Google Web Risk: Malware and Phishing Flags
Google maintains lists of web addresses that host malware, phishing pages or unwanted software. These lists power the Safe Browsing warnings in Chrome and other browsers. When a URL is on them, visitors see a full-page red warning before they can reach it, and the site may be flagged in Google Search results.
Why it matters
A flag almost always means one of two things:
- Your site has been compromised. Attackers often break into sites through outdated CMS plugins, stolen passwords or vulnerable code, then add phishing pages, malicious redirects or injected scripts. The owner frequently does not notice, because the injected content may only be shown to some visitors.
- Your site hosts or links to harmful downloads, sometimes through a third-party ad, widget or file-sharing feature.
Either way, most visitors will leave at the warning screen, and the underlying problem may be putting them at risk. Treat a flag as a security incident.
What we check
We look up the scanned URL with Google’s Web Risk Lookup API, which uses the same threat data as Safe Browsing.
| Check | Passes when |
|---|---|
| Not flagged by Google Web Risk | the URL is not listed for malware, social engineering (phishing) or unwanted software |
If the URL is listed, the check fails and shows the threat types Google returned. Results are cached for up to 24 hours, so a change in Google’s verdict can take up to a day to appear here. If the lookup service is unavailable, the check is shown as “couldn’t test”.
We check the exact URL you scanned. Google can also flag other pages on your site, or the whole domain, so a pass for one page does not rule out problems elsewhere.
How to fix
1. Confirm and see the details
Verify your site in Google Search Console if you have not already. The Security issues report lists what Google detected and, often, example URLs. This is the most reliable starting point.
2. Contain it
- Change every password with access to the site: hosting control panel, SFTP/SSH, database, CMS admin accounts and API keys. Remove accounts you do not recognize.
- If the site is actively serving malware or phishing, consider taking it offline or showing a maintenance page while you clean up.
3. Find and remove the harmful content
- Compare the site’s files with a known-good copy, such as your version control repository or a clean backup. Look for new or recently modified files, especially in upload folders.
- On a CMS, reinstall the core, themes and plugins from official sources rather than trying to clean them in place. Remove plugins and themes you do not use.
- Check the database for injected
<script>tags, hidden links and unfamiliar redirect rules. - Check server configuration such as
.htaccessfiles and web server rules for unexpected redirects. - Review third-party scripts, ad networks and embeds, in case the harmful content comes from one of them.
4. Close the way in
Cleaning without fixing the cause usually leads to reinfection. Update everything to a supported version, remove abandoned plugins, enable two-factor authentication for admin accounts, and review file permissions. If you cannot find how the attacker got in, consider getting help from a professional incident response or site cleanup service.
5. Request a review
Once the site is clean, open the Security issues report in Search Console and choose Request review. Describe what you found and what you fixed. Google re-checks the site and removes the flag if the problem is gone. Reviews for phishing are usually faster than reviews for malware, but there is no guaranteed timeline. Repeated problems can lengthen later reviews.
If you believe it is a mistake
False positives happen, for example when a shared download host or a URL shortener you use is flagged. Check whether the flag is really about your content, and remove any link or file that points to the flagged resource. If your site is clean, request a review in Search Console as above and explain why.
Prevention
- Keep the CMS, plugins, themes and server software updated.
- Use unique passwords and two-factor authentication for every admin account.
- Keep tested, off-site backups so you can restore a clean copy quickly.
- Load third-party scripts only from providers you trust, and review them periodically.
- Watch Search Console: Google can email you when it detects a security issue on a verified site.