If Chrome, Firefox or Safari is showing visitors a red “Deceptive site ahead” page, that warning is coming from Google Safe Browsing, not from your host or your browser. Google has found something on your site it considers harmful, and the warning will stay until you clean the site and ask Google to look again. Both steps are needed, in that order.
It is a horrible thing to see on your own business. The warning covers your whole site, it appears in every major browser, and it does not care how long you have been trading. The good news is that it is a process with a defined end, and the timescale is days rather than weeks.
What Google is actually telling you
Safe Browsing flags two broad things: malware, and social engineering. Malware means code on your site that attacks visitors. Social engineering means content designed to trick them, usually an injected phishing page pretending to be a bank, a delivery company or a login screen.
Either way, the finding is about content being served from your domain. It is rarely a false positive and it is almost never something you can argue with. Something got in.
Find out what Google found
Go to Search Console and open Security & Manual Actions → Security Issues. Google lists the problem it detected and, importantly, gives you example URLs. Those examples are the fastest route to the infection, because they tell you which files or pages to look at first.
If you do not have Search Console set up for the domain, set it up now. It is free, it takes a few minutes with a DNS record, and it is the only place Google will tell you what it found and the only place you can ask for the warning to be lifted.
Clean the site before you request anything
This is the step people skip, and skipping it costs days. A review that fails because the site is still infected does not reset instantly, and repeated failed reviews do you no favours.
A proper clean means finding and removing the malicious code, finding how it got in, and closing that route. Typically that involves:
- Comparing WordPress core, theme and plugin files against known-good copies, so injected code has nowhere to hide
- Checking the places that are easy to miss:
.htaccess,wp-config.php, themu-pluginsfolder, and the uploads directory, which should contain no PHP at all - Looking at scheduled tasks, because a cron job that reinfects the site nightly will undo everything you just did
- Removing administrator accounts you did not create, and rotating every password and the security keys in
wp-config.php - Updating whatever was out of date, since an unpatched plugin is the usual way in
Then, and only then, ask for the review.
Requesting the review
In Search Console, on the same Security Issues screen, there is a Request Review button. You will be asked to describe what you did. Be specific and factual: what you found, what you removed, what you updated, and how you closed the entry point. A vague “I cleaned it” is weaker than a short list of actual actions.
Google says most malware and social engineering reviews complete within about 72 hours. In practice it is often faster, but plan around a few days rather than a few minutes.
What not to do
Do not simply restore an old backup and assume you are finished. If the backup predates the compromise you may have removed the malicious code, but you have also restored the vulnerability that let it in, and you will often be reinfected within days. If the backup postdates it, you have restored the infection too.
Do not delete the affected pages and hope the warning lifts on its own. It will not. The review has to be requested.
Do not leave the site live and untouched while you decide what to do. Every hour a compromised site stays up is more damage to your search rankings, your sender reputation and your customers’ trust.
Common questions
Will this hurt my search rankings?
Yes, while it lasts. Traffic drops sharply because most people will not click past the warning, and Google may drop affected pages from the index. Sites that are cleaned and reviewed promptly generally recover; sites left flagged for weeks take considerably longer to come back.
The warning has gone but my site still looks odd. Am I clear?
Not necessarily. Safe Browsing lifting the warning means Google no longer detects the specific thing it flagged. It is not a certificate that your site is clean. If you never found the entry point, assume it is still open. It is worth checking for administrator accounts you did not create at the same time.
My host says the site is fine. Why is Google still warning?
Hosts and Google look for different things, and host scanners vary enormously in quality. Trust the example URLs in Search Console over a general “no issues found” from a scanner.
How long does the whole thing take?
A straightforward clean is a few hours of work. The review is up to about 72 hours on top. Most sites are clear within two to three days of somebody actually starting.
If you would rather not do this yourself
Hacked site rescue is a fixed £200, and if I cannot solve it you do not pay. That covers finding the infection, cleaning it, closing the way in, and hardening the site afterwards. I will also handle the Search Console review request and tell you what to expect.
If you are not sure whether what you are seeing is a compromise at all, tell me what is happening and I will tell you, whether or not you hire me for the fix.