Google Dangerous Site Warning: How to Get Off the Blocklist

If Chrome shows a red "Dangerous site" page in front of your website, or Google adds "This site may be hacked" under your listing, Google has found harmful or hacked content on the site. The warning does not expire on its own. You remove it by cleaning the whole site, closing the hole the attacker used, and then asking Google for a review in Search Console. Google says a clean site has its browser and search warnings removed within 72 hours of a successful review.

This article is for business owners whose site has just been flagged, or whose customers say their browser blocked it. It explains what each warning means, what it costs you each day it stays up, what has to be fixed before you ask for a review, how the review works and how long it takes, and how to deal with Bing, Microsoft Edge and a hosting suspension at the same time.

#Which warning are you seeing

Each warning comes from a different system, and the system decides where you go to remove it. Start by matching what you or your customers see to this table.

Chrome's help page on warnings about unsafe sites (opens in a new tab) lists phishing, malware, unwanted software and social engineering as the reasons for the red "Dangerous site" page, and tells site owners to fix the problem and request a review. Google's help pages for the "This site may be hacked" (opens in a new tab) and "This site may harm your computer" (opens in a new tab) labels say the same thing: the label stays until the owner acts.

#Where the warning comes from

Most of these warnings come from Google Safe Browsing, a list of unsafe sites that many products check before they load a page. According to Google Safe Browsing (opens in a new tab), it protects over five billion devices every day and is used in Chrome and other browsers, Google Search, Gmail, Android and Google Ads.

That is why one flag hurts in so many places at once. The same entry can block your site in a customer's browser, put a label on your search listing, warn people who click a link in an email, and affect your ads.

The owner's side of the system is the Security issues report (opens in a new tab) in Google Search Console. It groups problems into three families:

• Hacked content: pages or code placed on your site without permission, such as injected scripts, spam pages or hidden links.
• Malware and unwanted software: software that harms visitors' devices, including files your site offers for download.
• Social engineering: content that tricks visitors into doing something dangerous, such as typing a password into a fake login or running a command.

The fake "verify you are human" pop-up falls in the last two families at once. It is injected code that tricks your visitors into running malware, and my article on the fake Cloudflare verify you are human pop-up explains how it works.

#What the warning costs a business

A red browser warning stops almost all visitors at the door, and the cost grows each day it stays up. Every channel that sends people to your site is affected at the same time.

• Search traffic: people who do click through from a labelled result meet the red page next.
• Paid traffic: every paid click lands on a page the browser blocks, so ad spend is wasted until the site is clean.
• Email and social links: the warning appears whichever way someone arrives, including links you sent in a newsletter.
• Trust: customers who saw a warning remember it, and some will tell you only after they have bought elsewhere.
• Customers' own devices: if the hack was a fake captcha or a malicious download, real people may have been infected through your site.

If your hosting company has also suspended the site, you lose everything at once: no site, and sometimes no business email on the same server.

#What has to be fixed before you ask for a review

Google reviews the whole site, so the whole site must be clean before you ask. The Security issues report says to fix the issue throughout the site and all issues listed in the report, and warns that "fixing the issue on just some pages will not earn you a partial return to search results."

A proper fix covers more than removing what Google listed. The sample URLs in the report are examples, not a complete list.

1. Remove every piece of injected code, including hidden plugins, changed theme files, spam pages and anything in the database.
2. Remove every back door, such as rogue admin accounts or code that recreates the malware after it is deleted.
3. Close the entry point, whether that was a stolen password, an outdated plugin or a pirated theme. Google's help pages say that if you do not, the site may be infected again.
4. Reset all access: hosting, admin, database and email passwords, and end every active login session.
5. Clear every cache, so visitors and Google's crawler get the clean version, not a stored copy with the old script.
6. Make sure Google can crawl the pages. The request a review guide on web.dev (opens in a new tab) says the pages should not be blocked by robots rules or noindex.
7. Check from the outside, the way a new visitor and Google see the site, not only while logged in.

My hacked WordPress site cleanup guide explains what a full cleanup includes stage by stage, and why half-cleanups get reinfected.

#How the Google review works

The review is a short written request in Search Console that tells Google what was wrong and what you changed. You need the site verified in Search Console first, which also gives you Google's messages about security problems in future.

