Assessment is a statistical model to effectively assess the probability of a website’s compromise due to different types of threats and vulnerabilities. It leverages over 500 different variables from the websites attributes to identify the key factors that acts as a catalyst (negative) in increasing the chances of a website security breach.
Some of the attributes used in the algorithm to compute threat assessment are:
• Website Size, Email Address, iframes and # of SW packages included on the site.
• Type of CMS used and composition of the website.
• Average # of visitors/day, Social Media Popularity, Likes, Trends etc.
It has 3 indexes or levels:
1. High: Threat Assessment Algorithm determined that website is at a high risk for infection.
2. Medium: Threat Assessment Algorithm determined that website is at a medium risk for infection.
3. Low: Threat Assessment Algorithm determined the site is currently a low risk for infection.
8. What is Blacklist Monitoring?
Websites which are identified to have Malware or known vulnerabilities are blacklisted by search engine such as Google as well as AV Database such as Norton, McAfee, Yandex and many others. A blacklisted website has no SEO ranking and does not show up in search engine queries. The blacklist monitoring solution within Web Monitor cross-checks daily with different 3rd party database if the website under scan is blacklisted or has potential to be blacklisted due to Malware infection or vulnerabilities. A blacklisted site can be remediated using SiteLock Remediation. Blacklist monitoring ensures reputation management for business website.
9. What are the FTP IPs to whitelist to enable Web Backup, Clean and Patch?
For Website Backup FTP IPs please refer to: https://codeguard.zendesk.com/hc/en-us/articles/115000610423-Whitelist-FTP-IPs
For Web Clean and Patching FTP IPs whitelist:
• 184.154.13.94
• 216.104.43.42
• 184.154.36.160/27
• 184.154.139.0/26
• 184.154.76.0/26
• 173.236.60.74
10. Can I enable/disable any of these features?
Yes, an end user can decide to disable CDN, WAF, Backup or Malware Scanning on their User Portal.
11. I have made changes to my website. How does new content will reflect on all the CDN?
Instant Purge feature on the User Portal can purge all Cache Contents, thereby loading all new contents from the Website.
12. What happens if the origin server is down? Can an end-user fetch data from CDN?
Yes, CDN is configured at times to allow fetching of contents when the origin is down.
13. Can WAF cause degradation in my site’s performance?
WAF does perform inspection but website visitor or end-user will never notice a change in performance.
14. How is data encryption maintained between End User, CDN and Origin Server?
There is SSL layer encryption between end-user and our network, as well as from CDN to Origin. While we allow provisioning your Domain SSL on the origin server.
15. Can I upload my domain SSL via CDN portal?
Yes, you can.
16. I want to bypass (or block) a specific IP or URL from WAF inspection.
User may set WAF Custom Rules and allow provisioning of bypassing or blocking certain IPs.
17. What happens if a User has consumed their quota?
User will be notified when their Quota Limit hitting 75% and send another reminder when hitting 90%. We will also notify the over-usage charges and bill accordingly if they go beyond 100% but do not disconnect the services.
18. How do I know if I need to be PCI Compliant?
If the Web Operations perform Payment Card handling, storage, processing, payment etc. you are required to be PCI Compliant. There are various levels of Compliance based on transaction volume.
19. Is WAF required for PCI Compliance?
Integrating with WAF is also a PCI DSS Requirement.
20. Can I reuse the company name to apply multiple Complete Package?
No. This is due to the restriction by SiteLock , where the company name must be unique and can’t be reused.
21. How often is the backup?
The backup runs on a daily basis, and users also have the option to request for a backup via SWP when needed.
22. Where is the server that stores the backup file?
SiteLock has many PoPs all over the world. In order to achieve High Availability, the backup file may be stored in multiple servers across different undisclosed locations.
23. How long does it take for the CDN to pull updates from the original source and cache them at the edge server?
CDN TTL is 1 hour, but users can manually purge the cache via SWP if necessary.