You open your website and see a warning that it is a phishing site, or a customer tells you their antivirus blocked it. You are not stealing anyone's password, so how did this happen?
Phishing detections are among the most common false positives we handle. Below is the same six-step plan we use for our clients.
Key takeaways
- Phishing flags usually come from automated systems that pattern-match login forms or brand names.
- Find out exactly which services flag you before you do anything else.
- Check for a hidden phishing kit: compromised sites are a common cause.
- Submit evidence-backed requests to each service and monitor afterwards.
Why legitimate sites get marked as phishing
Phishing filters look for signals that resemble phishing kits. Legitimate sites often share those signals: a login page, a payment form, the logo of a well-known brand you work with, a newly registered domain or links that redirect through tracking services.
A second common cause is a real compromise: attackers upload a phishing kit to a forgotten folder of a legitimate site, use it for a few days and leave. The site owner never notices, but the listing remains.
The six-step removal plan
Work through these steps in order:
- Identify who flags you. Check Chrome, your VirusTotal report and any antivirus warnings your customers mention.
- Scan for phishing kits. Look for unknown folders, recently changed files and pages that imitate banks or webmail.
- Remove the cause. Delete malicious files, update your CMS and change all passwords.
- Document the fix. Take screenshots, keep clean scan results and write a short description of your business.
- Request reviews. Use Google Search Console for Safe Browsing and each vendor's own process for the others.
- Monitor. Recheck daily until every flag is gone, and keep monitoring for repeat listings.
Requesting a review before the cause is removed will usually lead to rejection, and some vendors take longer to review a repeat request.
Which services you may need to contact
Phishing verdicts are often shared between services. Typical sources include Google Safe Browsing, PhishTank, OpenPhish, Netcraft and the vendors shown on VirusTotal. Our guide for websites falsely marked as malicious lists each service's process.
Protecting your brand while you wait
Tell customers what is happening and offer an alternative way to reach you. Pause paid campaigns that point to the flagged pages, so you do not pay for traffic that bounces. If you rely on email, check whether your sending domain is affected too.
Frequently asked questions
Can a phishing warning appear even if I was never hacked?
Yes. Many phishing flags are pure false positives triggered by login forms, brand names or redirects.
How quickly can a phishing flag be removed?
Google Safe Browsing typically reviews within a day or two. Other vendors range from a few days to two weeks.
Do I need to contact every vendor separately?
Yes. Each vendor manages its own list. Removing one listing does not remove the others.
Will this happen again?
It can, especially if the root cause is not fixed. Continuous monitoring catches repeat listings early.