Your domain is on a blacklist and you want it off. But "why" matters as much as "how", because the removal process and the prevention strategy both depend on the root cause.
Here are the ten reasons we see most often, roughly in order of frequency.
Key takeaways
- Most blacklistings fall into one of ten categories.
- Not all listings mean your site was hacked. False positives are more common than most people think.
- The cause determines the fix: cleanup for compromises, evidence-based dispute for false positives.
- Some causes are outside your control, like shared hosting or inherited domain history.
1. Malware or injected code
The most obvious cause: an attacker compromised your site and added malicious code. This can be a redirect to a scam page, a cryptocurrency miner, a phishing form or a drive-by download script. Security crawlers detect the code and add the domain to their blocklist.
Fix: Remove the malicious code, close the entry point and then request removal from each vendor. See our WordPress reinfection guide for a thorough cleanup process.
2. Phishing pages
Attackers upload fake login pages for banks, email providers or social media sites onto compromised servers. The domain gets listed as a phishing source even though the legitimate site owner had nothing to do with it.
Fix: Delete the phishing pages, change all credentials and request removal. Our article on websites marked as phishing covers the process.
3. Spam or abused forms
Contact forms, comment sections and newsletter signups that lack spam protection can be abused to send bulk messages. If enough spam passes through your domain, spam blacklists and URL blocklists pick it up.
4. False positive from automated scanning
This is more common than most people expect. Security engines use heuristics and machine learning that sometimes flag clean sites. Login pages, brand logos, certain JavaScript patterns, new domains and URL shorteners are frequent triggers.
Fix: No cleanup needed. Go straight to submitting a false positive dispute. Our reporting guide explains how.
5. Shared hosting or IP reputation
On shared hosting, your site shares an IP address with potentially hundreds of others. If one of them is compromised, the IP can be blacklisted, and your domain is caught in the crossfire.
Fix: Ask your host to move you to a clean IP or consider hosting that isolates accounts.
6. Old listing from a past incident
You cleaned up a hack months ago, but never requested a formal review. Many vendors do not automatically recheck domains. The old listing stays in their database indefinitely.
Fix: Submit a removal request with evidence that the site has been clean since the incident.
7. Inherited domain reputation
If you registered a domain that was previously used for spam or malware, its history follows. Blacklists do not reset when a domain changes hands.
Fix: Contact each vendor with proof of new ownership and a clean scan.
8. Aggressive advertising or misleading downloads
Pop-ups, fake download buttons, deceptive interstitials and browser notification spam can trigger "unwanted software" or "social engineering" labels, especially from Google Safe Browsing.
Fix: Remove the offending elements and request a review.
9. Linking to or loading flagged resources
Your site itself is clean, but it loads JavaScript, images or iframes from a domain that is flagged. Some vendors extend the listing to every site that references the flagged resource.
Fix: Replace the external resource with a clean alternative and request a review.
10. DNS or domain infrastructure issues
Misconfigured DNS records, dangling CNAME entries or domain hijacking can redirect traffic through malicious servers. Some vendors flag the domain even after the DNS is corrected.
Fix: Fix the DNS issue, confirm with a fresh lookup and request removal.
Frequently asked questions
How do I find out which cause applies to me?
Start with your VirusTotal report to see which vendors flag you and what label they use. Then check your site for signs of compromise. If it is clean, you are likely dealing with cause 4, 5, 6 or 7.
Can a domain be blacklisted for more than one reason?
Yes. A compromised site might be listed for malware by one vendor and phishing by another if different pages have different problems.
Is a new domain more likely to be blacklisted?
New domains have no reputation and are therefore more likely to be flagged by heuristic engines. Building up clean history reduces this risk.
Can I prevent all blacklistings?
You can prevent most by keeping software updated, using strong passwords, monitoring your domain and avoiding risky third-party scripts. False positives, however, can happen to any site.