Antivirus Blocking My Website: How to Fix McAfee, Norton, Bitdefender, Fortinet and Kaspersky Blocks

Most modern antivirus products do more than scan files. They include a web protection feature that checks every address a user visits against the vendor's list of known bad sites. If your domain is on that list, the user sees a warning or block page instead of your website. The page usually names the antivirus product and gives a short reason, such as malware, phishing or a suspicious site.

This is different from a browser warning like Google's red "Dangerous site" page. A browser warning comes from Google Safe Browsing and affects everyone using Chrome, Firefox or Safari. An antivirus block only affects people running that particular product. That is why the problem often looks random: some customers reach your site without trouble, while others call to say it is blocked.

The block is not a judgment about your business. It is an automated or analyst decision based on what the vendor saw at some point. If you want the background on why clean sites get caught, our post on why antivirus flags clean websites covers it. This page focuses on getting the block removed.

There is no central antivirus blacklist. Bitdefender, Kaspersky, ESET, Norton, Sophos, Fortinet, Trend Micro and others each maintain their own database of URLs and domains. Some share threat data with each other, but every vendor decides on its own when to add a site and when to remove it.

That has two practical results. First, you may be blocked by one vendor and not the others. Second, fixing it with one vendor does nothing for the rest. You need to find every vendor that lists you and contact each one through its own channel.

• Bitdefender: offers a way to report a URL it blocks by mistake. See our Bitdefender page.
• Kaspersky: lets you look up a URL's status and submit a false positive for review. See our Kaspersky page.
• ESET: accepts false positive reports for blocked websites. See our ESET page.
• Norton: uses Norton Safe Web ratings, and site owners can dispute a rating. See our Norton Safe Web page.
• Sophos: accepts submissions for sites it classifies wrongly. See our Sophos page.
• Fortinet: its FortiGuard web filter powers many business firewalls, and it accepts requests to review a site's rating. See our Fortinet page.
• Trend Micro: lets you check a site's safety rating and request a new review. See our Trend Micro page.

Firewalls in offices and schools often use the same vendor lists. If a client says your site is blocked at work, the firewall vendor (often Fortinet or Sophos) is a likely source.

The block page your customer sees names the product. Use that name to find the right vendor, because each one runs its own list and its own review.

• McAfee blocking my website: the red warning comes from McAfee WebAdvisor ratings. See our McAfee WebAdvisor delisting guide for how its site review works.
• Norton blocking my website: Norton uses its Safe Web ratings, which you can dispute as the site owner. Our Norton Safe Web removal page walks through it.
• Bitdefender blocking my website: Bitdefender TrafficLight and its endpoint products share one URL list. Start with our Bitdefender false positive guide.
• Fortinet blocking my website: FortiGuard web filtering blocks whole categories on company networks, so office users are often the first to notice. See Fortinet FortiGuard reclassification.
• Kaspersky blocking my website: Kaspersky checks addresses against its own threat database. Our Kaspersky delisting steps explain what to send.

Not sure which product it is? Run the free check on this page, then compare the flagged engines with the screenshot from your customer.

Before you contact anyone, make a full list of who is flagging you. Guessing wastes time, and a missed vendor means some customers stay blocked.

1. 1Run your domain through our free Domain Blacklist Checker. It checks VirusTotal (a service that runs a URL past dozens of security engines at once), Google Safe Browsing, Spamhaus DBL and URIBL, and shows which engines flag you.
2. 2Ask an affected customer for a screenshot of the block page. The screenshot shows the product name and often the category, which tells you exactly which vendor to contact, even if that vendor does not show up in public scans.
3. 3Note the reason each vendor gives (malware, phishing, suspicious, spam). The reason tells you what evidence the vendor will want to see.
4. 4Write down the exact URL that was blocked. Sometimes only one page or subdomain is listed, not the whole domain, and the request needs to name what was actually flagged.

Vendors do not remove a listing while the threat is still there. If you request a review while the site is infected, the request is refused, and repeated requests for a site that is still dirty can make later reviews harder.

