You can install a security suite on all your devices to protect them from attack, but such an app can do little against identity theft. Webroot Premium combines device-level protection with identity theft tracking and remediation. However, that device-level protection offers little more than Webroot’s antivirus, and the identity component lacks features found in the best competitors. We recommend Norton 360 With LifeLock or Bitdefender Ultimate Security if you need this kind of dual protection. Both are Editors’ Choice winners that excel in protecting your devices and comprehensive identity theft remediation.
How Much Does Webroot Premium Cost?
At $129.99 per year, Webroot Premium costs less than most suites that combine security technology with identity theft protection. Bitdefender Ultimate Security costs $179.99 per year, McAfee+ goes for $199.99 per year at the tier that includes identity protection, and Avast One Platinum runs $249.99 per year. The basic Webroot subscription protects five devices and one identity. Switching to the $249.99 family edition almost doubles the price, and it doubles the number of protected devices to 10. More significantly, a Webroot family subscription protects up to 10 identities.
For comparison, the Bitdefender subscription mentioned above covers 10 devices and one identity. With Avast One Platinum, you can install protection on up to 30 devices, and the identity component covers your whole family (two adults and four kids). And McAfee+ covers every device in your household, whether it runs Windows, macOS, Android, iOS, or even ChromeOS. You can upgrade your McAfee+ subscription to cover family identities for $60 more.
Norton’s protection comes in a dizzying array of levels. The $149.99 Select tier gives you five device and VPN licenses, 100GB of storage for online backups, and basic identity theft protection. At the Advantage tier, you pay $100 more and get 10 licenses, 250GB of storage, and additional identity theft features. Paying $349.99 for the Ultimate+ tier gets you unlimited devices, 500GB of backup storage, and the very top level of identity protection. Each of these comes in Family and Family Plus Kids editions, topping out at $819.99 per year to get Ultimate+ protection for you, your partner, and five kids.
Like Norton, Aura has multiple tiers, which cost $144, $264, and $444 per year. That may sound pricey, but those tiers include 10, 20, and 50 device-level security licenses, which protect one, two, and five identities, respectively.
IDX Complete isn’t quite like the rest in this group. It integrates a suite of security and privacy tools, including password management and a data broker opt-out system like what you get with Optery or Privacy Bee, but you’ll have to get your antivirus protection elsewhere. IDX Complete costs $355.32 per year, or $701.88 per year if you want identity protection for your partner and kids.
As you can see, Webroot is one of the least expensive in this group. However, when you pay more, you get more, anywhere from a little bit to a whopping huge amount.
What Happened to Webroot Internet Security?
With the current product line update, Webroot AntiVirus was renamed to Webroot Essentials. In addition, Webroot Internet Security Plus and Webroot Internet Security Complete were written out of the story entirely. Now if you want to upgrade from Webroot Essentials, you jump directly to Webroot Premium. Bitdefender did something similar recently with Bitdefender Internet Security, which is slated for the chopping block sometime in 2025.
This shakeup isn’t a great loss. I’ve repeatedly faulted the Webroot suites for not adding enough features at each tier.
Getting Started With Webroot Premium
As with the Webroot Essential antivirus app, you start by creating a Webroot account online, downloading the app, and entering the activation code when prompted. Immediately after installation, it runs through a list of startup tasks, checking for malware and optimizing performance for your unique system configuration. Even with these added tasks, the process goes quickly.
(Credit: Webroot/PCMag)
As noted, Webroot AntiVirus became Webroot Essentials, and this review covers Webroot Premium. Those names aside, the main window’s title remains Webroot SecureAnywhere. It looks exactly like Webroot Essentials except for an extra tab on the Utilities page and some extra options in Advanced Settings.
The main window has a green gradient background. It has a lighter panel that reports statistics about recent scans and a button to launch an on-demand scan. Even if you never click to request a scan, Webroot does a full scan during installation and scans daily. A panel at the right manages access to the rest of this app’s collection of security features.
Shared Antivirus Protection for Windows
This suite’s antivirus protection for Windows PCs is almost identical to Webroot Essentials. Please read my review of the basic antivirus for full details of my findings. I’ll briefly run through my results here and then cover the minor differences.
