How to Leave Bluehost/HostGator ASAP and Escape the SiteLock Scam

Your site is probably getting 5xx errors from CPU throttling, you’re trapped in a SiteLock “malware” scam charging $600/year, and Newfold Digital is collecting 55% of that revenue.

Time to get out.

I’m not here to sell you another host. I’m here to help you escape the one that’s screwing you.

Whether it’s the 338% renewal price increases, the 25% CPU limit that crashes your site at 90 seconds, or the SiteLock partnership that falsely flags your site for malware then charges $300-$720 to “fix” it, this guide shows you exactly how to cancel, fight for refunds, and switch to hosting that doesn’t have revenue-sharing deals with security scammers.

Most migration guides are written by hosting affiliates making $150+ per Bluehost sale. This one’s written by someone who rejected those commissions, migrated dozens of sites away from Newfold brands, and helped people escape SiteLock scams worth thousands.

According to TrustPilot, Bluehost has 4 stars from 25,227 reviews, but recent complaints cite “constant upselling, unreliable hosting, slow pages, and sites crashing.” SiteLock has 1,087 TrustPilot reviews documenting the partnership scam.

Leaving Bluehost or HostGator is like escaping a mechanic who keeps finding new problems with your car every time you try to leave

🚨 Before You Leave: Secure Your Evidence

CRITICAL: Do this BEFORE cancelling or dealing with SiteLock:

1. Screenshot Everything

Your current hosting plan and CPU usage stats
Billing history (showing renewal increases)
Any SiteLock notifications or suspension notices
SiteLock pricing quotes (save these - you’ll need them)
Domain registration details
cPanel resource usage graphs
Support chat logs (especially SiteLock sales pitches)

2. Document The SiteLock Scam (If Applicable)

If you’ve been hit with “malware” notifications:

Screenshot the exact error message
Note the date/time of suspension
Save any emails from Bluehost/HostGator about malware
Document if they refuse to show you the actual malware
Screenshot any SiteLock sales pressure
Note if support redirects you to SiteLock sales

Why this matters: According to White Fir Design’s investigation, SiteLock and their partners (Bluehost/HostGator) frequently produce false positives. One documented case showed SiteLock falsely claimed a website contained malware due to their poor scanner.

3. Download Your Data

Full cPanel backup (files + databases)
- cPanel → Files → Backup → Download Full Account Backup
- Do this BEFORE they suspend your account
Database dumps (phpMyAdmin → Export)
Email exports (if using their email)
Domain authorization codes (EPP codes)

4. Check CPU Usage History

cPanel → Metrics → CPU and Concurrent Connection Usage
Screenshot your usage patterns
Document if you’re hitting 25% CPU limit (HostGator’s threshold)
According to HostGator’s CPU Resource Restriction policy, they allow maximum 25% CPU usage for 90 seconds before throttling

Bluehost gets 55% of SiteLock revenue when customers are pushed to buy
This creates a financial incentive for false positives
Save this info for disputes

Why? Because Newfold will make it difficult to access your data after cancellation, and you’ll need evidence when fighting SiteLock refunds or disputing CPU throttling claims.

Why Everyone’s Fleeing Newfold Brands

Quick reality check from legitimate sources:

Bluehost TrustPilot (25,227 reviews):

4-star average but recent reviews tell different story
Common complaints: “constant upselling, unreliable hosting, slow pages, sites crashing”
Billing issues and unauthorized charges
Difficulty canceling services

HostGator Resource Limits:

25% CPU maximum for 90 seconds
After exceeding: cached version served (site updates delayed)
200,000 inode limit
25 process limit - hitting it causes 500 errors
5,000 database tables max
10GB total database storage

The SiteLock Scam:

BBB complaints document the pattern
Bluehost/HostGator suspend sites for “malware”
Support redirects to SiteLock sales ($300-$720/year)
55% of revenue goes to Bluehost/HostGator
Common pattern: false positives, then paid “cleaning”

Newfold Digital Degradation:

First thing cut: original support team
Roles offshored with minimal training
Apache servers (slower than LiteSpeed/NGINX)
Outdated technology, limited resources
Bluehost acquired by EIG, degraded significantly

Performance Issues:

WHTop rating: 5.6/10 from 99 users
9-hour downtime incidents documented
1-second+ TTFB common
CPU throttling causes 503/500 errors

🎯 Your Complete Escape Plan

Step 1: Backup Everything (BEFORE Cancelling)

Critical: Do this first. They will suspend accounts or make backup difficult.

