How to Choose a Website Security Provider

As more people are creating websites and becoming aware of website security, companies are popping up everywhere to help with the problem. And just like website security plugins, not all website security services are created equal.

Here at Sucuri, we believe that you should do your website security comparison research so you know the options available and what you are getting out of it.

How to Choose a Website Security Provider

We would like to arm you with questions to ask your potential security providers. Some may be simple preferences, others are bigger concerns, like hidden fees. Of course, working for Sucuri, we are a bit biased, but these questions apply across the range of security products and companies available.

Let’s start with the topic that most people come to us about.

Fixing Website Hacks – Questions to Ask

Your site is infected and time is of the essence. What do you need to ask a security provider before handing over your credit card and FTP details?

Are the cleanups automatic or manually done? Is there an additional cost for a complicated cleanup?

Many website security companies use bots for part of their cleanup (or all of their cleanup). In our case, the bot does a quick pass, will clean obvious malware, flag others, then hand it off to a live analyst to finish the cleanup.

This is important because a lot of the malware cannot be fixed by the bot alone. There are website infections that need to be cleaned up by a security analyst. What happens if you choose a company that offers only an automated cleanup? You could get locked in for a year and end up paying extra for a manual cleanup. Have you considered that hidden cost?

What kind of ongoing protection do you get?

Sites that are hacked are often reinfected rather quickly.

If you are paying for a one-time cleanup what happens when hours after the infection is cleaned you are reinfected?
Is this a new charge?
How long is the remediation good for?
Is there protection, like a firewall, included in the cleanup?

The Sucuri Platform plans include unlimited cleanup requests for the year of the plan, continuous monitoring, and a firewall to prevent reinfection.

Is the charge per site, per page, or per server?

This can lead you into a rabbit hole because then we get into what a site is and what is considered a page or a server.

It is important to know it because if you clean up domain[.]com and not myawesomedomain[.]com and they are on the same server. Chances are the second domain will reinfect your first site. This is called cross-site contamination. We have done a short webinar to explain how these infections spread in a server.

Here at Sucuri, we charge per site. We don’t charge for additional bandwidth, pages, or complicated cleanup requests. If you have questions on how we define a site, check our FAQ or reach out to a chat rep.

Protecting Website – Questions to Ask

Now that you are armed with some questions about cleanup, let’s look at the website firewall or protection aspect of the site.

How hard is the setup and will you do it for me?

Seems like a silly question, but some companies do charge to assist with setup. We all have specialties. For example, I know very little about building a website but can speak for hours about securing the site. So having someone who is used to doing the set up can be advantageous.

Here at Sucuri, the firewall setup is a DNS A record change or nameserver change. You can do it yourself by following our activation guide, or we can do it for you at no charge.

Where does the firewall sit?

It doesn’t sit – it stands.

Just kidding. There are hundreds of firewalls out there and each work differently. Some are local firewalls, some are other application firewalls, and still, more are web application firewalls.

If the firewall sits on your server, such as a plugin, it will take up server resources to run, making it more vulnerable to layer 7 attacks and possibly slow down your site. However, it also means that it is available from your website dashboard so it is easier for you to manage.

Here at Sucuri, we use a cloud-based web application firewall (WAF) meaning that it sits on our firewall servers and filters traffic between the visitor’s browser and your website.

This allows us to shoulder the burden of the firewall without impacting the efficiency of your site. In fact, it helps take the load off the server for static cached items. This makes your website more than 70% faster on average.

Is the firewall proprietary or outsourced?

This is a funny question, isn’t it? You are going to a security company and would think it’s their own technology; however, this is not always true.

Why is it important? Well, it can affect service levels if I have to reach out to a third-party vendor. When something breaks it will be harder to fix.

Here at Sucuri, our firewall is designed by us and is in-house proprietary software.

Having a proprietary website security solution allows us to respond quickly. Also, because we do remediation in-house, we can adapt the firewall to newer trends faster than most companies.

There are some other questions you might want to ask, like:

Is the firewall a Content Delivery Network (CDN)? – Yes, the Sucuri firewall is.
Can you create custom rules on the firewall? – Yes, on certain Sucuri plans. Speak with a chat agent for more information.
What kind of rules are set up by default? A lot of them. Speak to a chat agent if you want more information.

Believe it or not some firewalls have no rules set up and rely on you to set it up yourself.

Conclusion

I hope these questions better helped you select a website security provider. Here are some guides with more information in choosing a security company:

I am sure there are more questions out there, so don’t be afraid to reach out to us in chat or email – we are here to help.