On my standard test system, Webroot’s full scan time ran about four minutes at first, but subsequent scans ran steadily faster, down to about a minute and a half. The average for recently reviewed antivirus apps is well over an hour and a half, so that’s a huge difference.
(Credit: Webroot/PCMag)
Webroot recognizes and quarantines known bad programs and tips its hat to known good ones. It relies on a behavior-based detection system in the cloud to determine the fate of unknown programs. It journals all actions by unknown processes and reports the behavior pattern for online analysis. A bad evaluation from the cloud tells the local agent to wipe out the process and reverse everything it did. This system can even reverse a ransomware attack in some cases.
Many tests by the big independent labs like AV-Test Institute and AV-Comparatives assume that if the antivirus is going to recognize and wipe out malware, it will do so instantly. Webroot’s journal-and-rollback system waits for the cloud to respond, so it doesn’t jibe with those tests. In the past, Webroot has scored well in an MRG-Effitas test that gives each antivirus 24 hours to remediate any malware activity, but Webroot hasn’t appeared in this lab’s reports for a few years. Webroot did receive the top-ranking AAA certification in the latest report from SE Labs. That’s good, but note that all the other tested antiviruses also reached AAA certification.
My own hands-on malware protection test starts when I open several folders containing malware samples. Just opening the folders didn’t trigger Webroot’s real-time scanner, but copying the contents to a new folder woke it up. It caught about 80% of the samples at this stage and requested a scan to confirm its cleanup. That scan detected still more malware, but a third scan came up clean and green. At this point, Webroot had eliminated all but one sample. Finishing the test by launching and analyzing that sample, I found that Webroot managed 100% detection and scored 9.9 out of 10 possible points.
Avast, AVG, Norton, and UltraAV also scored 9.9 points, but only Webroot detected 100% of my current sample collection.
Collecting and curating a set of malware samples takes weeks, so I don’t change the static malware collection often. To measure how well each antivirus handles current, prevalent malware, I start with a feed of malware-hosting URLs supplied by MRG-Effitas. Typically, these URLs are no more than a day or two old.
In testing, Webroot blocked access to 76% of the malware-hosting URLs and quarantined another 21% of the malware payloads, for a total of 97% protection, better than its previous 93%. That 97% score is dandy, but Avira, Bitdefender, Guardio, Sophos, and Trend Micro all earned 100% in their own malicious URL blocking tests.
There’s no active malware required to create a phishing website. Rather, the fraudsters who devise these imitation web pages hope that there really is a sucker born every minute, someone who’ll log into a fake bank site, shopping site, or even dating site. Because these fakes come and go quickly, I use the very newest ones for my testing. I challenged Webroot on Windows and macOS simultaneously, and it scored 100% on both platforms.
Avira, Guardio, and McAfee also reached 100% in their own phishing protection tests. NordVPN Plus and Surfshark One come from the VPN realm, but they achieved 100% detection as well. Perhaps it’s no surprise that the phishing-centric Norton Genie reached the same pinnacle.
Other Features Shared With Webroot Essentials
Where many security companies reserve firewall protection for their security suites, Webroot offers it in the basic antivirus. The firewall component doesn’t attempt protection against outside attacks. Rather, it leaves that task to the capable built-in Windows Firewall. Webroot monitors network activity by unknown programs and prevents them from misusing their connection, something Windows Firewall doesn’t do. If the antivirus component detects malware on the system, the firewall clamps down, preventing all network access by untrusted programs.
When there’s no current emergency, the firewall, by default, doesn’t interfere with programs that want to access the network. You can optionally set it to require confirmation for internet access by untrusted programs even when there’s no active infection. Or you can crank it up so that every access attempt requires confirmation unless you’ve given the program permission. I experimented with these modes to confirm they work, but the average user probably won’t ever change the firewall settings.
From the Webroot online console, you can activate the LastPass subscription that comes with both Webroot Essentials and Webroot Premium. We’ve reviewed LastPass Premium separately, so I’ll refer you to that article for details.
(Credit: Webroot/PCMag)
If you’re not a security expert, you won’t use most of the remaining shared features. However, they can be helpful when you’re working with tech support to solve a problem. There are tools to repair collateral damage after a malware attack, quickly reboot into Safe Mode, and manually repair malware damage. An active process list shows which processes are trusted and which ones Webroot is monitoring. Finally, the SafeStart Sandbox lets the most expert of experts launch a suspect program under limitations that prevent it from doing damage. But again, the average user just doesn’t have the knowledge to use these advanced features.
