Just what do you expect a security suite to do for you? With Webroot Total Protection, you get antivirus, identity theft protection, backup for your sensitive files, parental control, a VPN app, and more. It’s an impressive collection, though not all the features are top quality. Norton 360 With LifeLock and Bitdefender Ultimate Security offer most of the same features—and more. These two cost a bit more than Webroot, but they deliver more value in comprehensive security, mobile protection, and support for multiple devices. In the realm of security suites with identity protection, Bitdefender and Norton are our Editors’ Choice winners.
How Much Do You Pay for Webroot Total Protection?
Webroot Total Protection’s base price of $179.99 lets you use the security suite and VPN on five devices and protects one identity. At the $299.99 per year family tier, you can install Webroot on 10 devices and protect 10 identities. Note, though, that the $1 million identity protection guarantee is for all 10. You don’t get $1 million apiece.
In my review of Webroot Premium, I noted that its $129.99 base price and $249.99 family plan were lower than the prices of most competing products. Total Protection costs $50 more at both tiers but is still not comparably expensive. In addition, with VPN and hosted online backup, it’s more on par with the top competitors feature-wise.
Norton comes in three tiers—Select, Advantage, and Ultimate Plus—each with more identity protection features than the previous. The three tiers include a security suite and VPN for five, 10, and unlimited devices, and they come with 100GB, 250GB, and 500GB of storage. They cost $149.99, $249.99, and $349.99 per year, respectively. The Select tier is closest in features to Total Protection and costs less. However, upgrading Norton to provide identity protection for your family and kids (up to four) raises that price to $389.99, way more than Webroot’s $299.99. And a Webroot family plan protects 10 individuals.
At $189.99 per year, the Plus tier for Bitdefender Ultimate Security is just a bit more than Total Protection’s price. That includes the security suite and VPN apps for five devices and protection for one identity. Upgrading to the Plus Extended tier enhances identity protection and raises the price to $249.99 per year. Finally, switching to the family subscription at that level extends protection to 25 devices and five identities for $349.99 per year.
As you can see, Webroot Total Protection is somewhat less expensive. However, its identity protection component lacks many common features, so a lower price is reasonable.
Getting Started With Webroot Total Protection
Getting the benefit of your Webroot subscription starts with a visit to the Webroot member site online. Create or log into your account, activate your purchase, and download the software. You’ll notice a link to download the backup system, but don’t dive right into that one. As I’ll explain below, you can only install backup on one PC or Mac, so it’s important to consider which device you’ll protect. If you’re setting up a Mac, there’s a separate link to install the VPN. On Windows, the VPN installs automatically alongside the antivirus.
(Credit: Webroot/PCMag)
Webroot runs a quick scan after installation, but you can let it run in the background. In testing, I encountered some odd behavior. The first scan finished in one second and reported zero files scanned. A second try stuck for 10 minutes at the warning “Initializing, please wait.” The third time was the charm—the full scan ran to completion over the next few hours.
(Credit: Webroot/PCMag)
Webroot products have had the same look for many years, with a green gradient background and rather small text. Webroot Total Protection has a completely new look. It uses a simple dark gray background with a more open layout and larger text. A large status panel dominates the top of the window, normally reporting “You are protected” and presenting information about the latest scan. It turns an angry red if important protective features are disabled. In the future, Webroot Essentials and Webroot Premium will switch to the new appearance, though the company hasn’t said when.
Below the status banner, eight icons represent important security feature areas: Virus Protection, VPN, Performance, Vulnerability, Parental Controls, Identity Protection, Password Manager, and Backup + Restore. This display replaces the somewhat compressed right-side menu of the old user interface.
Webroot Total Protection Drops Some Features
While Webroot still includes the equivalent of System Optimizer, System Analyzer is no longer present. If you’re a longtime Webroot user, you may notice the absence of some other features. Or you may not, as the dropped features were mostly aimed at users with tech expertise way beyond the norm.
