Google has labelled your website as harmful. Depending on the specific classification, visitors may see "Deceptive site ahead", "The site ahead contains harmful programs" or "This site may harm your computer".
Whatever the wording, the result is the same: traffic drops to near zero. This guide gives you a clear action plan.
Key takeaways
- Act the same day. Every hour the label is live costs visitors and trust.
- Check Search Console for the exact URLs and threat type before you start fixing anything.
- Clean the root cause first, then request a review. Doing it the other way round wastes time.
- Check VirusTotal and other vendors afterwards, because listings often spread.
Understand the label
Google uses several labels, each tied to a different threat type:
Harmful programs means Google found software downloads it considers unwanted or dangerous. Deceptive site means it detected social engineering, usually a phishing page. Malware means it found code that installs malicious software on visitors' devices. Hacked content means Google detected pages injected by an attacker.
The label in Search Console tells you exactly which type applies to your site and which URLs triggered it.
Step 1: Open Search Console
Log in to Google Search Console and navigate to Security & Manual Actions then Security Issues. This shows you:
The threat type, the number of affected pages and sample URLs. Note everything down before you start fixing. If you do not have Search Console access, verify your domain ownership first.
Step 2: Find and fix the cause
Work through the sample URLs one by one:
- For hacked content or phishing pages, check for unknown files, injected code, rogue admin accounts and database injections.
- For harmful downloads, identify which file is flagged and remove or replace it.
- For deceptive elements, look for misleading overlays, fake login forms or aggressive ad scripts.
- For malware, scan with a server-side scanner, not just a browser-based one, and check cron jobs and .htaccess files.
If you use WordPress, our guide on malware that keeps coming back covers the thorough cleanup that prevents reinfection.
Step 3: Request a review
Once every flagged URL is fixed, return to Search Console and click Request a Review. Write a short, specific explanation: what you found, what you changed and why the site is now safe. Vague requests get rejected. Our Google Safe Browsing false positive guide includes a proven template.
Step 4: Monitor for spread
Google is often the first vendor to flag a site, but not the last. Other vendors pick up the signal through shared threat feeds. Check your domain on VirusTotal and address any additional listings. Our security blacklists overview explains how to prioritise.
Step 5: Prevent a repeat
Update your CMS and plugins, enforce strong passwords, enable two-factor authentication and set up domain reputation monitoring so you learn about a new listing within hours, not weeks.
Frequently asked questions
How fast can the harmful label be removed?
Google typically processes reviews within one to three days. The label disappears from both search results and the browser within hours of approval.
What if my review is rejected?
Google will tell you which URLs are still problematic. Fix those specific pages and submit again, referencing the earlier request.
Is there a cost to request a review?
No. The Search Console review process is free.
Will I lose my search rankings?
Rankings usually recover after the label is removed, but it can take several weeks for traffic to fully return.