You open your own website in Chrome and see a full red page: "Deceptive site ahead" or "The site ahead contains malware". Or a customer sends you a screenshot. Either way, your site is effectively offline for most visitors.
Here is what to do, starting right now.
Key takeaways
- The red warning comes from Google Safe Browsing, used by Chrome, Firefox, Safari and more.
- It can mean phishing, malware, unwanted software or hacked content.
- Request removal through Google Search Console after fixing the cause.
- Check other vendors too, because the listing often spreads.
What the red warning means
The warning is triggered by Google Safe Browsing, a service that protects more than four billion devices. It classifies threats into categories:
- Deceptive site ahead: phishing or social engineering detected.
- The site ahead contains malware: code that installs malicious software.
- The site ahead contains harmful programs: unwanted software downloads.
- Suspicious site: a softer warning for lower-confidence detections.
The specific wording tells you which type of problem Google found. This determines where to look and what to write in your review request.
What to do in the first hour
Speed matters. Every hour the warning is live, you lose visitors and trust. In the first hour:
- Confirm the warning by visiting your site in Chrome Incognito and another browser.
- Open Google Search Console, navigate to Security Issues and read the details.
- Note the exact threat type, the number of affected pages and the sample URLs.
- If you run paid campaigns, pause them immediately to avoid paying for traffic that bounces.
- Let your team know so they can respond to customer questions.
Fix the root cause
If the warning is caused by a real compromise, clean it thoroughly before requesting a review. A review on a site that still has malicious content will be rejected, and rejected reviews can delay the next attempt.
If the site is clean and you believe it is a false positive, document why. Typical false positive triggers include login pages, brand elements on partner sites, aggressive ad scripts and downloads that fail heuristic checks.
Our article on what to do when Google labels your site as harmful covers both scenarios in detail.
Request a review
In Search Console, click Request a Review under Security Issues. Write a specific, honest explanation:
If it was a compromise: describe what was found, what was removed and what you changed to prevent a repeat. If it is a false positive: describe what the flagged page does and why it is not a threat.
Google processes phishing reviews in about a day and malware reviews in a few days. Our Google Safe Browsing guide includes a proven request template.
Check for spread to other vendors
Google is often the first to flag a site, but other vendors follow. Check your domain on VirusTotal to see the full picture. Common vendors that pick up Google's signal include Bitdefender, Kaspersky and various threat feeds. Each needs its own removal request.
Our blacklist removal checklist explains how to work through multiple vendors efficiently.
Prevent the next red screen
After the warning is removed, invest in prevention: update your CMS and plugins, enforce two-factor authentication, set up domain monitoring and remove unnecessary third-party scripts. A repeat warning is harder to clear and more damaging to your reputation.
Frequently asked questions
Can I just wait for the warning to go away?
No. Google does not automatically recheck sites. The warning stays until you fix the cause and request a review through Search Console.
What if I cannot access Search Console?
You need to verify domain ownership first. Google supports several verification methods including DNS records and HTML file uploads.
Will the warning affect my SEO?
Indirectly, yes. The bounce rate spikes, click-through rates drop and engagement signals collapse. Rankings usually recover after the warning is removed.
How do I know if it is a hack or a false positive?
Check Search Console for sample URLs and inspect your site for unknown files, injected code, rogue users and unexpected redirects. Our guide on checking whether your site is hacked walks through the diagnosis.