WordPress Site Blacklisted: What to Do Next

Your site is blacklisted when a security vendor or spam blacklist adds your domain to its list of dangerous sites. Browsers, antivirus products, email filters and ad platforms use these lists, so the effects show up in many places at once: a red warning in Chrome, an antivirus block page, emails landing in spam, or ads being rejected.

WordPress itself is not the problem. It runs a large share of the web, which makes it a popular target, and most attacks go after the add-ons and logins around it rather than WordPress core. In most cases a blacklisting means the site really was compromised at some point, even if it looks normal to you now.

These are the usual ways a WordPress site ends up on a blacklist. More than one can apply at the same time.

• Outdated plugins and themes. Known security holes in old versions are scanned for automatically. A plugin you installed years ago and forgot about is a common entry point.
• Nulled plugins and themes. These are pirated copies of paid products, downloaded from unofficial sites. They often come with hidden backdoors (code that lets an attacker get back in later).
• Injected redirects. Attackers add code that sends some visitors, often mobile users or people arriving from Google, to scam or malware sites. You may never see it when you visit your own site while logged in.
• Spam pages. Thousands of pages selling pills, fake goods or gambling get added to your site, sometimes in a hidden folder. These trigger both security vendors and spam blacklists.
• Compromised admin accounts. A weak or reused password, or an old account belonging to a former contractor, lets someone log in and change whatever they like.
• Phishing pages. A fake login page for a bank or email provider is uploaded to your hosting, and the link is sent out in spam.

Start by finding out exactly who flags you and why. This tells you how serious the problem is and which vendors you will need to contact later.

1. 1Check your domain with our free Domain Blacklist Checker. It covers VirusTotal (which runs your URL past dozens of security engines), Google Safe Browsing, Spamhaus DBL and URIBL.
2. 2Open Google Search Console, Google's free dashboard for site owners, and look at the Security Issues report. If Google has flagged you, it usually lists the problem type and some example URLs.
3. 3Ask anyone who reported the problem for a screenshot. A block page from an antivirus product names the vendor directly.
4. 4Write down each vendor, the reason it gives (malware, phishing, spam) and any example URLs. Keep this list. You will use it for cleanup and for the removal requests.

Vendors will not remove a listing while the problem is still on the site. Cleanup has to be finished, and checked, before you request any review.

WordPress cleanup is harder than deleting one bad file. Attackers usually leave several backdoors, hide code in the database, and add rogue admin users. If one is missed, the infection returns within days and the site is listed again. That is why we recommend that your developer, your host or a site-cleanup specialist does this part. Many hosts offer cleanup or can point you to someone who does.

Our guide on how to check if WordPress is hacked explains the signs to look for. If you have cleaned before and the problem came back, read why WordPress malware keeps coming back before you start again.

• Remove all malicious code, files and database entries, not only the ones you can see.
• Delete unknown admin users and reset every remaining password, including hosting, database and FTP access.
• Replace nulled plugins and themes with official copies, or remove them.
• Update WordPress core, every plugin and every theme to the current version.
• Ask the person who cleaned the site for a short written summary of what was found and fixed.

Once the site is clean, request reviews in a sensible order. Google comes first because its Safe Browsing warnings appear in Chrome, Firefox and Safari, and they affect the most visitors. Ad platforms and other tools also tend to look at Google's status.

1. 1In Google Search Console, open the Security Issues report, confirm each issue is fixed, and use the review request button. Describe briefly what was wrong and what was done.
2. 2Wait for Google's answer. If it refuses, something is usually still on the site, so go back to your developer before trying again.
3. 3Rerun the Domain Blacklist Checker and look at which VirusTotal vendors still flag you. VirusTotal only shows results; it cannot remove them. You contact each vendor through its own channel, such as Fortinet, Sophos, Kaspersky or Bitdefender.
4. 4If spam blacklists such as Spamhaus DBL list you because of spam pages, request removal there too, using each list's own process.
5. 5If ads were rejected, request the ad platform's review only after the security listings are cleared.
6. 6Recheck everything a few days later to make sure nothing was missed.

Review times are set by each vendor. Google often responds within a few days, while other vendors can take from a day or two to a couple of weeks.

A blacklisting is a strong sign the site needs better upkeep. These basics close the most common doors.

• Turn on automatic updates for plugins and themes where possible, and check for updates weekly.
• Remove any plugin or theme you do not use. Inactive add-ons can still be exploited.
• Only install plugins and themes from the official WordPress directory or the developer's own site.
• Use a unique, strong password for every admin account and turn on two-factor login (a second code from your phone).
• Give each person their own account with only the access they need, and remove old accounts.
• Keep regular backups stored away from the site, so a clean copy is available.
• Use daily blacklist monitoring, so you hear about a new listing quickly instead of from a customer.

If you are not sure whether the site is fully clean, wait and ask. One extra day of checking is cheaper than a failed review and a second round of listings. Our website blacklist removal page has more on what vendors expect.

• Requesting a Google review before the cleanup is complete, which usually leads to a refusal.
• Restoring an old backup that already contained the backdoor.
• Cleaning the files but not the database, or the other way round.
• Only fixing the URLs that Google listed as examples, while the same infection sits on other pages.
• Forgetting the vendors beyond Google, so antivirus users stay blocked for weeks.

We take care of the delisting once your site is clean. Our team reviews each listing, prepares the evidence, submits the removal request through each vendor's official channel and follows up until the vendor responds. You get a confirmation when each listing is removed.

We do not clean malware, repair hacked WordPress sites or remove phishing kits. If the site is still serving malware, phishing or spam, we tell you what needs fixing based on what the vendors and scans show, and we wait until it is resolved before submitting anything. Your developer, host or a cleanup specialist does that work.

We cannot promise that a vendor will remove a flag or say how fast it will act; that is the vendor's decision. Our terms are no cure, no pay. A one-time case is €39, paid when you open it, and refunded in full if the vendor refuses removal. On subscription plans, a case credit is only used when the removal is confirmed. If the same vendor re-flags the domain within 30 days of a confirmed removal and nothing changed on your side, we resubmit at no extra charge. The guarantee does not apply if the listing was justified, if you did not provide requested information, or if you withdrew the case.

Monitoring checks your domain daily against 90+ security vendors and 20 email spam blacklists, and emails you when something changes. For agencies looking after many WordPress sites, the Business plan covers 10 domains with team roles and domain groups.