The Utilities page used to let you manually fix some problems that might be left over after malware cleanup. You could restore the screen saver, set system policies to default, or boot into Safe Mode. The Utilities page also offered the option to manually remove a program and its traces or run a removal script. These items are gone, and they won’t be missed by most.
A live list of active processes gave insight into which ones were trusted and which were still on probation, monitored pending completion of Webroot’s in-cloud analysis. You could even manually move a file from monitored status to fully blocked, forcing Webroot to roll back the program’s activities. That ability was useful for me in testing, but the average user would never do it. Likewise, the sandbox system, which would let you run a suspicious app safely, has departed.
Webroot’s firewall relies on Windows to defend against outside attacks, limiting its activity to ensuring local programs don’t abuse their network connection. It was wholly invisible unless you dug in and changed settings, which virtually no users would do. The firewall no longer appears as a separate component.
The Secure Erase component could wipe out sensitive files beyond the possibility of recovery, even with forensic software or hardware. It wasn’t fully enabled out of the box, though, and few users really need this industrial-spy level of protection. Secure Erase is gone.
Device Protection Features Shared With Webroot Premium
While Total Protection looks quite different, it shares much of its underlying technology with Webroot Premium. I’ll summarize those shared features here and then highlight the differences. For more details, see my review of Webroot Premium.
Webroot’s unique journal-and-rollback system for detecting and eliminating malware isn’t compatible with some automated tests. Only one of the independent testing labs I track has included Webroot recently. The latest report from SE Labs gives Webroot AAA-level certification, the best rating, but one report isn’t enough to derive an aggregate lab test score. With an aggregate score of 9.9 points based on tests by four labs, Avast One Platinum has the best overall lab performance.
In my hands-on malware blocking test, Webroot Premium achieved 100% detection and scored 9.9 of 10 possible points. It did so using a combination of real-time protection and several rounds of speedy cleanup scanning. Webroot Total Protection achieved the same score but in a slightly different fashion. It reported every detection separately in a non-ephemeral pop-up that I had to actively dismiss, and it never requested a scan for thorough cleanup.
(Credit: Webroot/PCMag)
Webroot doesn’t emphasize scanning all the files on all your hard drives. In Webroot Essentials, any attempt to run a full scan gets a warning that it isn’t necessary and requires you to confirm you really, really want that full scan. I didn’t get that warning from Webroot Total Protection, but the scan ran for a long time, almost five hours. A repeat scan cut that time, but only by 15 minutes or so. On the speedy side, the quick scan finished in two minutes.
(Credit: Webroot/PCMag)
The malware collection I use for my basic detection test necessarily stays the same for many months, as it takes several weeks to collect and analyze a new group of samples. To test each app’s effectiveness against the very latest malware, I use a feed of malware-hosting URLs supplied by London-based MRG-Effitas. Webroot’s Web Threat Shield browser extension scored an excellent 97% in this test, but Avira, Bitdefender, Trend Micro Maximum Security, and a few others reached 100%. There’s no difference in the Threat Shield protection installed with Webroot Total Protection.
I also test each antivirus app’s ability to detect phishing websites and fraudulent sites that try to steal your credentials by mimicking bank sites and other sensitive sites. Webroot scored 100% detection in this test, as did McAfee+, Avira Prime, and several others. With a perfect score already on the books, both for Windows and macOS, I saw no need to repeat this test.
Optimizing Performance, Scanning for Vulnerabilities
With Webroot Premium, you can run System Optimizer to tune up your system’s performance or System Analyzer to identify (but not fix) possible system problems. Webroot Total Protection offers a single, simple tune-up scan, which can be reached by clicking Performance in the main window.
The tune-up overview reports when you last optimized your system, with stats about just what Webroot did. Click the Scan button to manually launch a scan. On my test virtual machine, the scan took a little over eight minutes. Awkwardly, clicking the button to apply all necessary performance fixes ran the whole scan again, spending another eight minutes of my time. You can change that behavior by disabling the Scan Before Cleaning option in Settings.
