SiteLock packages can provide different combinations of scanning, cleanup and firewall protection. Check your purchased plan before configuring it. A scanning-only service should not be described as including automatic malware removal or a web application firewall.
IN THIS ARTICLE
01 Start with the correct website
Open the SiteLock service supplied with your Nabtech order. Confirm the domain and whether the website is already infected or simply needs ongoing protection. If there is a current compromise, preserve logs and a recovery copy while you begin the response process.
- Review the service's enabled features and setup checklist. Complete any domain-ownership verification using the exact value shown for your account.
- Configure scanning for the intended website. Where deeper file scanning or cleanup needs a connection to the hosting account, use the supported credentials and scope rather than an unrelated administrator login.
- Run or await the initial scan and review its result. Note the scan time, covered pages or files and any areas the service could not inspect.
- If your plan includes a firewall or CDN, follow the service's DNS onboarding instructions. Record the previous records, preserve mail DNS and verify the origin configuration before directing live traffic through it.
- Test the public site after activation, including login, forms, uploads and checkout. Security rules can affect legitimate application requests and should be tuned using evidence.
- Configure notifications for an address your team actively monitors. Assign responsibility for reviewing findings and following up on failed scans.
02 Understand what the result means
A clean scan describes what the service checked at that time. It does not prove every dependency is safe or guarantee that a later attack will fail. Keep the CMS, plugins, themes and credentials maintained, and retain independent backups.
What should I do if SiteLock blocks a legitimate action?
Record the URL, time, user action and any request or incident identifier. Review the matching event with support. Prefer a narrow rule adjustment for a verified false positive over disabling protection for the entire domain.
If the dashboard reports incomplete setup, resolve the missing connection or verification step before relying on the service. Adding a trust-seal graphic to a page does not itself activate scanning, cleanup or firewall protection.