Last updated:
Website Security scans your website for malware and other threats, and on the bigger plans cleans up what it finds and blocks attacks before they reach your site. This article covers how to open your security dashboard, what each plan does, and what to do if a scan finds something.
Opening your security dashboard
- Sign in to the client area and go to My Services.
- Click your Website Security service. (If you added it to a hosting plan, open the hosting plan and find it under Addons.)
- Use the log-in button on its page. The security dashboard opens already signed in.
The first scan starts by itself shortly after the service is set up. Results usually appear in the dashboard within a day.
What your plan does
| Plan | What it does |
|---|---|
| Find | Scans your website from the outside every day: up to 25 pages for malware, a one-off check for common website weaknesses (such as SQL injection and cross-site scripting), and daily checks that your site isn't on a blacklist. It tells you about problems but doesn't fix them. |
| Fix | Everything in Find, plus daily scans of your website's files (up to 500 pages), daily weakness scans, spam blacklist monitoring and automatic malware removal. |
| Defend | Everything in Fix, plus a web application firewall that blocks attacks and bad bots, and a content delivery network that can make your site load faster. |
| Emergency Response | A one-off clean-up for a website that's already been hacked. See below. |
File access for clean-up (Fix, Defend and Emergency Response)
To scan your files and remove malware, the service needs FTP access to your website.
- Added to a hosting plan with us: we set this up for you. A dedicated FTP account is created for the scanner, so you don't need to share your own login.
- Bought on its own: enter your website's FTP details (server, username, password and the folder your website is in) in the security dashboard's settings. Your hosting provider can give you these. If your website is hosted with us, see FTP accounts to create a separate FTP account for it, or add the service to your hosting plan instead and we'll do it for you.
Until the FTP details are in place, Fix and Defend can only scan from the outside, like Find.
Reading your results
The dashboard shows a risk score, which is an estimate of how likely your site is to be attacked, based on things like how complex it is and how popular it is. A higher risk doesn't mean you've been hacked; it means the site is more of a target, so the stronger plans are worth more.
Scan results show each check as passed or failed. If something fails, the dashboard explains what was found and where.
If a scan finds malware
- On Fix or Defend with file access set up, most malware is removed automatically and the dashboard shows what was cleaned.
- On Find, nothing is removed for you. Follow What to do if your website has been hacked, or upgrade to Fix so it's cleaned automatically.
- Whatever your plan, change your website's passwords and update its software, themes and plugins afterwards, so the same weakness can't be used again.
Adding the Trust Seal
Every plan includes a Trust Seal: a small badge you can show on your website, confirming it's been scanned. The security dashboard gives you a short piece of code for it. Paste that into your website's footer (in WordPress, a footer widget or your theme's footer settings is the usual place). The seal reflects your site's latest scan, so keep it clean for the seal to mean something.
Switching on the firewall (Defend)
The firewall and content delivery network work by sending your website's visitors through them first. That needs a DNS change, which isn't done automatically:
- In the security dashboard, follow the steps to set up the firewall. You'll be asked to confirm you own the domain, then shown the DNS records to change.
- Make those changes where your domain's DNS is managed. If your domain uses our nameservers, see Managing your DNS records.
- DNS changes can take a few hours to reach everyone. Your website keeps working throughout.
Not sure where your DNS is managed, or which records to change? Contact our support team and we'll help.
Emergency Response
Emergency Response is for a website that's been hacked now. Work starts within 30 minutes: your site is cleaned automatically, then by hand if needed, and watched for seven days afterwards. If your site is hosted with us, we set up the file access for you when you add it to your hosting plan. While you wait, read What to do if your website has been hacked, especially the first step: change your passwords.