(Credit: Webroot/PCMag)
Initially, the Settings page just shows a choice between Recommended and Custom settings. You can’t even see the detailed options until you choose Custom. When you do so, it becomes clear that the scan does quite a bit. In addition to wiping out useless files and clearing away Registry junk, it does things like checking memory utilization, applying performance tweaks, and optimizing internet settings.
(Credit: Webroot/PCMag)
By default, Webroot runs a tune-up scan every Monday at six a.m. You can turn off the scheduled scan or configure it to run once per day, week, or month.
Malware coders are always looking for ways to breach security. They’re especially happy to find a security hole in some popular app or operating system. As soon as the perps mount an attack through the found security vulnerability, the app’s designers dig in to patch the hole and release a security update. But if you don’t apply that update, you remain wide open to attack. Webroot’s Vulnerability scan, not found in other Webroot applications, notifies you about any missing security patches.
(Credit: Webroot/PCMag)
As with the tune-up scan, you can launch the vulnerability scan manually or wait for its scheduled run (which is weekly by default). This scan took two minutes on my test system, and it didn’t find any vulnerable apps.
I deliberately refrain from updating browsers on my test systems, so I found this result odd. Indeed, when I checked the status in Chrome and Firefox, both responded by installing an available update.
Protection Features for Other Platforms
Webroot Total Protection’s new look extends to the Mac platform as well. It looks almost identical to the Windows edition, with a main window dominated by a big status banner. The biggest visible difference comes in the feature icons below that banner. The Mac edition drops Parental Control and Vulnerability and adds a Support icon.
(Credit: Webroot/PCMag)
There are other differences, especially when you open the Virus Protection page. On Windows, you see an Overview tab with statistics about recent scans along with buttons to launch a quick, system, full, or custom scan. Along the top you can select other tabs: Settings, Reports, Quarantine, and Schedule.
On the Mac, there are no buttons to launch scans, reports, settings, or schedules. You just see a counter of files scanned today and the file’s name most recently scanned. My Webroot contact explained that the Mac edition silently runs an initial full scan in the background, but it’s not visible. The app relies almost entirely on real-time protection, and that’s what the stats on the Virus Protection page refer to. It’s a bit confusing.
(Credit: Webroot/PCMag)
As with Webroot Premium and multi-license Webroot Essentials subscriptions, you can use your licenses to install Webroot Mobile Security on any Apple or Android device. However, you don’t get much protection. In addition, enabling mobile security forces you to create a separate Webroot account with password requirements that are just plain weird. The main difference with Total Protection is that you can install the VPN on your mobile devices.
Identity Protection Features Shared With Webroot Premium
Your Webroot subscription comes with an identity protection service supplied through a partnership with Allstate. You access this service entirely online, and it doesn’t matter whether you’ve signed up for Webroot Premium or Webroot Total Protection. That being the case, I’ll refer you to my Webroot Premium review for full details.
(Credit: Webroot/PCMag)
The identity protection service aims to prevent identity attacks by monitoring the dark web for breaches and tracking unusual transactions. If you do suffer identity theft, it provides the expected remediation help from a trained agent, with up to $1 million available to cover the financial damages of an identity theft event.
Most competing services do more than Webroot, though. And accessing the service can be awkward. If your Allstate session times out, or if you log out, it displays a login page that won’t accept your Webroot account credentials. You must shut it down, log back into your Webroot account, and then link to the Allstate identity service again.
Webroot Backs Up Your Important Files
The Total Protection page on Webroot’s site touts features including “unlimited backup,” but actually, there’s one significant limit. You get unlimited storage for your backups, but you can only back up one PC or Mac. When you first click the backup button, whether it’s on Windows or Mac, it clarifies the one-device limit and sends you to your account online to download the backup app.
(Credit: Webroot/PCMag)
Setup is simple. You don’t decide what to back up, as Webroot automatically archives “documents, pictures, music, email, browser bookmarks, financial data…everything important.” You needn’t decide when to back up, as the backup system defaults to continuous backup. You have the option to limit backing up to just once a day or set hours during which it won’t back up, though it’s unlikely you’ll need to apply these limits.
