Visitors to your site are stopped by a full red screen: "Deceptive site ahead. Attackers on this site may trick you into doing something dangerous like installing software or revealing your personal information."
This is Google Safe Browsing's phishing warning. It is shown in Chrome, Firefox, Safari and many other apps. Here is how to deal with it.
Key takeaways
- "Deceptive site ahead" is Google Safe Browsing's social engineering (phishing) category.
- It is usually triggered by a specific page: a login form, a fake download button or a hidden phishing kit.
- Search Console shows sample URLs and is the only reliable way to request a review.
- Phishing reviews are typically completed within about a day.
What "deceptive" means to Google
Google uses the deceptive label for social engineering: content that tricks visitors into doing something harmful. That includes:
- Phishing pages that imitate banks, email providers or other brands to steal logins.
- Fake download buttons or misleading "update your browser" prompts.
- Pages that pretend to be from a government, payment provider or tech support.
- Deceptive ads or pop-ups embedded through third-party ad networks.
Why legitimate sites receive it
There are two common scenarios. In the first, attackers compromised your site and uploaded a phishing kit, often in a hidden folder you never visit. In the second, a legitimate page, such as your own customer login, a payment step or a page showing partner logos, looks enough like phishing for the automated classifier to flag it. Our article on why clean websites get phishing warnings goes into detail.
How to find the offending page
Work through these steps:
- Open Google Search Console and go to Security Issues. Note the sample URLs listed under social engineering.
- Visit each sample URL from a different device and check what it shows.
- Search your server for recently added folders, HTML files that imitate other brands and unfamiliar index files.
- Review ad networks, pop-up scripts and download buttons on the flagged pages.
Sample URLs are examples, not a complete list. Check the rest of your site for similar content before requesting a review.
Requesting the review
Remove or fix every deceptive element, then click Request a Review in Search Console. Explain clearly what you found and changed, or, for a false positive, what the page does and why it is legitimate. Our guides to Google Safe Browsing false positives and the Chrome red warning include example wording.
After the warning is lifted
Google typically completes phishing reviews in about a day. Once the warning is gone, check VirusTotal and phishing feeds such as PhishTank, OpenPhish and Netcraft, because phishing listings often spread. Our article on websites marked as phishing covers those vendors.
Frequently asked questions
Is "Deceptive site ahead" the same as a malware warning?
No. Deceptive means phishing or social engineering. Malware warnings say "The site ahead contains malware" and have a different cause.
Can I bypass the warning for my visitors?
Visitors can click through via Details, but almost none do. The only real fix is a Google review.
What if Google rejects my review?
Check the sample URLs again; something is usually still live. Fix it and request another review.
Will the warning affect my Google Ads?
Yes. Ads pointing to a flagged domain are typically disapproved until the warning is removed.