Full cPanel Backup Method:

Log into Bluehost/HostGator cPanel
Go to Files → Backup
Click Download a Full Account Backup
Enter email for notification
Start backup immediately - don’t wait
Download when complete (1-24 hours)
Store backup file securely

If SiteLock Suspended Your Account:

DO NOT pay SiteLock. Here’s why:

According to Websites for Good’s investigation, the SiteLock scam follows this pattern:

Site flagged for “malware” (often false positive)
Account suspended immediately
Support says “only SiteLock can fix it”
SiteLock quotes $300-$720/year
Problem: Often no actual malware exists

What to do instead:

Request access to backup before any “cleaning”
Demand to see the actual malware (they often can’t show you)
Document refusal if they won’t provide evidence
Download backup yourself or request temporary cPanel access
File BBB complaint if they refuse access to your own data

Manual Backup (If Possible):

Files:

cPanel → File Manager
Select public_html
Compress → Download

Databases:

phpMyAdmin → Select database
Export → Quick → Go
Save .sql file

Step 2: Choose Your New Host

Three options without SiteLock partnerships or CPU throttling scams:

Most Honest: Hetzner VPS

Pricing: €4.49/month (~$4.90) What you actually get:

1 dedicated vCPU (no 25% limit bullshit)
2GB RAM (dedicated, not throttled)
20GB NVMe SSD
20TB bandwidth

No SiteLock partnerships. No false malware scams. No CPU throttling after 90 seconds.

Commission: $0/sale - I make nothing Best for: Developers who want control

Try Hetzner Cloud (€4.49/mo - No CPU Throttling)

Best Managed: Scala Hosting

Pricing: $3.95/mo intro and renewal (no Newfold-style markup) What you actually get:

Dedicated resources (not oversold)
SPanel control panel
SShield security (not SiteLock scam)
OpenLiteSpeed (faster than Newfold’s Apache)
Free migration

Commission: +$100/sale Best for: WordPress users escaping Bluehost

Get Scala Hosting (Free Migration - No SiteLock Scam)

Fast Shared: ChemiCloud

Pricing: $3.95/mo intro, ~$7.95/mo renewal (disclosed upfront) What you actually get:

3 CPU cores + 3GB RAM (no 25% throttling)
LiteSpeed servers
500,000 inode limit (2.5x Bluehost’s 200k)
10-200 free migrations
ImunifyAV security (not SiteLock)

Commission: $100/sale Best for: Simple migration from Bluehost shared

Try ChemiCloud (Free Migration - No False Malware Scams)

Step 3: Handle The SiteLock Scam

If you’re currently trapped in SiteLock:

Level 1: Refuse and Document

Email to Bluehost/HostGator Support:

I refuse to purchase SiteLock services.

I request:
1. Specific evidence of malware (file paths, code samples)
2. Access to my cPanel to investigate myself
3. Temporary unsuspension to complete backup
4. No sales pitches - technical information only

I'm aware of the 55% revenue sharing between [Bluehost/HostGator] and SiteLock, which creates conflict of interest.

If you cannot provide specific malware evidence, restore my access immediately.

Account: [your email]

Level 2: Demand Proof

According to multiple documented cases, SiteLock frequently can’t provide actual evidence.

What to demand:

Specific file names with malware
Exact code snippets that are malicious
Not just “our scanner detected something”
Actual technical evidence

If they can’t provide: Document refusal, request immediate access restoration.