System Analyzer and Optimizer
Looking at the main window, there’s no visible difference to show that you’re using Webroot Premium rather than Webroot Essentials. However, if you click the Utilities section in the main window, you’ll find new items. Where the Plus version has buttons for Reports and System Control, the Complete version replaces those with buttons named Optimize Now and Run System Analyzer. If you click the gear icon next to Utilities, you’ll find a new System Optimizer tab. Note that these features are already present in Webroot Essentials for Mac.
(Credit: Webroot/PCMag)
The performance optimizer itself is simple. You click the Optimize Now button, either from the main window or the System Optimizer page, and it quickly wipes out useless files, thereby recovering the space occupied by those files. There’s no preview of what’s to be deleted, nor is there a report on completion.
If you want to see what this component did, click the settings gear icon in the Utilities panel, click System Optimizer, and click the View Log button at the bottom right. Be warned; the log is just a raw blow-by-blow list of what Webroot removed. You can also invoke Webroot’s scheduler to run optimization on a daily or weekly basis or run it at a regular interval, up to every 24 hours.
(Credit: Webroot/PCMag)
Digging into Advanced Settings, you can see why the optimizer is so fast. All it does out of the box is clear temporary files and empty the Recycle Bin. Most users won’t open Advanced Settings. Those who do can configure the optimizer to remove a handful of other types of data, including the user login history, the storage folder for files burned to CD or DVD, and any memory dump files.
As on the Mac, the System Analyzer looks for possible system-level problems and runs a quick scan for malware. On my virtual machine test system, the Hardware section came out almost all good. Webroot reported the system free from frequent crashes and noted that all attached devices are functioning. Its only gripe was the relatively low amount of graphics RAM.
Under Software, it reported that searchapp.exe may have a memory leak and explorer.exe may have a handle leak (whatever that is). Regarding Threats, it reported that it found no malware and that both antivirus and firewall are enabled.
(Credit: Webroot/PCMag)
If the System Analyzer reports something wrong, you’re on your own. You must figure out how to fix it for yourself. Some items are easy—you might need to update Windows or turn the firewall on. But if it reports frequent crashes or devices not functioning properly, you won’t necessarily know what to do.
Secure Erase
If you right-click any file or folder in Windows, you’ll find a new menu option, Permanently Erase With Webroot. A secure deletion tool like this is handy when you want to erase a file and ensure it can’t be recovered using forensic software or hardware. It’s especially useful when paired with encryption software—after encrypting a sensitive file, you securely delete the original. Webroot doesn’t offer encryption, but you may still find uses for this tool.
Here’s a little background. When you delete a file in Windows, it isn’t really gone. It just goes into the Recycle Bin. Even if you bypass or empty the Recycle Bin, the file’s data isn’t gone. Those data sectors remain on disk, unchanged, except for a marker that says they’re available, not in use. Simple forensic software can often recover these files. Windows 10 and 11 have a simple file recovery tool built in. That’s fine when you delete the file accidentally, but not if you intend to eliminate the file completely.
The typical secure deletion utility foils forensic recovery in a very simple way. It overwrites the file’s data sectors with random data before deletion, so the recovery software gets nothing but gibberish. Overwriting the data once is sufficient to foil software-based recovery, and even lab-quality hardware-based forensic recovery systems can’t recover data that’s been overwritten seven times.
(Credit: Webroot/PCMag)
Unfortunately, Webroot’s Secure Erase does not perform secure deletion out of the box. All it does is delete the selected file or folder without sending it to the Recycle Bin. You can do that yourself by holding down Shift during deletion.
To enable actual secure deletion, you must dig into settings and raise the security level at least to Medium. At this level, Webroot overwrites the data three times, in three different ways, before deleting the file. That should be good enough for almost all consumers.
For those who deal with illegal or otherwise sensitive data, the Maximum security level goes all out. It overwrites the data seven times, which means there’s no possibility of recovery, even with the fanciest hardware. It also overwrites the unused bytes at the end of the file’s last data sector and wipes other traces around the file system. This level of secure deletion takes longer, of course, so don’t use it unless you really need it.
