"Remove" and "delist" sound the same, but security blacklists do not all work like a simple list you can be taken off. Some review your whole site, some only a URL, some change your category and some expire on their own.
Knowing which type of blacklist you are on tells you what to ask for, what evidence to include and how long to wait. Use this page as a reference while you work through your list.
Key takeaways
- There are five main types of security blacklist, and each has its own delisting process.
- Browser blacklists hurt most and usually clear fastest. Start there.
- Web filters do not remove you, they reclassify you. Ask for a new category, not a removal.
- Threat feeds are copied by other vendors, so delisting there prevents the listing from coming back.
Step 1: Find every blacklist your website is on
Scan your domain on VirusTotal and write down every vendor that returns malicious, phishing or suspicious. Also check Google Search Console under Security Issues, and test the domain in Sucuri SiteCheck. Then group the vendors using the types below.
One vendor flagging you on VirusTotal is still worth fixing. Small vendors are often the source that larger ones copy.
Type 1: Browser blacklists
Google Safe Browsing, Microsoft SmartScreen and Yandex Safe Browsing power the red warnings in Chrome, Firefox, Safari and Edge. They review the whole site, so every flagged URL must be clean before you ask.
How to delist: request a review in Search Console (Google), the site owner report form (Microsoft) or Yandex Webmaster. Describe what you found and fixed. Typical time: one to three days.
Type 2: Antivirus web protection
Products such as Bitdefender, Kaspersky, ESET, Avira and Sophos block sites on their customers' devices. They usually work per URL or domain, and many rely on automated detection.
How to delist: use the vendor's false positive form, choose "website" or "URL" and include the exact flagged URL. Typical time: one to five working days. See our guides for Bitdefender, Kaspersky and ESET.
Type 3: Web filters and categorisation
Fortinet FortiGuard, Cisco Talos, Palo Alto, Webroot BrightCloud and Forcepoint do not keep a yes/no list. They give every domain a category, and company networks block categories such as Phishing, Malicious or Newly Registered.
How to delist: submit a recategorisation request and ask for the correct business category, for example "Business" or "Shopping". Asking to be "removed" often gets no response. Typical time: one to three working days.
Type 4: Threat intelligence feeds
PhishTank, OpenPhish, URLhaus, Netcraft and CRDF publish lists that dozens of other products download. A listing here explains why you suddenly appear on many vendors at once.
How to delist: each feed has a dispute or report option. Point to the specific URL, show it is clean now and ask for the entry to be marked as offline or false. Typical time: a few hours to a few days. Some feeds expire entries automatically once the URL stops responding with the flagged content.
Clear the feeds early. If you only clear the products that copy them, the next feed update can list you again.
Type 5: DNS and reputation blocklists
Lists such as Spamhaus and SURBL are used mostly by email filters and DNS security services. A listing here sends your emails to spam and can block links to your website in messages.
How to delist: use the list's lookup and removal page, fix the cause (often a compromised mailbox or form abused for spam) and request removal. Read the difference between domain and email blacklists before you start.
What every delisting request should include
Whatever the type, the requests that get approved fastest contain the same things:
- Your domain and the exact flagged URLs.
- What the website does and who runs it, with company details.
- What you found (or that nothing malicious was found) and what you changed.
- Proof of ownership if the vendor asks for it, such as a Search Console verification.
- A polite, short tone. Long, angry messages are slower to process.
After delisting: confirm and keep watching
Re-scan on VirusTotal daily until every vendor is clear, and follow up with any vendor that has not responded within three working days. Then set up domain monitoring so a new listing is caught and removed before customers notice. Read how to stop your site getting blacklisted again for prevention tips.
Frequently asked questions
Is there one form that removes my website from every security blacklist?
No. Every vendor runs its own list and review process. That is why removal services submit to each vendor separately, in parallel.
Do blacklists delete old entries automatically?
Some threat feeds expire entries after a while, but browser lists, antivirus vendors and web filters usually keep a listing until someone requests a review.
Can a vendor refuse to delist my website?
Yes, if they still see the problem. Check the exact URL they flagged, fix it and resubmit with a clear explanation of what you changed.
How much does it cost to delist a website?
Submitting requests to vendors is free. You pay for a service like ours when you want a team to find every listing, write the requests and follow up until each vendor clears you.