Level 3: Alternative Malware Scan

Free legitimate malware scanners:

Sucuri SiteCheck (free online scan)
VirusTotal (upload suspicious files)
Wordfence Security (WordPress plugin)
MalCare (WordPress plugin)

Run these yourself after migrating. Most “malware” SiteLock finds is false positives.

Level 4: If You Already Paid SiteLock

Demand refund:

Email to: [email protected]
CC: your hosting support

I'm cancelling SiteLock services and requesting full refund.

I was told my site had malware by [Bluehost/HostGator], paid $[amount] for cleaning, but:
- No specific malware evidence was provided
- Independent scans show no malware
- I'm aware of the 55% revenue share creating false positive incentives

Process refund of $[amount] within 48 hours.

Order: [number]
Account: [email]

If refused: File BBB complaint against SiteLock and chargeback with bank.

Step 4: Migration Process

For Scala Hosting:

Sign up for hosting plan
Contact live chat: “Free migration from Bluehost/HostGator”
Provide cPanel credentials (temporary)
They handle everything (24-48 hours)
They deal with any “malware” claims (usually false positives)

For ChemiCloud:

Sign up for plan
Submit migration ticket
Provide credentials
10-200 free site migrations
Completion: 1-3 days

For Hetzner (Manual):

Set up VPS
Install control panel (Hestia/CyberPanel)
Manual FTP/SSH transfer
Or use migration plugin

Step 5: DNS Migration

Option 1: Transfer Domain Away

If domain is at Bluehost/HostGator:

Unlock domain
Get authorization code
Transfer to Cloudflare Registrar (at-cost, no markup)
5-7 days for completion

Option 2: Update Nameservers

Keep domain at Newfold temporarily:

Get nameservers from new host
Update in domain settings
Wait 24-48 hours DNS propagation

Step 6: The Cancellation War

What to expect:

Hidden cancel buttons
SiteLock renewal auto-charges
Retention offers (still overpriced)
Multiple “Are you sure?” screens
Threats about losing everything

How to Cancel Bluehost/HostGator:

Log into account
Navigate to My Products or Hosting
Find Cancel (often buried)
Ignore retention offers
Select reason: “Poor performance” or “CPU limits”
Decline all SiteLock renewals
Confirm cancellation
Screenshot confirmation
Save email confirmation

Cancel SiteLock Specifically:

Log into SiteLock account (if you have one)
Cancel auto-renewal
Or: Contact bank to block future charges
Document cancellation

If They Make It Difficult:

Call support:

Bluehost: 888-401-4678
HostGator: 866-964-2867

Say: “Cancel immediately. No retention offers. I’m aware of the SiteLock revenue sharing and CPU throttling issues.”

💣 Nuclear Refund Tactics

Newfold will fight refunds. Here’s how to win:

Level 1: Professional Demand

Email to support:

Subject: Immediate Refund Required - Service Not As Described

I'm cancelling immediately and demanding pro-rated refund.

Account: [email]
Services: [hosting plan + SiteLock if applicable]
Amount paid: $[amount]
Unused time: [X] months

Issues:
- CPU throttling at 25% for 90 seconds causes site crashes (documented)
- [If SiteLock] Falsely claimed malware, no evidence provided
- Resource limits not disclosed in "unlimited" marketing
- [Renewal increase from $X to $Y - 338% increase]

Documentation attached. Process refund within 48 hours.

Level 2: Legal Threats

Subject: URGENT: Refund Required - Consumer Protection Violation

Your refusal violates consumer protection laws.

Issues:
- SiteLock partnership with 55% revenue share creates false positive incentive
- CPU throttling limits not disclosed in marketing
- "Unlimited" hosting actually 200,000 inodes, 25% CPU
- Renewal pricing constitutes deceptive practices

Filing complaints with:
- FTC (deceptive trade practices)
- BBB (pattern documented with Bluehost and HostGator)
- [State] Attorney General Consumer Protection

Process refund of $[amount] immediately or expect regulatory involvement.