Mac Protection
You can also use your licenses to install protection on your macOS devices. What you get is exactly the same as Webroot Essentials for Mac.
(Credit: Webroot/PCMag)
The macOS edition doesn’t have all the high-end expert features found in the Windows edition, but those features are too techie for many users. We don’t have any reports from the independent labs to verify Webroot’s protective capabilities under macOS. Its phishing test results synced precisely with the Windows edition, meaning it scored a perfect 100% detection. In addition, it quarantined 99% of Windows malware samples, better than almost every competitor.
Mobile Security
In the previous product lineup, mobile security was one of the features distinguishing the suites from the standalone antivirus. Now even Webroot Essentials includes mobile security, provided you subscribe at the three-device tier or higher. However, at whatever tier you obtain it, Webroot Mobile Security remains disappointing. Don’t expend a license on it unless you have extras.
Installing the app is easy enough, but adding it to your subscription is unreasonably difficult. For no reason I can grasp, you must create a separate login for the mobile apps. You use the same email address and activation code, but the password has some weird requirements. It must be 9-30 characters long, must include at least six letters, and must have at least three numbers. Special characters aren’t mentioned, but a few stumbles revealed that special characters are simply not allowed.
(Credit: Webroot/PCMag)
In years past, Webroot Mobile Security included a wide range of useful mobile features. Lost Device Protection helped recover a lost or stolen phone; App Protection would analyze your apps and flag any with problematic permissions; Battery Monitor highlighted apps drawing a lot of power; and Network Monitor tracked the apps sucking up the most bandwidth. All these features are absent in the current app.
You can tap the Scan Now button to run a malware scan anytime. Tapping Activity Report Pro displays a simple score based on the safety of the websites you visit. The Secure Browser lets you surf the web protected by Webroot’s effective detection of malicious and fraudulent sites. Note that you must exit Secure Browser to use any other Webroot features. It’s probably easier to enable Webroot for Chrome, applying the same protection to the familiar Chrome browser.
You’ll also find a button to launch your Webroot-sponsored LastPass account. The final button launches Webroot’s VPN app. However, your Premium account doesn’t get you access. You need Webroot Total Protection if you want to use the VPN.
That’s it. That’s all you get with the Android app. If you want a suite with a serious Android antivirus component, look elsewhere.
(Credit: Webroot/PCMag)
It’s common for security companies to offer fewer features on iOS than on Android. The baked-in security that protects iOS from malware also balks techniques that fight malware. With Webroot’s Android app doing so little, it’s hard to imagine an iOS edition that does even less…but it exists.
Webroot’s iOS app will scan your device, but not for malware. Rather, it checks for things like insecure Wi-Fi and missing iOS updates and advises you to enable Webroot’s protection for Safari. You can tap Activity Report Pro for a score based on the scan’s findings. As with the Android app, there’s a link to hook up your Webroot-sponsored LastPass account. And that’s all.
Identity Protection
Installing Webroot protection on your devices starts from the online console, where you download the appropriate app. You manage identity protection entirely from the console, with no need for a local app.
If you look at the Webroot app on your Mac, you’ll notice it has a button labeled Identity Protection. That feature is unrelated to the actual identity protection service. Wisely, the Windows edition calls it Privacy Protection.
Logging In and Setting Up ID Theft Protection
To connect with the identity protection system, you must first log in to your Webroot account online. When you click Identity Protection in the menu at left, you’ll see a page titled Allstate Identity Protection—Webroot partners with Allstate for this part of the package. Click the big button titled Go to ID Protection account.
Now, log in with your Webroot credentials again. If you’re using a password manager, you may have a problem because this page is in the carbonite.com domain, not webroot.com. You may have to dig up the password entry for Webroot and copy/paste your credentials. Finally, you’ve arrived at the identity protection dashboard.
(Credit: Webroot/PCMag)
Alas, your troubles aren’t over. If your session times out or you log out of the identity dashboard, you come to yet another login page, this one in the domain allstateidentityprotection.com. And your credentials simply don’t work here. Your only recourse is to log in to the main Webroot account page and link to identity protection from there.
During my previous review, my Webroot contact verified that you can’t log back in, saying, “It is a less-than-ideal experience, but it is standard behavior.” That behavior hasn’t improved in the last two years.
