You run a legitimate business, yet your website has been flagged as a phishing site. It feels unfair, and often it is.
Phishing detection works by comparing pages against known scam patterns at enormous scale. Here are the eight reasons we see most often, and what to do about each.
Key takeaways
- Most phishing detections come from automated classifiers, not human reviewers.
- Login, payment and brand-related content are the biggest triggers on clean sites.
- A hidden compromise is still the single most common real cause.
- Knowing the reason lets you fix the page and write a convincing review request.
1. Your site was compromised
Attackers often upload phishing kits to hacked websites, typically in a hidden folder. Your homepage looks fine, but a page imitating a bank or email provider lives on your domain. Check Search Console's sample URLs and search your server for unfamiliar folders. See how to check if WordPress is hacked.
2. Your login page looks like a template
Simple login pages with an email field, a password field and little else closely resemble phishing templates. Adding your company name, logo, footer details and links to your homepage and privacy policy helps classifiers see it is genuine.
3. You show other brands' logos
"Pay with" badges, partner logos or "Sign in with" buttons can make a page look like it impersonates those brands, especially on payment or account pages.
4. Your domain resembles a known brand
Domains containing words like bank, pay, secure, login, verify or a well-known brand name are scored higher risk, even when legitimate.
5. You use URL shorteners or redirect chains
Phishing campaigns rely heavily on shorteners and multi-step redirects. If your emails or ads link through several hops, classifiers may flag the final destination.
6. Your hosting is shared with scammers
Low-cost shared hosting and some cloud ranges host many phishing sites. A poor IP neighbourhood lowers your score. See URL reputation lookup for how vendors score this.
7. Your domain is new or recently changed
Most phishing sites use fresh domains. New registrations, recent ownership transfers and sudden DNS changes all increase risk scores.
8. Someone reported you
Users and competitors can report sites to feeds such as PhishTank or Netcraft. Reports are verified, but mistakes happen, especially for pages that look like reasons 2 to 4.
Once you know the reason, follow our fast-track guide to clear the flag with every vendor.
Frequently asked questions
Do vendors tell you why you were flagged?
Google gives sample URLs. Most other vendors give only a label, so you need to diagnose the reason yourself.
Can a single page get the whole domain flagged?
Yes. Many vendors flag the entire domain if one page is considered phishing.
Will adding SSL prevent phishing flags?
No. Most phishing sites use valid SSL certificates, so it is not a trust signal on its own.
Is it safe to keep my login page while disputing?
Yes, if it is legitimate. Improve its trust signals and explain it clearly in your review requests.