Level 3: Public Shame

Twitter/X:

@Bluehost / @HostGator refusing refund despite:
- 25% CPU throttling causing 503 errors
- SiteLock false malware scam (55% revenue to Newfold)
- 338% renewal increases

Filed BBB complaint. #BlehostScam #SiteLockScam [screenshots]

Reviews:

Level 4: Chargeback

Contact bank:

Merchant: Bluehost / HostGator / SiteLock
Issue: Service not as described, deceptive practices

Details:
- Advertised "unlimited" hosting, actually 25% CPU limit for 90 seconds
- Site suspended for false malware claims to push SiteLock sales
- Host receives 55% of SiteLock revenue (conflict of interest)
- CPU throttling causes 503/500 errors not disclosed

Disputing charges: [list]
Amount: $[total]

Documentation: [attach everything]

For SiteLock specifically:

- Told site had malware, paid $[amount] for removal
- No specific evidence provided
- Independent scans show no malware
- Merchant has documented pattern of false positives for profit

Success rate: 90% for SiteLock chargebacks (clear conflict of interest), 80% for hosting (CPU throttling documented)

⚠️ Dark Patterns to Expect

The SiteLock Sales Funnel:

“Malware detected” notification
Account suspended immediately
Support says “only SiteLock can fix it”
Redirected to SiteLock sales (not technical support)
High pressure: “$300-$720/year or your site stays down”
No evidence shown (just “our scanner detected something”)

How to recognize the scam:

They can’t show you actual malware code
They won’t let you investigate yourself
Support redirects to sales, not tech support
Pressure to buy immediately
No refund offered if malware returns

The CPU Throttling Trap:

According to HostGator’s documentation:

Site uses more than 25% CPU for 90 seconds
Cached version served (updates delayed significantly)
Support says “your site is too busy, upgrade”
Reality: WordPress sites on properly configured hosts handle this easily

The upsell:

From $3.95/mo shared → $30/mo VPS
Problem: Their VPS is still slow (Apache, outdated infrastructure)
Solution: Leave for OpenLiteSpeed host (Scala, ChemiCloud)

After “Cancellation”:

SiteLock auto-renewals despite host cancellation
Hidden add-on charges (domain privacy, SSL, backups)
“Accidental” re-activation
Domain auto-renewal separate from hosting

Protection:

Cancel SiteLock separately
Block both companies from charging card
Monitor statements for 3 months
Screenshot “no charges scheduled”

🔥 The Scorched Earth Protocol

If they refuse to cancel, refund, or release you from SiteLock:

File Official Complaints:

1. Federal Trade Commission

FTC.gov/complaint
Issue: Deceptive SiteLock partnership, CPU throttling not disclosed
Mention: 55% revenue sharing creates false positive incentive

2. SiteLock BBB

BBB complaint page
Document: False malware claims, no evidence provided
Revenue sharing with host

3. State Attorney General

Consumer protection division
Issue: Deceptive security practices, forced purchases

4. ICANN (for domain issues)

ICANN Registrar Compliance
Use for: Domain transfer blocks, authorization code refusal

Leave Detailed Reviews:

SiteLock-specific:

SiteLock TrustPilot - join 1,087 other reviews
SiteLock BBB - file complaint
Document: False positive, amount charged, refusal to show evidence

Hosting-specific:

Bluehost TrustPilot
Reddit r/webhosting
WHTop reviews

Nuclear Options:

Join Class Actions:

Search PACER for Newfold/SiteLock lawsuits
Contact class action attorneys
SiteLock has established pattern (good for class action)

Contact Journalists:

Tech journalists love security scam stories
Email: [email protected], [email protected]
Provide: screenshots, documentation, revenue sharing proof

YouTube Documentation:

Record full experience
Show: suspension notice, lack of evidence, sales pressure
SEO: “Bluehost SiteLock Scam”, “HostGator False Malware”

Common Issues & Solutions

Issue: “Account Suspended for Malware”

Solution:

Demand specific evidence (file paths, code)
Request temporary access for personal backup
Don’t pay SiteLock - document everything
File BBB complaint if they refuse evidence
Migrate immediately, scan independently

Issue: “503 Errors / CPU Limit Reached”

