If you contacted Bluehost support or read their knowledge base about SiteLock, you were told about a dedicated SiteLock dashboard with its own login, its own Terms of Service agreement, and tabs for Overview, Sites, Users, and Messages. That product has been discontinued for new accounts.
We cover what replaced it, what is free, what the paid tier costs, and what to do if you still have an active SiteLock plan.
Everything below assumes you already have hosting with Bluehost and are looking at your security options. If you have not signed up yet, take a look at our full Bluehost review for hands-on performance and support testing, plus our Bluehost coupons page for current signup discounts.
Why the Names Don’t Match: SiteLock Has Been Discontinued
Confirmed directly with Bluehost support: SiteLock is no longer sold to new accounts. Bluehost has replaced it with built-in, hosting-wide malware protection instead, which is what shows up as Malware Scan and Clean and Bluehost Complete Security in the current interface.
If you already had a SiteLock plan before this change, it stays active until its current expiration date, but it will not auto-renew. Once it lapses, you will need to move to the built-in protection or another option, since there is no path to renewing SiteLock itself.
This explains the gap cleanly. Support and the knowledge base still describe SiteLock because it has not been fully retired for existing customers yet, but anyone setting up malware protection today lands in the newer, differently branded system covered below.
Where to Find It
- Log in to your Bluehost Account Manager
- Click Security in the left sidebar
- You will land on the Malware Protection tab, showing your current plan (labeled Malware Scan and Clean by default) and the date of your last scan
- Click Manage to open your current protection, or Upgrade to see paid options
What’s Included for Free
Clicking Manage on the default Malware Scan and Clean plan opens a panel with two sections:
Malware Scanner confirms whether your files have been scanned and flags anything suspicious. On a clean site, it simply reports no malware detected and that ongoing scanning is active.
ThreatShield is a firewall layer, showing a count of firewall events over time, split between Blocked and Detected, with a graph and a breakdown by attack type (for example, Hardening-related attempts). This runs automatically without needing to be configured.
Both are included at no extra cost on every plan, and neither requires any setup beyond having hosting active.
What the Paid Upgrade Adds
Clicking Upgrade opens Bluehost Complete Security, priced at $19.99 per month, billed for the full term upfront rather than monthly.
On a 12-month term, that is $239.88 charged at signup, not $19.99 charged each month. Confirm the billing term and total before purchasing, since the monthly figure displayed is not what actually gets charged to your card.
The paid tier adds:
- Real-time Threat Detection, continuous scanning beyond the free tier’s periodic checks
- Proactive Threat Blocking, aimed at stopping known malicious sources before they reach your site
- Automatic Malware Removal, cleaning up detected threats without manual intervention
- Google Blacklist Monitoring, alerting you if search engines flag or blacklist your site
- Comprehensive Site Coverage, extending scanning across every file and database rather than a narrower scope
- Trusted Security Seal, a displayable badge for your site
- On-Demand WordPress Cleanup, human-led support for complex infections rather than automated tools alone
- 24/7 Dedicated Support, direct access to security specialists
Tip: If your site has never been compromised and you are running standard WordPress with reputable plugins, the free Malware Scanner and ThreatShield combination covers the basics. The paid tier earns its cost mainly if you handle sensitive customer data, run ecommerce, or want a guaranteed human response if something does go wrong, rather than relying on automated detection alone.
Should You Upgrade?
Consider the paid tier if:
- Your site processes payments or stores customer data directly
- You have been compromised before and want automatic removal rather than manually cleaning an infection yourself
- You want the Google Blacklist Monitoring specifically, since discovering your site has been blacklisted after the fact can mean days of lost traffic before you notice
The free tier is likely enough if:
- Your site is a blog, portfolio, or informational site with no stored customer data
- You already run WordPress security plugins covering similar ground
- You are comfortable manually addressing an issue if the scanner flags something, rather than needing automatic cleanup
If You Already Have a SiteLock Plan
If you purchased SiteLock before it was discontinued, it continues working normally until its current term expires.
It will not renew automatically after that, so mark your renewal date and plan ahead rather than waiting for it to lapse unexpectedly.
When it does expire, you have two options: rely on the built-in Malware Scan and Clean protection that now comes with hosting, or upgrade to Bluehost Complete Security if you want the expanded feature set. There is no option to renew or repurchase SiteLock itself once your existing plan ends.
