Full Disclosure: WebTotem offer AppSumo users a small upgrade in number of sub-accounts in exchange for reviews. The 'reward' does not depend on the favorability of the review. With that aside, here is a review of my experience with WebTotem (WT) for about a month so far (since March 3, 2021).

Very often, prospective buyers will ask if WebTotem is comparable and/or better than Virusdie. My answer as a VD user for more than 2 years is that the two products have little overlap and thus direct comparison is impossible but if I have to do it, WebTotem is much more feature-rich.

VD has two components: an antivirus/malware scan & remove tool, and a WAF. Their AV/malware scanner works great and is very simple to use. Their WAF I really hate, as I find it way too sensitive. I have that turned off on all my websites. Also, the VD dashboard has a File Editor with full access to each website root, which cannot be disabled; if access to the dashboard is somehow compromised, the user will be royally f—ed.

WebTotem has AV/malware, WAF, deface detector, site response / availability monitor, port vulnerability scanner, detailed server resource monitor (PHP version, CPU type & load average, RAM consumption, disk space), SSL certificate expiry monitor, a reputation manager and a bespoke 'Security Rating' that is a product of (arbitrarily selected and scored) items that relate to overall security (HTTP security headers, open ports, outdated JS components, etc.) There is the ability to generate reports and to white-label them.

I haven't had a chance to test WebTotem AV/malware removal, and I have no idea how their WAF works in principle (i.e. what rulesets are used), but its centerpiece is 'AI learning' — and I haven't been overzealously blocked by that WAF while working around the websites I've tested; so I've kept it turned on. It maintains a list of 'attacks' and blocked requests.

There are minor issues with the web interface that annoy me (for example, when adding a new site, the 'wizard' that offers manual or automatic installation just stops in the middle of the process; there is no 'OK, I did that, so give me the API key to activate the new site' step. It just sits there, waiting to be closed.)

The service is also unstable from time to time; for one of my websites I regularly see an 'Agent Unavailable' notice even though the agent is available. The WT interface explains the issue by stating 'It seems our server is overloaded right now'. Apparently the AppSumo campaign has been very successful. 😊

There is no mobile version of the dashboard; no 2FA to protect the login as far as I can see; no ways to rename sites once they have been added, and I can see how the dashboard will become a pain to use once one adds more than two dozen websites.

But while annoying, these things do not fundamentally degrade the value of the service; WebTotem is an ambitious project that can lend a strong hand to a busy sysadmin and thus earns 5 tacos from me.