A customer emails you a screenshot: a red warning saying your site is dangerous. Your heart sinks. Are you hacked? Is it a mistake? Are other customers seeing the same thing?
Take a breath. This guide helps you diagnose the situation in minutes and take the right action, whether it is a real compromise or a false alarm.
Key takeaways
- Not every danger warning means your site was hacked. False positives are common.
- Check VirusTotal, Google Search Console and your hosting scanner first.
- If you were hacked, clean up before requesting removal. If it is a false positive, skip straight to the vendor dispute.
- Respond to customers openly. Silence costs more trust than the warning itself.
Step 1: Reproduce the warning
Ask the customer which browser or security product showed the warning, then try to see it yourself. Open your site in Chrome, Firefox and Safari. If the warning appears in a browser, it almost certainly comes from Google Safe Browsing. If it appears in an antivirus popup, check which product the customer uses.
If you cannot reproduce it, the warning may only appear behind a corporate firewall or in a specific region. That narrows the source to a web filter or a lesser-known vendor.
Step 2: Check VirusTotal
Search your domain on VirusTotal. Its report shows the verdicts of 90+ security engines. Note which vendors flag you and which labels they use: phishing, malware, suspicious or spam. This tells you what kind of threat the vendor thinks it found.
Our guide on how VirusTotal works explains how to read the report in detail.
Step 3: Look for signs of a hack
Log in to your hosting panel and your CMS and check for:
- Unknown admin users or users with changed roles.
- Recently modified files, especially in theme folders, plugin directories or uploads.
- Unexpected redirects when visiting the site from a search engine.
- New pages or posts you did not create, often hidden phishing forms.
- JavaScript injected into headers, footers or widget areas.
- Unfamiliar cron jobs or scheduled tasks.
If you find any of these, your site was compromised. Clean it up fully before requesting blacklist removal. Our article on WordPress reinfection covers the thorough cleanup process.
Step 4: If it is a false positive
If your site is clean and you find no signs of compromise, you are dealing with a false positive. This is more common than most people expect. Login forms, brand names, certain scripts and even new domains can trigger automated detections.
Skip straight to requesting removal from the vendor that flagged you. Our false positive reporting guide shows how to write a request that gets approved.
Step 5: Communicate with your customers
Do not wait until the warning is gone. Let affected customers know you are aware of the issue, explain what happened in plain language and offer an alternative way to reach you if needed. Transparency builds trust; silence erodes it.
Pause any paid campaigns that point to the flagged pages so you do not pay for traffic that bounces on a warning screen.
Frequently asked questions
Can one customer see a warning while another does not?
Yes. Warnings depend on the browser, antivirus product and network filter each person uses. A listing on one vendor does not mean every visitor is affected.
Is a single customer complaint worth investigating?
Always. One complaint usually means many more people saw the warning but did not tell you.
How long until the warning disappears after I fix it?
It depends on the vendor. Google Safe Browsing reviews take one to three days. Other vendors range from a few days to two weeks.
Should I take my site offline while I investigate?
Only if you confirm an active compromise and the site is distributing malware. For false positives, keep the site live and work on the removal.