The request should be specific. Google's guidance is to describe the exact issue, the steps taken to fix it and the outcome. A good request reads like a short report: what was injected and where, what was removed, which software was updated or replaced, which passwords were reset, and how the attacker got in and how that was closed.

#How long it takes

Google's published review times depend on the type of problem. These figures come from the web.dev guide and the Security issues report.

Phishing review time (Google)

About 1 day

Malware review time (Google)

A few days

Warnings removed after a passed review (Google)

72 hours

#Mistakes that slow it down

Three mistakes add weeks to the process.

• Asking too early. Google says a request made before the issue is fixed can cause longer turnaround time, and repeated failed requests can get a site treated as a repeat offender.
• Asking twice. Google asks owners not to resubmit while a request is still pending.
• Leaving pages uncrawlable. If Google cannot reach the pages, it cannot confirm they are clean.

#Bing, Microsoft Edge and other blocklists

Google is not the only list, and clearing Google does not clear the others. Bing and Microsoft Edge run their own checks, and security vendors keep lists of their own.

Microsoft Edge. Edge uses Microsoft Defender SmartScreen. Microsoft's article on unexpected block warnings in Edge (opens in a new tab) says SmartScreen weighs URL reputation, page content, file downloads, certificate validity, user reports and script behaviour. A site owner reports a fixed or wrongly blocked site through the "Report that this site doesn't contain threats" link on the block page, then waits for an email from Microsoft's reputation team.

Bing. Bing Webmaster Tools has a malware section where you can ask for a re-evaluation. When Bing announced its malware re-evaluation tool (opens in a new tab), it said it runs several fresh scans before giving the all clear, and that if malware is still found the request fails and you cannot submit another for some time. The rule is the same as with Google: clean first, ask once.

Antivirus and security vendors. Some customers see a block from their own antivirus rather than the browser. Each vendor runs its own list, so once the site is clean, the customer's vendor may need a separate request to recheck it.

#When your hosting company suspends the site

A hosting suspension is the host protecting its other customers, and it is usually lifted once you show the site is clean. Hosts often find malware through their own scans or because the site started sending spam.

Ask the host three things straight away: what exactly they found and where, whether other sites on the same account are affected, and what they need from you to lift the suspension. Also ask whether the cleanup can be done while the site stays hidden from the public.

If the same account holds several websites, all of them need checking. An infected neighbour reinfects a clean site, and a host will not lift a suspension for long if the problem keeps returning. If your hosting is cheap, crowded or slow to respond, a better setup is part of the fix, and my hosting, domain and email setup service covers moving to one.

#Do it yourself or hire help?

You can handle the review request yourself. The cleanup before it is the hard part, and it decides whether the warning comes back.

When I handle a flagged site through my hacked site repair and malware removal service, the review request is part of the job, and I write it from the cleanup report so Google gets a specific account of what changed. Access is given safely, with a separate account you can remove afterwards, never your own password sent over chat. If you are weighing up quotes, my guide to what malware removal costs and what it should include explains what separates a full job from a quick scan.

#How to avoid a repeat warning

A repeat warning is usually the same attacker coming back through the same door. Prevention is a small routine, done reliably.

• Keep everything updated: the CMS, plugins, themes and the server's PHP version. Remove anything you do not use.
• Protect every login: long unique passwords, two-step login for admins, one account per person, and old accounts removed.
• Keep backups away from the site and test that one can be restored.
• Keep Search Console verified and make sure its emails reach someone who reads them. Google tells verified owners about security problems.
• Watch for change: new admin users, new plugins and changed files are early warnings.
• Check custom code too. If your business runs a custom app or portal, my web application security checklist covers what to ask your developer.

My article on WordPress website security for business owners explains the four basics behind this list, and a website maintenance and support plan is how most businesses make sure someone actually does them every month.

#Where to start

Open Search Console today and look at the Security issues report. If the site is not verified, verify it first, because that is where the review request lives.

Then be honest about the cleanup. If you know exactly what was injected and how the attacker got in, fix it, check from the outside and request the review once. If you do not, get the site cleaned properly first. A single, well-written request after a full cleanup is the fastest way off the blocklist. If you want a first look at a flagged site, you can send me the details.