Ask your developer or host to check for injected code, unknown files, strange redirects and pages you did not create. Look at the site from a private browser window and from a phone on mobile data, because some malware only shows itself to first-time or mobile visitors. If you run WordPress, our guide on checking if WordPress is hacked is a good starting point.

If everything checks out and the block is a false positive (a wrong flag on a clean site), you are ready to request reviews. If something is found, get it cleaned and keep a short record of what was fixed. That record helps the review.

Once you have your vendor list and the site is clean, work through the vendors one at a time. The process is similar for most of them, even though the forms differ.

1. 1Open the vendor's official review or false positive channel. Our vendor pages linked above describe where to find it. Avoid third-party sites that offer to submit for you without saying how.
2. 2Enter the exact domain or URL that is blocked, matching what the block page or scan showed.
3. 3Explain briefly that you own the site, what the site does, and that it is clean. If it was cleaned, say what was removed and when.
4. 4Add a working contact email, ideally on the same domain, so the vendor can reach you and sees that you control the site.
5. 5Save the confirmation or ticket number. Some vendors reply by email, others just update the rating without telling you.
6. 6Recheck the vendor's status after a few days, and run the Domain Blacklist Checker again to confirm the flag is gone.
7. 7Repeat for the next vendor until every listing is cleared.

Write each request in your own words, specific to that vendor. Pasting the same vague message everywhere tends to get slower and less useful replies.

Review times are set by each vendor, not by you or by us, and they vary. Some vendors process clear false positives within a day or two. Others take several days to a couple of weeks, especially if an analyst has to look at the site manually.

After a vendor removes the listing, users may still see the block for a short while until their antivirus updates its local data. In most cases that happens within hours, but it can take longer on devices that are rarely online. If a customer is still blocked after the vendor confirms removal, ask them to update their antivirus and try again.

Also watch for re-flags. If the root cause was a compromised plugin or an old script that comes back, the site will be listed again. Our post on stopping your site getting blacklisted again covers prevention.

• Telling customers to turn off their antivirus. It damages trust and does nothing for everyone else who is blocked.
• Submitting a review before the site is clean, which usually leads to a refusal.
• Fixing only the vendor one customer mentioned and missing the others that also list you.
• Sending one generic message to every vendor instead of using each vendor's own channel.
• Not rechecking. A vendor may clear the main domain but keep a subdomain or a single URL listed.
• Ignoring the reason given. A "phishing" flag needs different evidence than a "malware" flag.

If one vendor blocks you and you have the time, you can usually handle it yourself with the steps above. It mostly takes patience and care with the details.

It gets harder when several vendors list you at once, when the forms ask for evidence you are not sure how to collect, or when you are losing sales every day the block stays. Following up across five or six vendors, each with its own process and pace, is where most of the time goes. That is the part we take off your hands.

We handle the delisting. Our team reviews each listing, prepares the evidence, submits the removal request through each vendor's official channel and follows up until the vendor responds. You get a confirmation when the listing is removed.

We do not clean malware or repair hacked sites. If your site really is serving malware or phishing, we tell you what needs fixing based on what the vendor and scans show, and we do not submit a removal request until it is resolved. Your developer, host or a site-cleanup specialist does the cleanup.

We cannot guarantee that a vendor will remove a flag or how fast it will act. What we offer is no cure, no pay. A one-time case costs €39, paid when you open the case, and if the vendor refuses to remove the flag, that payment is refunded in full. On subscription plans, a case credit is only used when the removal is confirmed. If the same vendor re-flags the domain within 30 days of a confirmed removal and nothing changed on your side, we resubmit at no extra charge. The guarantee does not apply if the listing was justified, if you did not provide requested information, or if you withdrew the case.

With monitoring, we check your domain daily against 90+ security vendors, including Bitdefender, Kaspersky, ESET, Fortinet and Sophos, and 20 email spam blacklists, and email you when something changes. The Protect plan is €99 per year for one domain with 2 case credits per year. If a listing comes back, we remove it again at no cost.