Reporting a false positive sounds simple: tell the vendor they made a mistake. In practice, many reports are rejected, ignored or answered with a template asking for more information.
After handling thousands of these requests, we know what vendors look for. Here is how to report a false positive that gets approved.
Key takeaways
- Always use the vendor's official false positive channel.
- Include the exact URL, the detection name, a business description and proof that the site is clean.
- Keep the report short, factual and polite.
- Follow up once after a week if you hear nothing, quoting your ticket number.
Find the right channel
Every vendor has its own process: a web form, a dedicated email address or a customer portal. Sending your request to a general support address or social media account usually leads nowhere. Our guide to reporting false positives to security vendors and the vendor directory list the correct channels.
What to include in your report
A complete report contains:
- The exact URL or domain that is flagged, written out in full.
- The detection name or category, for example "Phishing" or "Malicious".
- Where you saw the detection, such as VirusTotal or a product warning.
- A one-paragraph description of your business and what the page does.
- Proof that the site is clean: recent scan results or an explanation of your cleanup.
- Your contact details, preferably from an email address on the same domain.
Sending from an email address on the flagged domain shows that you are the legitimate owner, which speeds up many reviews.
A simple template
"Hello, our domain example.com is detected as Phishing by your engine, as shown on VirusTotal. Example Ltd is a registered accounting firm, and the flagged page is our customer login portal. We have scanned the site and found no malicious content. Could you please review and remove the detection? Thank you."
Adapt the template to each vendor, keep it in English unless the vendor asks otherwise and attach evidence where the form allows it.
Common mistakes that get reports rejected
Avoid these pitfalls:
- Submitting before the site is actually clean.
- Leaving out the exact URL or using a shortened link.
- Sending angry or threatening messages.
- Submitting the same request many times, which creates duplicate tickets.
- Asking one vendor to fix a listing that belongs to another.
Following up
Note the date and ticket number of every report. If there is no reply after five to seven working days, send one polite follow-up on the same ticket. After approval, rescan on VirusTotal or in the vendor's product to confirm the change. Our evidence checklist helps you prepare a follow-up quickly.
Frequently asked questions
Is reporting a false positive free?
Yes. Reputable vendors do not charge for reviewing false positives.
How long until a vendor responds?
Usually between one day and two weeks, depending on the vendor and the quality of the request.
What if the vendor rejects my report?
Ask what triggered the detection, fix that specific issue and submit again, referencing the earlier ticket.
Can someone report a false positive on my behalf?
Yes. Vendors accept reports from agencies and specialists acting for the site owner, which is how we handle cases for our clients.