Your sales dashboard suddenly flatlines. Customers email to say their browser calls your shop dangerous, or their antivirus blocks the checkout. For an online store, this is a revenue emergency.
This guide is written for shop owners. It tells you what to do right now, how to find out whether you were hacked and how to get your store back in front of customers.
Key takeaways
- Checkout pages and payment forms are frequent false positive triggers for phishing filters.
- Pause paid ads immediately so you do not pay for traffic that hits a warning screen.
- Card-skimming scripts (Magecart) are a common real cause on Magento, WooCommerce and PrestaShop.
- Request removal from every vendor in parallel to shorten downtime.
The first hour: stop the bleeding
Before you investigate, limit the financial damage:
- Pause paid campaigns on Google Ads, Meta and marketplaces that send traffic to the flagged domain.
- Check the warning yourself in Chrome, Firefox and Safari, and note the exact wording.
- Look up your domain on VirusTotal to see which security vendors flag it.
- Open Google Search Console and check Security Issues for sample URLs.
- Tell customer service what is happening so they can reassure buyers and take orders by phone or email if needed.
Do not switch to a new domain. It has no reputation, loses your SEO and is often flagged even faster.
Why online stores get flagged
Webshops have more of the patterns security filters look for than ordinary websites:
- Checkout and login pages that resemble phishing kits, especially if they load payment fields from a third party.
- Card-skimming scripts injected into the checkout by attackers, often through an outdated plugin or extension.
- Redirect chains from tracking, affiliate or payment links.
- Many third-party scripts: reviews, chat, analytics and ads, any of which can be compromised.
- A new domain or new store without reputation history.
Check for a card skimmer
Card skimming is the most damaging real cause, because it also means customer data may be at risk. Check your checkout page source for unfamiliar scripts, look for recently modified theme or extension files and compare your installed plugins against the official versions. If you find a skimmer, involve your payment provider and follow your data-breach obligations before requesting blacklist removal.
Our article on WordPress malware that keeps coming back covers a thorough cleanup for WooCommerce stores.
The first day: request removal
Once the store is clean, file removal requests with every vendor that flags you, in parallel:
- Google Safe Browsing via Search Console, which clears the Chrome, Firefox and Safari warning.
- Antivirus vendors such as Bitdefender, Kaspersky and ESET.
- Web filters such as Fortinet if business buyers cannot reach you.
- Threat feeds visible on VirusTotal such as CRDF and alphaMountain.ai.
Our removal timelines article shows how long each vendor typically takes.
The first week: recover sales and trust
As listings clear, resume ad campaigns one at a time and check that each is approved. Ask your payment provider to confirm your account is in good standing. Send a short, honest message to customers who abandoned carts during the outage. Then set up domain monitoring so a future listing is caught within hours.
Frequently asked questions
Will my payment provider suspend my account?
Some providers run their own checks and may pause payouts while your domain is flagged. Contact them early and share evidence that you are resolving the issue.
Do marketplace listings (Amazon, eBay) get affected?
Your marketplace listings themselves are usually fine, but links from those platforms to your own store can be blocked or removed.
How fast can a store be unblocked?
Google Safe Browsing typically clears in one to three days. Clearing every vendor usually takes one to two weeks when requests are filed in parallel.
Can a Shopify store be blacklisted?
Yes. The platform itself is secure, but apps, custom scripts, redirects or a phishing-like checkout customisation can still trigger detections on your domain.