You may have seen a full page red warning in a browser saying a site is dangerous or deceptive. Behind many of those warnings is Google Safe Browsing, a service that identifies unsafe websites and shares the list with browsers and other products. It protects people, but it matters to a business for another reason: if your own website is flagged, customers will be warned away from it.
How Safe Browsing works
Google continuously examines websites and links, looking for signs of malware, phishing pages and deceptive software. Sites that match are added to lists of unsafe URLs. Chrome, Firefox, Safari and other products use those lists to warn users before they open a flagged page. Email and security tools sometimes use similar data to flag links in messages.
Typical warning types include:
- Deceptive site ahead, for phishing or social engineering pages
- The site ahead contains malware, for pages that try to install harmful software
- Harmful programs, for unwanted or misleading software downloads
Why a legitimate business site gets flagged
The usual cause is not that you did something wrong, but that someone else did something to your site:
- Outdated website software or plugins were exploited
- An attacker uploaded a phishing page or hidden redirect
- A hacked ad network or third party script served malware
- A compromised administrator account made unwanted changes
Many owners do not realise anything is wrong until a customer calls about the warning.
How to check your status
Google provides a public Safe Browsing site status page in its Transparency Report where you can enter a URL. Google Search Console, if your site is verified, also has a security issues report that lists problems and details. Checking it periodically is wise.
What to do if your site is flagged
- Do not ignore itWarnings reduce traffic and trust quickly
- Take the site offline or restrict access if neededPrevent further harm to visitors while you investigate
- Find and remove the causeLook for unfamiliar files, users, redirects and scripts, then restore from a clean backup if available
- Fix the underlying weaknessUpdate the website, themes and plugins, change all passwords and enable multi-factor authentication
- Request a reviewIn Search Console, tell Google the issue is fixed so the warning can be reviewed
- Monitor afterwardsWatch for reinfection over the following weeks
If you are not confident doing this, ask your web or IT provider. A partial cleanup that leaves a hidden backdoor leads to repeat flags. Our managed security services team helps businesses investigate and clean compromised sites.
Prevent it happening again
- Keep website software, themes and plugins updated, and remove ones you do not use
- Use strong, unique passwords and multi-factor authentication on admin accounts
- Limit who has administrator access
- Keep regular backups stored away from the website
- Use a web application firewall and malware scanning where available
- Monitor your security status in Search Console
- Run our free IT risk assessment to spot wider gaps
Safe Browsing and your email
Attackers also send links to fake pages in phishing messages, and Safe Browsing can block some of them. Layered phishing protection and email security catch more, and good endpoint security helps if a user does click. Regular security awareness training teaches staff what warnings mean and not to click through them. Our email protection guide covers the mail side.
Do not click through warnings
If you see the red warning on someone else’s site, treat it seriously. Go back, and report it to IT if it appeared on a link in an email. Many compromises begin with someone deciding the warning was probably nothing.
We can investigate, clean and secure your website and monitor it afterwards.
Talk to our security teamFrequently asked questions
Does Safe Browsing mean my site was hacked?
Often, yes, though occasionally a site is flagged by mistake. Investigate before assuming either.
How long does a warning last?
Until the problem is fixed and Google reviews the site. Reviews can take from a short time to several days.
Can I check any website’s status?
Yes. Google’s Transparency Report includes a site status tool for any URL.
Related service: Cyber Security Assessment
Last updated
