We’ve been with FatCow hosting for quite a while. Up to this year, they’ve been an inexpensive, reliable company. Two incidents in the last six months changed all that. They’ve lost our support. Here’s why.
WordPress Sites Shut Down Because of a False Positive on a Default WordPress File
Every WordPress installation includes many default files, we’re talking thousands of little bits and pieces that make WordPress what it is, a reliable platform for bloggers.
Back in May, FatCow’s scanners decided that the standard WordPress file, moxieplayer.swf, was malware. Here’s the email we received:
Hello,
A routine scan of your account has found the following malicious or infected files:
wp-includes/js/tinymce/plugins/media/moxieplayer.swf
As a result, we have suspended your website, to avoid problems for website visitors or other customers. Please remove the malicious code, through FTP or the File Manager. I would recommend deleting and republishing your entire website from a clean copy; this should then erase any other code which may have
been injected into your pages to allow back-door access by unauthorized people.
You should immediately change your password through the control panel for the account, and most importantly, you need to make sure any application in your account are completely up-to-date as far as versions, security patches, etc. are concerned. This applies not just to the core application, but also plugins,
themes, modules, etc. If this is not done, your account will remain vulnerable to future attacks of this kind.
In order to secure your web application,you can use SiteLock Fix product which scans your website daily and removes any infected files. To learn more about SiteLock, please go to: (url removed) /product/sitelock
Sounds serious, right? FatCow did more than warn us, they suspended our websites. That means that FatCow removed access to them, no one could view any of our eleven websites.
In this situation, we had to go through every installation, find the suspicious file and delete it. We’re quite surprised that our WordPress installations still worked after they were put back online.
Once the sites we up again, we began to do some detective work. That file, moxieplayer.swf, is a standard WordPress file. It comes with every WordPress installation. When we notified FatCow of that, here’s what they said:
Comment:
It is possible that a few lines of malicious code was found within the file as opposed to our scanner considering that the file as a whole was malicious. I’m going to try to have this looked into a little further, but with the files already gone we might be limited in what we can research. I’ll get back to you if I find out more information.
Guess what? FatCow never bothered to get back to us. You will note that in the first message, FatCow was pushing Sitelock, an extra-cost feature that they recommended. Fatcow flagged a perfectly safe WordPress file then tried to sell a premium product using scare tactics.
FatCow never admitted their mistake. Every other company that we’ve dealt with over the last twenty years has taken the blame for their own errors. Not FatCow. Despite having our sites shut down for absolutely no reason whatsoever, FatCow never offered compensation either. In their ads and on their site, FatCow pretends to be wholesome, efficient and friendly. Trust us, they’re not.
Stay tuned for Part Two of our rating on FatCow Web Hosting. Once we find a reputable hosting company, we’ll come back a post a link to their site.
Comments and questions are welcome but Likes on our Facebook page get immediate attention. Here’s the link: Computers Made Simple on Facebook . Thanks for reading!
I have also had the same problem. When I got the same kind of error, they also sent me a whole list of WP files that were ‘infected’. I removed my entire WP installation and placed a simple HTML file telling my visitors that I will be back up and running in few days. However, within those few days, I again got an email from SiteLock directly saying they are placing it on a ‘Suspension Watch List’ because they have detected some ‘maleware’ in my files. The funny thing was 8 hours ago, I was with their tech support to fix cPanel issue and I asked the tech support to wipe my system clean so that I can reinstall WP. Btw, their cPanel is the most archaic system I have seen so far. It is not easier in anyway to work with that system.
I am also thinking of moving away from FatCow.
Things seemed to have calmed down over at FatCow. Maybe they changed their security company or their settings, we’re not sure. Things have been sailing along smoothly since we wrote that piece. By the way, the best way to lock down your WP site is to use WordFence (free) and Google Authenticator. Unless someone comes in from the host end, your site is secure. We agree their CPanel sucks. Good luck with your site(s) and thanks for commenting.
