Website Flagged as Dangerous: How to Remove the Warning

The exact words depend on where your visitor sees the warning. Google search results and browsers use Google Safe Browsing. Security software and company firewalls use their own lists.

• Chrome, Firefox and Safari: a red page saying the site is dangerous or contains malware. Fixed through Google Safe Browsing review.
• McAfee: a red WebAdvisor rating or block page. See McAfee WebAdvisor delisting.
• Norton: a Safe Web warning in the browser extension or Norton 360. See Norton Safe Web removal.
• Bitdefender: a TrafficLight or endpoint block page. See Bitdefender false positive removal.
• Yandex Browser: a warning from Yandex Safe Browsing, which keeps its own list.
• Google search results: a "This site may be hacked" or "may harm your computer" note under your listing. See site labeled dangerous in Google search.
• Office and school networks: a block page from a web filter such as Fortinet, Cisco Talos or Palo Alto Networks, so the site only fails for people at work or school.

Vendors use three kinds of labels. Dangerous or malicious means the vendor believes the site harms visitors. Suspicious means an automated system found warning signs but no proof. Unrated or newly registered means the vendor knows too little about the domain and blocks it to be safe.

Many suspicious ratings come from machine learning systems such as alphaMountain.ai and CRDF, which score domains on trust signals instead of a confirmed threat. Clean sites often get a suspicious rating because of:

• A new domain or a recent move to a new host.
• A shared IP address that also hosts harmful sites.
• Login or payment forms on pages with little other content.
• Redirects or scripts that are hard to read, such as obfuscated code.
• Missing company information, such as an address, contact page or privacy policy.

• Malicious code was injected into your pages, theme or plugins and loads scripts from another domain.
• Your site hosts a file that vendors detect as malware or unwanted software, sometimes uploaded by a hacker, sometimes a genuine tool that looks suspicious.
• An ad network or third party script on your site serves harmful downloads or redirects.
• The domain shares hosting or history with sites that were harmful, or it was used for something else before you owned it.
• A detection rule matched your site by mistake. This is a false positive and can be cleared with a review once you show the site is clean.

Chrome shows different warnings depending on what Google Safe Browsing found. The red full page warning is covered in detail in our guide to the dangerous site ahead red page.

• "The site ahead contains harmful programs" means Google found unwanted software, often a download that changes browser settings or bundles extra programs.
• "Dangerous download blocked" means one file was flagged, not always the whole site. Remove or replace the file, or host a signed version from a trusted source, then request a review.
• Warnings only some visitors see often come from Enhanced Safe Browsing, which checks more pages in real time. These can be false positives; see Chrome false positive warnings.

1. 1Run the free check on this page and note every vendor that lists your domain. Ask a visitor who saw the warning for a screenshot, because it names the product.
2. 2If Google flags you, open the Security issues report in Google Search Console to see the problem type and example URLs.
3. 3Scan the site files and database, remove injected code and unknown files, and replace core files, themes and plugins with clean copies.
4. 4Change all hosting, CMS, database and FTP passwords, remove unknown admin users and update everything to the latest version.
5. 5Scan the site again from outside, for example by checking it on VirusTotal, to confirm nothing harmful is still served.
6. 6Request a review from Google in Search Console, then send a review request to each other vendor that lists you, with a short note on what you fixed.
7. 7Keep checking until every vendor has removed the listing, and keep the evidence of your cleanup in case a vendor asks for it.

Request reviews in order of impact: Google first, because it reaches the most visitors, then the vendors your customers or your own monitoring report. Removing the warning from one vendor does not clear it anywhere else. Check all vendors again before you tell customers the problem is solved.

If your scans are clean and you cannot find anything harmful, the listing may be a false positive or left over from an old infection. Vendors still need a review request to remove it, and they respond better to a short, factual request that names the URL and explains why it is safe.

Our website blacklist removal hub lists every vendor we work with and links to the removal steps for each one.

If customers are telling you about the warning before you have seen it yourself, our guide on what to do when customers say your site is dangerous explains how to answer them.

A grey "Not Secure" label next to your address is not a blacklist listing. It means the page loads without a valid SSL certificate, so nothing is sent for review. Install or renew the certificate and make every page load over https. See WordPress site says Not Secure or the guide for Squarespace, Wix and GoDaddy sites.