Customers report they cannot reach your app. Chrome shows "Deceptive site ahead", corporate firewalls block your login page and antivirus calls it phishing.
Web apps and SaaS platforms are among the most commonly misclassified sites. Here is why, and what to do.
Key takeaways
- Apps are flagged because login screens and user-hosted content look like phishing to classifiers.
- Platforms hosting user content must also remove real abuse quickly, or flags will keep coming.
- Separate user content onto its own domain to protect your main app domain.
- Treat a phishing flag as an incident: communicate, fix, submit and monitor.
Why apps get flagged
Phishing classifiers focus on pages that ask for credentials. Apps are full of them:
- Minimal login screens with few other signals of a real business.
- Single sign-on buttons showing Google, Microsoft or other brand logos.
- Customer subdomains or white-label pages that look different from your main brand.
- User-uploaded pages, forms or files on your domain, which attackers can abuse.
- Frequent deployments and new subdomains with no reputation history.
Step 1: Treat it as an incident
Tell customers what is happening and offer a workaround if possible. Check VirusTotal, Google Search Console and phishing feeds such as PhishTank and OpenPhish to see exactly which URLs and vendors are involved.
Step 2: Check for real abuse
If your platform lets users create pages, forms or file links, check whether someone used it to host a real phishing page. Remove it, suspend the account and keep a record. Vendors will clear you much faster if you can show the abuse was removed promptly.
Platforms with user content should have a visible abuse reporting address and a fast takedown process. Vendors look for both.
Step 3: Strengthen your login pages
Add your brand, company name, footer links, privacy policy and a link to your main website. Make sure SSO buttons are clearly part of your branded page. Serve login on a stable, well-established domain or subdomain.
Step 4: Submit with context
Request a review in Search Console and submit to every other vendor. Explain what your product is, why the page asks for credentials, how many customers use it and, if relevant, what abuse you removed. Our false positive reporting guide lists vendor channels.
Step 5: Isolate user content
Large platforms host user content on a separate domain so that abuse cannot take down the main app. If customers can publish content, consider moving it off your primary domain. Then set up domain monitoring so new flags are caught before customers notice.
What about mobile apps?
If your Android app is flagged by Google Play Protect or an antivirus product, the process is similar: identify the detection name, then submit the app to the vendor for review. Many vendors use the same false positive channels for files and apps as for websites. See why antivirus flags clean websites.
Frequently asked questions
Will vendors whitelist my whole domain permanently?
Most vendors do not offer permanent whitelisting, but clearing listings and improving trust signals greatly reduces repeat flags.
Do enterprise customers' firewalls update automatically?
Yes, once vendors like Fortinet or Palo Alto Networks update their verdicts, firewalls update within hours to a day.
Should customer subdomains have their own domain?
If customers can publish content, a separate domain protects your main app from abuse on those subdomains.
How long does it take to clear a SaaS app?
Google is usually fastest. Expect three to seven days to clear all vendors when submitting in parallel.