All the webhosting company’s are pushing Sitelock now. I found out that Sitelock are owned by EIG which owns Hostgator, Bluehost and who knows what else.
It appears from all the complaints I am seeing on the web that it isn’t limited to just one hosting company and it seems that there is a lot of suspicious activity going on with lots of people being notified or websites taken offline for malware or suspicious code and then being contacted by Sitelock for upgrades and fees to “clean” the websites or code or various other “services” that of course cost quite a lot of money. I just started noticing all this and have been scouring the web for more info. Seems like there are a lot of individuals complaining about Sitelock out there, but I have found no definitive authorities speaking out against Sitelock and the web hosting company’s underhanded and scammy practices of blackmailig people by holding or infecting their sites with malware and demanding high fees and monthly subscriptions to “fix” the problem.
I am really starting to look into what web hosts are pushing and Sitelock in general. Am even starting to look at Sitelock as malware. Seems like everyone believes the web host when they say “Of course you want to have Sitelock on your website don’t you? You want their little logo that ensures trust with your customers, right?” It’s no different than the Better Business Bureau. Everyone thinks that’s just some benevolent organization doing good on the part of the consumer of their own freewill. Ha! The only way you as a business can get registered with the BBB is to pay them a fee. Then, how good do you suppose their reviews and ratings of companies can be? You are essentially bribing the BBB to give you good ratings for the consumer. You pay what they want and they tell everyone that you are a good company. If you do not then you cannot be a member of the BBB and they have brainwashed the public into thinking that means something. ” Oh, they must not be a very good company, they aren’t a member of the BBB”
No …. they just don’t want to pay the BBB a fee to have the BBB logo on their website.
I have not ever had this problem before but you can bet I am starting to scrutinize this whole hosting/Sitelock partnership that everyone seems to be in these days. It’s kinda scary that a host could force you to buy Sitelock by saying you have malware and then Sitelock forces you to pay extreme fees beyond your yearly subcription, just to “clean” up your website.
Very frustrating and disturbing.
We got some response from FatCow on this, here are there emails:
Email 1: “I can see why it would appear this way to you and our other customers. It is important to remember that SiteLock is not in any way required by us in order to remove the malware or suspension. The suspension is only intended to stop the spread of infection. If there is a vulnerability in your website on Fatcow’s servers, that vulnerability would be present on any server that the site is uploaded to. The difference between other providers and us is that we have a reliable and reputable solution like SiteLock. You can remove the malware at any time by removing the code from each file or by removing the files entirely.
If you do feel that there is ever a false positive in our scans, we would like that feedback so that we can go to our engineers with suggestions of how we could improve our algorithms. If you do purchase SiteLock for a false positive, we are happy to provide you with a refund if we can confirm. ”
Email 2: “The false positive is related to our algorithms, which are constantly updated. Your feedback regarding SiteLock has been passed along, however please remember that SiteLock is a reputable suggestion and not a requirement. Please let me know if there is anything that I can do at this point in time. ” (This was after we let them now that we DID get a false positive. At that point they started the spiel about SiteLock.)
Believe it or not, we joined a forum for this and other issues and someone there suggested GoDaddy as a reasonable and somewhat more responsible alternative to our host and yours. We may give them a try. Then again, moving sites like ours is a lot of work. Thanks for commenting.
Thank you for this. I have multiple sites hosted with several different hosting companies and its been only Fatcow (on every site–all wordpress–hosted with them) that I have had this issue with. They shut down all three sites and in their ticket suggest I purchase site lock. I have slowly begun to move each site away from Fatcow. I knew it was a scam but its pretty sad they keep doing it over and over.
Yes, it is sad. Another person who commented mentioned that SiteLock owns some of these hosting companies, maybe they own FatCow too. Someone else, not connected to their suggestion in any way, had good experience with GoDaddy. We have never used GoDaddy but it seems they might be above FatCow’s way of doing business. Good luck and thanks for commenting.