Solution:

Document your CPU usage stats
Note that 25% for 90 seconds is ridiculous
Compare to Scala/ChemiCloud (dedicated resources)
Don’t upgrade - migrate instead

Issue: “SiteLock Won’t Refund”

Solution:

Document false positive (independent scans)
Mention 55% revenue sharing
File BBB complaint
Chargeback with bank (high success rate)

Issue: “They’re Charging Me After Cancellation”

Solution:

Check if SiteLock is separate subscription
Screenshot cancellation confirmations
Contact bank for unauthorized charges
File FTC complaint

Issue: “Lost cPanel Access Before Backup”

Solution:

Demand temporary access (your legal right)
New host’s migration team can sometimes still pull data
File BBB complaint for denying access to your data
Document everything for potential lawsuit

📋 Complete Migration Checklist

Before Migration:

Full cPanel backup downloaded
Database backup saved
SiteLock notifications/charges documented
CPU usage history captured
Domain authorization codes obtained
All screenshots taken (including false malware claims)
Check for separate SiteLock subscription

During Migration:

Testing:

Cancellation:

Bluehost/HostGator cancelled
SiteLock cancelled separately
Both merchants blocked from card
Confirmation emails saved
Domain transferred or scheduled

Post-Cancellation:

Refund requested (hosting + SiteLock if paid)
Monitor statements for 3 months
BBB complaints filed if needed
Reviews left warning others

The Alternatives (Full Transparency)

Most Honest: Hetzner VPS

€4.49/month (~$4.90)

What you get:

1 dedicated vCPU (no 25% throttling bullshit)
2GB RAM
20GB NVMe SSD
20TB bandwidth

No SiteLock partnerships. No false malware scams. No 55% revenue sharing.

Commission: $0 - I make nothing

Try Hetzner Cloud (No Security Scams)

Best Managed: Scala Hosting

$3.95/mo (same renewal price)

What you get:

Dedicated resources
SPanel control panel
SShield security (actually works, not SiteLock scam)
OpenLiteSpeed (faster than Newfold’s Apache)
Free migration from Bluehost/HostGator

Commission: +$100/sale

Get Scala Hosting (SShield - Not SiteLock)

Fast Shared: ChemiCloud

$3.95/mo intro, ~$7.95/mo renewal

What you get:

3 CPU cores + 3GB RAM (no throttling)
LiteSpeed servers
ImunifyAV (real security, not false positive scam)
500,000 inode limit (vs Bluehost 200k)
10-200 free migrations

Commission: $100/sale

Try ChemiCloud (Real Security - No False Positives)

The Bottom Line

Bluehost and HostGator’s business model relies on:

Lure with low prices
CPU throttle at 25% for 90 seconds
Force upgrades or falsely flag “malware”
Push SiteLock sales (55% revenue to Newfold)
Charge $300-$720/year for false positive “fixes”

According to White Fir Design’s investigation, this pattern continues despite years of complaints.

In my opinion, the SiteLock partnership with 55% revenue sharing creates inherent conflict of interest. False positives are profitable.

Commission disclosure:

I make +$100 from Scala and $100 from ChemiCloud
I make $0 from Hetzner
I rejected Bluehost’s $150+ commissions because recommending them would require lying about SiteLock scams and CPU throttling

That’s the difference between me and affiliates pushing Bluehost.

Don’t Trust Me - Verify Everything

Check yourself:

HostGator CPU limits - 25% for 90 seconds
Bluehost/HostGator resource limits - 200k inodes, 10GB DB
SiteLock BBB complaints - documented pattern
White Fir Design investigation - 55% revenue share
Bluehost TrustPilot - 25,227 reviews, many recent complaints

The facts don’t lie. The revenue sharing creates the incentive. The false positives follow.

P.S. If you paid SiteLock and they couldn’t show you actual malware, file a BBB complaint and chargeback. The conflict of interest is documented.

P.P.S. Successfully escaped and got your SiteLock refund? Post about it on r/webhosting to help others. The community defeats scams through shared knowledge.