For months now, when building websites for clients, I've come across virtually trillions of "Site Security Scanners" supposedly endorsed/approved by various shared web hosts who claim to run XSS, SQL injections, spam measures, and other checks, all for around $300 upwards if you want the plans that do more than one scan a year.
I'm not talking about PCI compliance scans like those offered by Comodo, McAfee, Symantec and the like, which normally cost thousands per year, but rather these vendors seem to be playing off the fear of less technical business owners by offering an affordable alternative to the PCI fims.
Although I could mention a few companies, I know of too many to list, so my main question is: Are these "affordable" scans a good alternative to a PCI scanner if you don't do eCommerce. What about if you're on a shared/managed plan -- shouldn't the host handle this?
As for sites with eCommerce, since some merchants processors mandate their own PCI vendors, or even cover the cost of PCI scans, is it necessary to have an additional scan happening?
Thank you very much to everyone for any insights as this has been on my mind for ages.