The URL is sent to the Google Safe Browsing API through our function, which does not store it and caches the answer for one hour. Google may log it under its privacy policy.
Reasons
What to do
- Find the cause: check the “Security & manual actions” section in Search Console, which says which URLs and what kind of problem Google has seen.
- Clean the site: change every password (admin, FTP, database), update the CMS and its extensions, remove the injected files and restore from a clean backup if there is one.
- Close the door: find out how they got in (an outdated plugin, a leaked password, an upload form) and fix it, or they will be back within days.
- Request a review from Search Console. Google recrawls the site and, if it is clean, removes the warning. It usually takes one to three days; sometimes a week.
The automatic check is not enabled on this deployment. You can run the same query by hand on Google’s transparency report:
Next step
Shall we fix it for you?
This cannot wait: every hour behind Google’s warning is traffic that does not come back. Send us the result and we tell you today what needs cleaning and how to request the review.
Opens the form with the diagnosis already written. You can edit it before sending.
How to use it
01
Type the URL
The home page or a specific page. Google flags individual pages and whole domains alike.
02
Read the verdict
Clean or flagged, and if flagged, why: malware, phishing, unwanted software or harmful application.
03
If flagged, follow the guide
Clean up, close the door and request a review in Search Console. The warning goes when Google confirms the site is clean.
What is Safe Browsing?
A list Google maintains with the addresses that distribute malware, run phishing or trick people into installing software. Chrome, Firefox, Safari, Android and a good share of antivirus products query it: when a URL goes in, billions of devices show a warning before opening it.
A legitimate site ends up on it almost always for the same reason: it got hacked. An outdated CMS extension, a reused password or an unchecked upload form, and someone drops phishing pages in a folder nobody looks at.
How to get off the list
- Find the cause: check the “Security & manual actions” section in Search Console, which says which URLs and what kind of problem Google has seen.
- Clean the site: change every password (admin, FTP, database), update the CMS and its extensions, remove the injected files and restore from a clean backup if there is one.
- Close the door: find out how they got in (an outdated plugin, a leaked password, an upload form) and fix it, or they will be back within days.
- Request a review from Search Console. Google recrawls the site and, if it is clean, removes the warning. It usually takes one to three days; sometimes a week.
Cleaning up is half the job
Deleting the injected files removes the warning. Not closing the door they came through brings it back in two weeks, with the review rejected and traffic on the floor again.
On the sites we maintain, support covers what keeps you from getting here: updates, backups that get tested, security headers and an alert when something changes without anyone asking. And when the damage is done, the clean-up with the breach closed and the review request.
Frequently asked questions
Why is my site flagged as dangerous when I did nothing?
Because it is almost never the owner. Usually the site was hacked through an outdated extension or a weak password, and someone uploaded phishing pages or injected code that redirects to other sites. Google detects it while crawling and flags the domain to protect visitors. The fix is cleaning up and requesting a review, not arguing with the warning.
How long until the warning goes away?
After requesting a review in Search Console, one to three days in most cases, and up to a week in the rest. If Google finds the problem again, the review is rejected and you start over, so clean thoroughly before asking. Repeats stretch the timelines.
Does it affect rankings?
A lot, in two ways. While the warning is active most people turn back on seeing it, so traffic drops even though the site still appears in results. And Google may add a manual action or drop pages from the index if the problem persists. After cleaning, traffic recovers in weeks, not days.
Does it check every page on the site?
It checks the URL you type. Safe Browsing can flag a whole domain or specific paths only, so if you suspect one section, check it separately. To see everything Google has found on your site, the complete source is Search Console.
Is this the same as Chrome’s red screen?
Yes. That screen — “The site ahead contains malware” or “Deceptive site ahead” — is what Chrome shows when the URL is on this list. Firefox, Safari, Android and many antivirus products use the same source, so the warning appears in almost every browser at once.
Is the URL I check stored?
Not by us. The URL travels to our function on Cloudflare and from there to the Google Safe Browsing API; our function caches the answer for one hour to avoid repeating the query and logs nothing. Google receives the URL and may handle it under its privacy policy, as with any of its services.
Background reading
Explained on the blog
What to do if Google flags your site as dangerous
Why Chrome's red screen appears over a website, what is usually behind it, how to clean the site properly and how to ask Google to lift the warning.
What is a vulnerability, and why does your website need maintenance?
What a software vulnerability is, why small websites are exposed too, what happens between the day a flaw is published and the day someone exploits it, and what keeping a site up to date actually involves.
Has your site been flagged?
Every day with the warning is traffic that does not come back. We clean up, close the breach and request the review, then leave the site so it does not happen again.
We reply within one business dayBogotá · UTC−5