What the deceptive site ahead warning means
When a visitor opens your site in Chrome and sees a full red page saying Deceptive site ahead, Chrome has matched your address against the Google Safe Browsing list of social engineering sites. The visitor can still click through, but most will not.
The listing can cover one page, a folder or the whole domain. It also affects Google Ads and can stop links to your site from working in some email clients and chat apps.
To Google, deceptive means a page tricks people into doing something they would not do if they knew who was behind it. Besides fake login pages, that includes fake download buttons, prompts to update your browser, pages that pretend to be a government office, payment provider or tech support line, and ads that mislead about where they lead.
Common reasons a site gets flagged as deceptive
- A hacker added a fake login page, often for a bank, a webmail provider or a delivery company, inside a folder you do not use.
- Your site redirects some visitors to a scam page, for example only visitors on mobile or only visitors coming from search.
- A form on your site asks for passwords or card details on a page that does not use HTTPS or looks like another company's brand.
- Pop ups or download buttons from an ad network push visitors to fake software updates.
- A false positive: a legitimate page was matched by mistake, which happens more often with new domains and with sites that sell accounts or services for other brands.
How to find the offending page
The sample URLs in Search Console are examples, not a complete list. Google may have found more pages than it shows, so a review that only fixes the samples is often refused.
Search your server for folders that were added recently, HTML files that use the name or logo of a bank, webmail or delivery brand, and index files in places you did not put them. Your hosting provider's file manager can usually sort files by date, which makes new additions easy to spot.
Step by step: remove the deceptive site ahead warning
- 1Run the free check on this page to see whether Google Safe Browsing lists you and which other vendors flag the same domain.
- 2Verify your site in Google Search Console and open the Security issues report. It names the problem type and often lists sample URLs.
- 3Open each sample URL from a clean device and look for login forms, redirects or downloads you did not create. Check the folders around them too.
- 4Remove the deceptive pages, change every password for hosting, the CMS and FTP, update plugins and themes, and remove unknown admin users.
- 5If the flagged page is genuine, change what made it look deceptive: add clear branding, use HTTPS everywhere and remove any wording that imitates another company.
- 6In the Security issues report, tick that you fixed the issues and request a review. Describe what you found and what you changed in plain words.
- 7Ask the other vendors that flag you, such as PhishTank or Netcraft, to review the domain as well, because Google's review does not clear their lists.
Do not request a review before the cleanup is finished. A refused review leaves the warning in place and the next request is looked at more closely.
What to include in your review request
Keep the request short and factual. Reviewers read many requests, and a clear one is easier to approve.
- What your business is and what the flagged page is for.
- What you found, such as a fake login folder or an injected redirect.
- What you changed, including removed files and updated passwords.
- How you will prevent a repeat, such as updates and monitoring.
- If you believe it is a false positive, why the page is legitimate. If a third party, such as a booking or payment provider, runs the page, name them.
Leave out angry language and long server logs. An example: "We are a dental clinic. The flagged page is our appointment booking form, run by our booking provider. We found no harmful files, added our clinic name and contact details to the page and moved it to HTTPS. Please review the listing."
False positive or real phishing kit?
If the flagged page is yours and genuine, make it clearly yours: show your company name, link to your contact page and privacy policy, and remove logos of companies you do not represent. Then request a review.
If you find a real phishing kit, treat it as a security incident. Remove it, find out how it got there and close that hole, and if visitors may have entered details on the fake page, tell the people affected.
If you do not have access to Google Search Console
Without Search Console you can still report an incorrect listing through the Google Safe Browsing report form, but you get less detail about what was found. Adding the Search Console verification record to your DNS is usually the quickest way to get the full report.
If someone else manages your hosting or DNS, ask them to add the record for you. Our Google Safe Browsing delisting guide covers both routes.
Other vendors that copy phishing listings
Google's list is not the only one. Phishing reports are shared between services, so after a deceptive listing you may also appear on PhishTank, OpenPhish, Netcraft, Fortinet, Kaspersky, Bitdefender and ESET. If your domain sends email, check the Spamhaus DBL too and follow our Spamhaus DBL removal guide if it lists you.
How to keep the warning from coming back
Most repeat listings happen because the original hole was never closed: an old plugin, a reused password or a forgotten copy of the site in a subfolder. Close those before you consider the job done.
Turn on domain monitoring so you hear about a new listing before your customers do, and read our website blacklist removal hub for the other vendors that can block a site.