(Credit: Webroot/PCMag)
On the computer you’re backing up, Webroot overlays colored dots to indicate backup status. A file awaiting backup gets an orange dot, while one whose backup is current sports a green dot. If all files in a folder are backed up, the folder also gets a green dot. A half-filled dot means that some of the folder’s files are still awaiting backup.
If there’s no dot, it means the file or folder is outside Webroot’s default backup selection. But don’t worry. You can right-click the item, open the Webroot Backup + Restore menu, and select Back this up.
What if you regret the changes you made to an important document? Worry not, as Webroot keeps an elaborate set of previous versions. It retains the newest version, of course, and also the oldest version from the first backup. The backup system keeps a daily version for the past week, a weekly version for the past month, and a monthly version for the past quarter. If you’re keeping score, that’s a total of 14 available versions. You access past versions by right-clicking the file on the backed-up computer, not from the online dashboard.
(Credit: Webroot/PCMag)
To recover a file on any device, log in to your Webroot account and click Backup in the left menu. You can now navigate (somewhat awkwardly) through your backed-up files and download local copies of selected files or entire folders.
Protection without effort seems like a Webroot theme. Even if you never lift a finger, it checks for malware and runs tune-up scans on a schedule. You also get the benefit of having your important files backed up without any need to go through some fancy configuration. And you don’t have to worry about running out of online storage space, as there’s no set limit.
(Credit: Webroot/PCMag)
Webroot’s VPN Service Ensures Secure Connections
Your antivirus is a powerful defender against malware attacks and can also equip your browser with sensors to quash access to dangerous and fraudulent websites. However, it can’t do anything to protect your data once it leaves your computer and travels across the internet.
Conversely, a VPN creates an encrypted connection for your data, protected from any outside interference. The VPN also hides your real IP address, which can be used to identify you and even reveal your approximate physical location. And spoofing your actual location may allow you access to region-locked content (though said access may break some rules).
(Credit: Webroot/PCMag)
Webroot’s VPN is a separate app that is installed with the main security suite but not integrated into it. In fact, it’s available as a standalone for $59.99 per year. Note that the current VPN is completely different from the Webroot VPN we reviewed a few years ago. The current app licenses technology from PureVPN, though, by observation, it does not include all the same features.
If you install the VPN and turn it on, it connects through whatever VPN server it calculates to be fastest. You can also make your own choice from a list of 68 countries, including some unusual ones like Brunei Darussalam and the Cayman Islands. The VPN lets you fine-tune your US locations, with 13 cities available. It also offers two city choices each for the UK and Australia.
(Credit: Webroot/PCMag)
I couldn’t make sense out of the location list’s order, other than that the countries with multiple city choices came at the top, and the last couple dozen showed up in alphabetical order. The order wasn’t even the same between the PC and Mac installations. My company contact explained that, yes, the multi-city countries get priority, and the order is also influenced by popularity and recent selections. Webroot has about 6,000 servers worldwide.
There are a handful of different techniques, called protocols, that define a VPN’s secure connection. We at PCMag prefer the open-source choices WireGuard and OpenVPN, but most users would rather not worry about selecting a protocol. Webroot makes its own protocol selection by default, which suits the don’t-worry crowd just fine. WireGuard is available on both Windows and Mac, as is IKEv2.
(Credit: Webroot/PCMag)
By default, the VPN launches at startup and grabs available app updates automatically. You can configure it to connect at startup, though it doesn’t do that by default. Advanced features include a kill switch and split tunneling. Kill switch means that if the encrypted VPN connection drops, the app ensures that no data goes out without protection. Split tunneling lets you identify apps that don’t need VPN protection.
When we update the separate Webroot VPN review, we’ll put the app through serious testing, including measuring its effect on download speed, upload speed, and latency. For now, we can note that PureVPN itself scored well in timing tests. It may not be the fastest VPN, but it exhibited less performance drag than most.
