Customers tell you Chrome shows a full red page saying "Deceptive site ahead", "Dangerous site" or "The site ahead contains malware", and most of them leave. Firefox and Safari show the same block, because they all read Google's Safe Browsing list. Edge may show its own "reported as unsafe" page. The warning means Google found specific pages on your domain that phish, carry malware or trick visitors, and it stays until those pages are gone and someone asks for a review. It does not lift by itself. Below is a rebuilt example (not a real client), the five-minute check that names the flagged pages, and the fix for each cause.
/wp-includes/js/secure/, /.well-known/, /old/, a random string) and copy a bank, Microsoft or a parcel company. Your host's File Manager sorted by "last modified", or the host's malware scan, finds them quickly.| What the check shows | Why it happens | The fix |
|---|---|---|
| "Deceptive pages" or social engineering; sample addresses are login pages for a bank, Microsoft 365, a parcel firm | Someone got in (an old plugin, a reused password, an abandoned FTP account) and uploaded a phishing kit. Your real pages may be untouched, which is why you never saw it | Delete the kit's whole folder, not just the sample pages. Then close the way in: update or remove every plugin and theme you do not use, change every admin, hosting, FTP and database password, and remove admin users you do not recognise. Then request the review (below) |
| "Malware" or harmful downloads; the site sends some visitors to another site, or a scan finds injected script | Code was added to your theme files, the database or .htaccess that loads a script from another domain, often only for phone visitors arriving from Google | Clean it the way site sends visitors to a spam page describes: replace core and plugin files from clean copies, search the database for the injected domain, check .htaccess. Restoring a backup from before the infection is faster if you have one, as long as you then close the way in |
| Flagged for a file you offer for download (a price list, a tool, a zip) | Safe Browsing flags the download itself. An old installer, a macro-enabled document or a file a past web person bundled with something can trip it | Remove the file or replace it with a plain PDF. If it is genuine software you make, sign it and host it on a well-known download service instead |
| Only one embedded script, ad or widget is named (a chat box, an old counter, an ad network) | The third party's domain was taken over or sold, and your pages still load it. To Google, your page now serves what that domain serves | Remove the snippet from the theme, the header-script plugin or the page builder's custom code box. An old visitor counter or a defunct widget is the usual one |
| Clean site, but you bought the domain recently or it lapsed and came back | The flag belongs to what the domain hosted before you. It stays until someone requests a review | Add the domain to Search Console, confirm Security issues lists nothing current, and request a review. If no review button appears, use Google's form for reporting an incorrect phishing warning |
| Only Edge warns ("This site has been reported as unsafe") | Microsoft's SmartScreen list, separate from Google's | Clean the site first, then use Microsoft's "report an unsafe site" page and choose that you are the site owner asking for a review; it asks for the address and what you changed |
Requesting the review is a few clicks; finding the kit's folder, the backdoor that reinstalls it and the old plugin that let it in is the part most owners would rather hand over, especially with the warning costing customers every day. If that is you, the box below is for that. Related: site sends visitors to a spam page, Japanese spam in Google results and "Not secure" warning.