The first time you visit the identity protection dashboard, it asks for basic personal information. You enter your name, phone, and address. I found that some of these fields were pre-filled based on information like the credit card details and email associated with the account. With that done, you can proceed to the Identity Protection console.
(Credit: Webroot/PCMag)
With that personal data entry out of the way, you can access your online identity protection. A menu along the left side divides features into four categories. At the top, the Overview category contains Dashboard and Identity Health status. Under Detection, you’ll find Credit Monitoring, Financial Transactions, and Dark Web Monitoring. Security Training and Solicitation Reduction appear in the Prevention category. Finally, the Recovery section just contains Identity Restoration.
You start your journey at the dashboard, which displays your identity health status and any dark web alerts. The status display is quite simple, showing just low risk, at risk, or exposed. McAfee+’s similar protection rating uses a 1 to 100 scale.
(Credit: Webroot/PCMag)
Clicking Identity Health Status in the menu opens a page with the same status bar in a larger size and recommended actions. In my case, it recommended reviewing alerts, updating profile data, and setting up dark web, credit, and financial transaction monitoring.
Credit Monitoring
To get started with credit monitoring, you must supply your SSN and date of birth. You may need to answer a series of typical credit verification questions, such as picking an address that is or has been your residence from a list or selecting a company that is or has been your employer. Once you pass verification, Webroot starts monitoring your credit through TransUnion. You’ll get an alert if there’s a problem.
(Credit: Webroot/PCMag)
Most competing services go beyond this simple monitoring. Some offer three-bureau monitoring. Others report your credit score monthly or even more often. Many let you view your full credit report and help you apply a credit freeze if needed. Bitdefender not only displays your credit score, but it also goes on to offer clarity on what elements went into that score and advice for improvement. With Avast’s Credit Simulator, you can preview the credit effects of actions like paying off your credit cards or taking out an auto loan. You get none of this with Webroot.
Transaction Monitoring
By the time an attack on your identity affects your credit, you have a serious problem. Better to nip the intrusion in the bud by detecting the first signs of trouble. That’s where Webroot’s transaction monitoring comes in.
To start, open the Financial Transactions page from the online console’s menu. Then click the Connect Accounts button and give Webroot access to one or more of your financial accounts. You do so by selecting the institution from a list, logging in to your account, and verifying that you permit Webroot to access the details of that account through its partner, Yodlee.
(Credit: Webroot/PCMag)
You can now tweak the types of transactions that should cause an alert. By default, these are:
-
A credit card transaction over $1,000
-
A high balance above $1,000
-
A withdrawal over $200
-
A transaction over $250
-
A net worth change over 3%
-
A low balance below $1,000
-
A portfolio change of over 3%
You can’t apply different thresholds to different accounts, and you can’t turn off specific alerts. You do get specific choices for each value. For example, you can set a Large Withdrawal alert at $200, $500, $1,000, or $5,000. If the presets don’t fit your mindset, just choose Other and fill in the desired value.
Avast lets you set triggers on purchases, withdrawals, transfers, and uncategorized transactions, with the option to configure each account separately. Aura is similar, but you set thresholds by account type, for example, using different values for bank accounts and credit cards. With Norton and Bitdefender, you have to upgrade beyond the basic tier to get transaction tracking. When you do so with Bitdefender, you can set thresholds for each account and even view all your transactions together in the online console.
Dark Web Monitoring
As with all the identity theft protection services I’ve evaluated, Webroot offers to monitor the dark web in case your personal information shows up for sale. Naturally, you must tell it just what data you want to be monitored. In the console’s left rail menu, click Dark Web Monitoring and then click the Add New Item button. This lets you enter five types of data:
Only the first three seem truly relevant. Yes, you could record your username and password credentials for website logins with Webroot, but you’re much better off recording them in LastPass.
(Credit: Webroot/PCMag)
On the one hand, Webroot does not limit the number of entries of each type. With almost all competing services, there’s a limit for each category, for example, one SSN or 10 emails. On the other hand, this is quite a limited selection of data types compared with other services. All the others do cover email, driver’s license, and credit card numbers, like Webroot. Only IDShield matches Webroot’s inclusion of Website Login Credentials.
However, Webroot is the only one that does not track bank accounts, phone numbers, or social security numbers. Almost all competitors track at least medical insurance numbers and passports.
