A customer sends you a screenshot: "Phishing protection blocked this page." Or your own browser refuses to open your website. Sales stop, support tickets pile up and nobody can tell you why.
The good news: a phishing protection warning always comes from a specific product with its own review process. Once you know which one, you can get your website unflagged, usually within a few days.
Key takeaways
- "Phishing protection" is a feature of a browser or antivirus, and each one keeps its own list.
- The exact wording and look of the warning tell you which vendor flagged your site.
- Most phishing protection lists also feed on each other, so check every major vendor, not only the one a visitor reported.
- Fix or explain the page that triggered the flag before you request a review.
What a phishing protection warning actually is
Browsers and security products run a feature, often literally called phishing protection or web protection, that checks every page against a list of known phishing sites. When your domain or a URL on it is on that list, the visitor gets a full-page warning instead of your site.
The list is maintained by the vendor behind the product. It is not a judgement by the visitor's employer, their internet provider or a government. That is why the fix is always the same: get the vendor that owns the list to review and remove your listing.
Ask the visitor for a screenshot that shows the full warning, including the browser or product name. It saves hours of guessing.
Identify which tool is warning visitors
The wording usually gives the source away:
- Red "Deceptive site ahead" page in Chrome, Firefox or Safari: Google Safe Browsing.
- "This site has been reported as unsafe" in Microsoft Edge: Microsoft Defender SmartScreen.
- "Dangerous page blocked" or "Phishing attempt detected": Bitdefender web protection.
- Norton or Avast style "Threat blocked" page: Norton Safe Web and related engines.
- Kaspersky, ESET or Trend Micro block page: Kaspersky, ESET or Trend Micro.
- Company network block page naming a category such as "Phishing": a web filter such as Fortinet, Cisco Talos or Palo Alto.
Check every vendor, not only the one that was reported
Phishing listings travel. Feeds such as PhishTank, OpenPhish and Netcraft are read by dozens of security products, so one report can show up in many places within a day.
Scan your domain on VirusTotal and write down every vendor with a phishing or malicious verdict. This is your removal list. If you only clear the vendor your customer mentioned, the others will keep blocking you, and some may copy the listing back.
Find and fix what triggered the flag
Open the flagged URLs while logged out, on a phone and on a desktop. In our cases the trigger is almost always one of these:
- A hidden phishing kit uploaded after a hacked plugin, theme or password.
- A login, payment or account page that looks like a known brand or a phishing template.
- Logos of banks, payment providers or big brands used without context.
- A redirect or link to another domain that is itself flagged.
- A brand new domain with no company details, privacy policy or contact information.
If you find malicious files, remove them and close the way in first: update software, change every password and turn on two-factor authentication. Requesting a review while the kit is still there makes the next removal much harder.
Request a review with each vendor
Submit through each vendor's official false positive or site review channel. For Google, use Security Issues in Search Console. For Microsoft SmartScreen, use Microsoft's site report form and choose that you are the site owner reporting an incorrect warning. For antivirus and web filters, use the vendor's reclassification or false positive form.
Keep each request short and factual: your domain, the flagged URLs, what the site does, what you found and what you changed. Our evidence checklist and false positive template help you write it once and reuse it.
How long until the warning disappears
Google usually reviews phishing reports within a day. SmartScreen, antivirus vendors and web filters typically take one to five working days. After a vendor approves the removal, the warning can stay for a few hours while browsers and devices refresh their local lists.
Re-check VirusTotal every day and follow up with vendors that have not replied after three working days. See how long blacklist removal takes for typical timelines per vendor.
Stop it from happening again
Keep your software up to date, remove plugins you do not use and make it obvious who runs the site: company name, address, contact details and a privacy policy. Most importantly, find out about a new flag before your customers do. Daily domain monitoring checks your site against 90+ vendors and alerts you the moment one of them lists you.
Frequently asked questions
Can I just tell my visitors to ignore the warning?
No. Most people leave, and many company networks do not allow visitors to click through at all. Removing the listing is the only reliable fix.
The warning only shows in one browser. Is that normal?
Yes. Each browser and antivirus uses its own list. A site can be blocked in Edge and open fine in Chrome, or the other way around.
My site was never hacked. Why is it flagged?
Automated classifiers often flag clean login, checkout and account pages that resemble phishing templates. Explain what the page does and add clear company details when you request the review.
Will moving to a new domain solve it?
Rarely. A new domain has no reputation and is flagged more easily. Clearing the existing domain is usually faster and keeps your search rankings.