This past December, Google blacklisted more than 11,000 websites following the outbreak of the SoakSoak malware which infected thousands of WordPress sites that used a popular plug-in. This is hardly an isolated event — in fact Google blacklists hundreds if not thousands of websites a day due to targeted hack attacks, malware, and other general site vulnerabilities.
For hosting providers, blacklisted sites can be a real nightmare. Customers often don’t understand why their site was blacklisted, and in knee-jerk fashion will typically blame their hosting provider – even when such blame is not warranted. Regardless of where the fault lies, hosting providers need to be prepared to help customers remediate these critical issues. Every minute a site is blacklisted represents lost revenue and damage to your customer’s brand. How you respond could be the difference between keeping a satisfied customer or losing an unhappy one.
While it can happen to any website, even those with relatively robust security measures in place, blacklisting is a particular problem for SMBs. Such companies typically can’t afford IT staff with specialized security and remediation expertise, so they rely on you for site maintenance. Others may have come to you through a reseller, which may or may not have the technical expertise to handle the situation, resulting in additional lost time and a panicked call to their web host for support.
Getting back into the Good Graces of Google: Restoring a clean website
Helping your customers restore their site as fast as possible is critical. The time required to remove malware, secure a site, request review and get site blocking removed can range from several hours to a week or more, depending on the severity of the damage. A recent study found that the average time it takes for Google to remove blocking is more than 10 hours; actual removal times examined for 500 blacklisted sites ranged from 2 hours and 20 minutes to 23 hours. And time is money: Results from the Symantec 2011 SMB Disaster Preparedness Survey found that, on average, blacklisting costs the SMB $12,500 per day.
So, how can you help? One of the fastest ways to get your customers’ sites up and running quickly is by restoring the site from a clean, previously backed-up version. This may not always address this issue if the site is infected with malware and requires additional remediation, but in the majority of cases, restoration via back-up does the trick. The question is, what kind of back-up services should you offer – managed or self-serve? Ideally, the answer is ‘both,’ but that depends on the size and sophistication of your business.
Managed Services Approach
Managed backup and monitoring services use a proactive approach that gives the user peace of mind their accounts are protected against threats, and that if an incident occurs, a plan is in place to mitigate the damages and return the accounts to normal as quickly as possible.
Of course, managed services come at a premium, and also require the web host to allocate resources – hardware, software, security, disaster recovery and business continuity — specifically to those managed accounts. Depending on the size of the customer, managed services may or may not be the best solution for a price-conscious user (cost) whose accounts can get by with a backup solution that can make them “whole” quickly (value).
While any customer would appreciate the white glove attention that a managed service provides, it may not be within their budget. Or, the customer may have enough IT skills and/or resources in-house to manage a simple browser-based back-up solution. In either case, web hosts should also offer a cloud-based, self-service option. Such solutions are much less expensive, reduce response times, and give your customer greater control over their situation – all of which adds to the positive customer experience and stickiness for the account. And if they should need it, you can also provide hands-on support as a premium or add-on.
Self-service back-up for e-mail and websites empowers customers to access and mange their own site restore functions, reduces the amount of staff you need to have on hand, and IT infrastructure you need to maintain (your customers will access their backed-up files directly from the cloud). It should also reduce the number of backup-related support tickets and improve the ease with which such tickets are resolved. More importantly, it frees up what staff you do have to focus on infrastructure or security-related tasks, or more complex customer support issues. The result is lower operating costs, higher profitability and a greater focus on customer satisfaction and growing your business.
If your customers do call you in a panic, there are several first-responder tools that you or they can use to find out whether they are truly blacklisted. The first, best and most obvious place to look is Google’s own Webmaster Tools. Other tools you can point your customers to include The Abusive Hosts Blocking List, which is primarily for email abuse but it can give them insights as to why their site may have been blacklisted, or MX Toolbox and BlackListAlert.org, which search multiple blacklist databases.
Once the site has been fully restored, Google recommends that your customers use Wget, cURL or the Fetch as Google tool in Webmaster Tools to verify the site is clean and free of damage. Only then should your customers submit an online review request to have Google the blacklist warnings. Hopefully your customers’ issues will be resolved in just a few hours, but counsel them that the review process could be much longer.
Effectively helping your customers handle their blacklisting issue, and being supportive throughout the entire process, can win you much deserved loyalty and appreciation. And offering them various service levels – i.e., managed or self-serve back-up and restoration services — that best fit their needs and IT skill level will go a long way toward turning a bad situation into a home run.
Ridley Ruth is COO at Dropmysite, a leading cloud-based backup company with a focus on websites, emails, databases, mobile devices and more. The company has developed a comprehensive solution and launched three websites: www.Dropmysite.com, www.Dropmyemail.com and www.Dropmymobile.com.