When Webroot finds an instance of your data, it generates an email or SMS notification and puts an alert on the dashboard of your online console. Clicking the alert gets a page of generic advice, things like resetting the password for a compromised email account or requesting a replacement for a compromised credit card. When you’ve taken care of the problem, you can click to clear the alert.
(Credit: Webroot/PCMag)
Most similar services offer more detail than Webroot, such as the nature of the issue, an explanation of the event, and, in some cases, precise details on all exposed data. With Webroot, you just get the date of detection and the type of data compromised.
Features to Prevent Identity Theft
Under Prevention, the identity dashboard’s menu lists Security Training and Solicitation Reduction. When I saw the latter, I wondered if it might be a feature to opt you out of data broker and people search websites. McAfee+ and Norton include such a feature, as do IDX Privacy and Aura, to varying degrees.
(Credit: Webroot/PCMag)
As it turns out, that’s not the case. Selecting Solicitation Reduction from the console’s menu doesn’t directly do anything. Rather, it guides you to third-party sites that let you opt out of “the major sources of junk mail and telemarketing calls.” Specifically, you can opt out of unsolicited credit card offers, telemarketing calls, commercial email in general, commercial mail from LexisNexis and the Direct Mail Association (DMA), and commercial coupons from Valpak and save.com. Privacy Bee includes a similar feature alongside its very extensive ability to automate opting out from data broker sites.
If you search YouTube for “computer security training” you will get endless options. Some of them are probably quite good. But Webroot has selected a handful of animated training videos as part of your identity protection service. These aren’t from Webroot itself, but rather from a partner called Ninjio.
(Credit: Webroot/PCMag)
Go ahead and watch the videos if you like. There are only nine, and they’re two or three minutes long. You could finish in a half-hour or so. The training page says videos are “released each month,” but the collection looks just the same as when I reviewed this service two years ago.
Identity Restoration
As always, I can’t perform a real-world test on this service’s identity restoration abilities. That would require me to somehow have my identity stolen and then evaluate the restoration process. No thanks! I can report that support experts are available 24/7 should you need their help.
But what kind of incident merits contacting support? Webroot’s Guardian questionnaire helps you decide. It offers information and advice for some events, like your data showing up in a data breach. For others, like a new account you didn’t open, answering the questions can automatically open a case. I found that out by accident while experimenting with the questionnaire. I’d like to see a final confirmation before opening a case.
(Credit: Webroot/PCMag)
One thing I can compare is the monetary guarantee backing the remediation service. LifeLock has long guaranteed to spend up to $1 million if necessary to get you back from the depths of identity theft, and this guarantee has become a kind of standard. At Norton’s top tier, a combination of guarantees totals up to $3 million; at Bitdefender’s top tier, it’s $2 million. Avast defaults to $2 million, though that’s to cover your entire family.
Webroot’s welcome page states, “Our Premium plans now include up to $1M in stolen funds and fraud expense reimbursement for up to 10 family members.” That means even if you spring for the family plan that protects 10 identities, the overall cap is $1 million, not $1 million per identity.
Many similar services apply separate limits to specific types of reimbursement. For example, Bitdefender Ultimate reimburses for lost wages, but at no more than $1,500 per week for up to eight weeks. I didn’t find any similar internal limits in Webroot’s documentation.
When I last reviewed this service, it offered a $500,000 guarantee, half the norm. It’s now in line with the competition, but the identity theft prevention and remediation features are limited compared with most competitors.
Verdict: Good Antivirus, Limited Identity Protection
Webroot Premium’s device-level protection includes Webroot Essentials antivirus plus a few bonus features. While good, the antivirus doesn’t compare with the full-powered security suite you get in Norton 360 With LifeLock or Bitdefender Ultimate Security. Likewise, Webroot’s identity protection service isn’t as complete as what you get with Norton or Bitdefender. As such, these two are our Editors’ Choice winners for security suites with identity protection. They both cost more than Webroot, but they’re well worth the price.
Like What You’re Reading?
This newsletter may contain advertising, deals, or affiliate links.
By clicking the button, you confirm you are 16+ and agree to our
Terms of Use and
Privacy Policy.
You may unsubscribe from the newsletters at any time.
About Neil J. Rubenking
Lead Analyst for Security
