It started with weird characters on a website I manage.
Hmmm. Is this malware?
Yes. Sucuri confirmed it.
I’ve been a customer since 2013 and use Sucuri to scan and protect websites I host and manage. So why wasn’t I notified?
That’s when I learned NONE of my Server-Side Scanners (SSS) were working.
My dashboard, however, was a sea of little green circles. Mouse over them:
🟢 CLEAN
Even the site with malware.
Then I discovered you can click the circles. Who knew? Behind them were tabs containing considerably more interesting information:
🔴 SSS: SCAN NOT WORKING.
Soon more malware was found on multiple sites, including recurring infections and backdoors. My hosting support and developer did much of the investigation while I became:
THE HUMAN API
shuttling findings between them and Sucuri.
And getting help introduced me to another feature:
THE TICKET RELAY
Level 1: Explain everything. Wait — potentially up to two days.
Complex problem? Level 2.
New technician. More waiting. Explain the context again.
Level 3? Different team. More waiting. More context.
Never assume the next technician has read the entire ticket.
Malware doesn’t pause while your ticket changes departments.
Sucuri temporarily got most scanners working. Progress!
Except it didn’t last. They disconnected again. Eventually SSS stopped working altogether.
So I requested daily manual reviews until SSS was reliable. Apparently my replacement for the automated security service I was paying for was:
ME.
Open ticket. Request scan. Next website. Repeat tomorrow.
Then came notifications.
Sucuri repeatedly told me, “Your notifications were turned off,” and that they’d turned them back on.
Really? Like I did that?
Why would I turn off alerts for the two things I’m paying a security company to tell me:
MALWARE DETECTED
and
SCANNER STOPPED WORKING?
Eventually I established what happens: when SSS disconnects, its notification options disappear.
Brilliant workflow:
Scanner disconnects.
Failure-notification options disappear.
Customer isn’t notified.
Dashboard can still say CLEAN.
Click underneath: SCAN NOT WORKING.
You can’t make this stuff up.
After nearly three weeks, I told management I was considering consulting an attorney.
Less than 12 hours later, I was escalated to Sucuri’s Office of the Chief Executive, which acknowledged in writing the “serious service failures” I’d experienced.
Finally! I even got Executive Case 01840522.
Naturally, I wanted to see it. Where is it?
Turns out it’s an internal reference. No portal. No ticket. Nothing I can access. They’ll email me.
Then Sucuri told me to continue using the dashboard to monitor my security services.
THE DASHBOARD?
The one with the green CLEAN circles that started this adventure?
Then they changed the SSS ticket status to:
WAITING FOR USER
Waiting for ME? You just told me to wait for the executive team to email ME.
At this point Sucuri feels less like website security and more like an escape room with malware.
Then support offered an interim solution: Sucuri’s WordPress plugin. It can send an alert if its scan fails.
IT WILL TELL ME WHEN THE SCANNER STOPS WORKING?
We found the developer!
Tiny problem: Sucuri also says the plugin “does not have access to the entire WordPress file system.”
So the replacement for my Server-Side Scanner isn’t a replacement for my Server-Side Scanner.
They’ll install it if I provide FTP or cPanel credentials.
At this point in our relationship?
I wouldn’t give Sucuri the password to my Netflix account.
I’ve spent weeks monitoring the monitoring system, reopening tickets and trying to get the security service I paid for to work.
I wasn’t trying to become the Erin Brockovich of Sucuri. I was trying to get my websites scanned and protected from hacking.
If Sucuri fixes this mess, I’ll update this review and give them full credit. I genuinely hope I get to.
You can’t make this stuff up.
Unfortunately, I don’t have to.