Parental Control Is New, But Not Good
While parental control is a common security suite feature, not everyone has kids, and not every parent feels the need to monitor children’s online time. For many years, Webroot has omitted this feature. With the new Total Protection, parental control joins the crew, but it needs a lot of work.
Modern parental control systems recognize that modern kids get online in many ways. Typically, you create and configure a child profile online and then link it to the local parental control agent on the child’s devices, whether it’s a PC, Mac, Android, or iOS. Webroot’s system, by contrast, is strictly local to a single PC, with no support for macOS or mobile devices.
(Credit: Webroot/PCMag)
Webroot aims to keep your kids away from inappropriate websites and limit their online activities to appropriate times. You can configure it to affect all user accounts, but you’ll probably want to match settings to each child’s account. To start that journey, you create a profile for each child, selecting an age range: Kid (5-12), Teen (13-18), Adult. You can pick from a half-dozen near-identical silhouette icons, but you cannot personalize the profile by uploading a photo. If you have a lot of kids, you can kick-start configuring the next one by copying from an existing profile.
(Credit: Webroot/PCMag)
Webroot can block websites matching 16 categories, as listed on the profile’s Site Filters tab. It sets an initial collection of sites for blocking based on the age range you chose. Naturally, you can customize the selection of blocked categories.
On the Time Limits tab, you get a grid for defining when the child is allowed online each day of the week. Most competitors that use a similar system mark off the grid in hours. Some slice it down to half-hours. With Webroot, you allow or block access in four chunky multi-hour slices: Morning (6 a.m. to 12 p.m.), Afternoon (12 p.m. to 6 p.m.), Evening (6 p.m. to 9 p.m.), or Night (9 p.m. to 6 a.m.). I prefer the greater flexibility of an hourly grid.
(Credit: Webroot/PCMag)
With the simple configuration complete, I put Webroot to the test. And it failed miserably.
Initially, I demonstrated to myself that the parental control system correctly blocks access to naughty websites, even secure HTTPS sites. However, I had no trouble connecting through a secure anonymizing proxy, which completely foiled the content filter. For this very reason, most content filtering systems deny access to proxies.
All the best content filtering systems work at a level below the browser. To test whether Webroot does this, I launched a very simple off-brand browser, so off-brand that I wrote it myself. And the content filter did absolutely nothing. Any kid who’s savvy enough to install an unsupported browser can evade parental control.
(Credit: Webroot/PCMag)
But wait, it gets worse. Webroot relies on its browser extension to handle content filtering. Your child can simply disable the extension, since there’s no Admin privilege required. This parental control system has no teeth.
I verified that changing the system clock doesn’t fool Webroot’s time-limiting system. However, your child can ignore time limits in the same way by using an off-brand browser or disabling the browser extension.
The presence of parental control in Webroot Total Protection is a net negative. It doesn’t work. It takes up space that could be put to better use. And some parents won’t realize it doesn’t work (but you can bet their crafty kids will figure it out).
Verdict: Comprehensive Security Features of Varying Quality
With identity protection, hosted online backup, and parental control, Webroot Total Protection offers a truly broad collection of security features. Some are top-notch, but a few, like parental control, don’t measure up. If you want identity theft protection and a security suite for your devices in a single package, it’s worth spending more on one of our Editors’ Choice winners, Bitdefender Ultimate Security or Norton 360 With LifeLock. Both of these products excel in antivirus lab tests and provide comprehensive identity theft services.
Pros
View
More
Cons
View
More
The Bottom Line
Webroot Total Protection offers a broad range of competent security-related components, but some of them could use more work.
Like What You’re Reading?
This newsletter may contain advertising, deals, or affiliate links.
By clicking the button, you confirm you are 16+ and agree to our
Terms of Use and
Privacy Policy.
You may unsubscribe from the newsletters at any time.
About Neil J. Rubenking
Lead Analyst for Security
