Browser warns your site is dangerous: how to remove the warning
PrintWhen Chrome, Firefox, Safari or Google Search show a red warning in front of your website, Google Safe Browsing (or a similar list) has found malware, a phishing page or unwanted software on it. The warning does not go away on its own: you have to remove what was found, close the way the attacker got in, and then ask Google to review the site again. The steps below follow that order.
What the warning looks like
- A full red page in the browser with a title such as "Dangerous site", "Deceptive site ahead" or "The site ahead contains malware" (the wording depends on the browser and its language).
- In Google results, a line under your site saying "This site may be hacked" or "This site may harm your computer".
- Your antivirus blocks the page when you open it. That case is described in an antivirus reporting a virus on your site.
Visitors who see such a page usually leave, and search traffic drops sharply, so it pays to act on the same day.
Step 1. Confirm what was found and where
- Check the status of your domain in the Google Transparency Report. It tells you whether the site is listed and for what kind of problem.
- Open Google Search Console and look at the Security issues report. Google lists sample addresses of the infected or fake pages there. If the site is not yet added to Search Console, add it as a Domain property and confirm ownership with the TXT record Google gives you (see adding TXT records in cPanel).
- In cPanel, open Security, then Imunify360, and look at the files the server scan has flagged.
Pay attention to the sample addresses. Phishing pages are often a whole folder planted deep inside the site (for example a fake bank or delivery login page), while the home page looks perfectly normal.
Step 2. Clean the site and close the entry point
A review request sent before the site is clean will be rejected, and repeated rejections slow things down. Before you ask for a review:
- Remove the planted folders and files, and the injected code in the site's own files. How to find them is explained in finding malicious code on your site.
- Change every password (client area, cPanel, FTP, database, CMS administrators) from a computer you have scanned with an antivirus.
- Update the CMS, plugins and themes, and delete the ones you do not use. For WordPress, the quickest route is WP Toolkit in cPanel.
- Open the addresses Google listed and make sure each one now returns a 404 error or the normal page.
If you would rather follow one complete checklist from the first minute, use the first steps after a site is hacked.
Step 3. Ask Google to review the site
- In Search Console, open Security & Manual Actions, then Security issues.
- Tick the box confirming that you have fixed the issues and press Request Review.
- In the text field, describe briefly what you found and what you did: which files or folders were removed, what was updated, which passwords were changed.
Google answers by e-mail and in the same report. According to Google, a phishing review usually takes about a day and a malware review a few days; spam injected into pages can take several weeks. After the listing is lifted, browsers can still show the warning for a few hours until they refresh their copy of the list.
Other services that may list the site
Some antivirus vendors and browsers keep their own lists (for example Microsoft Defender SmartScreen in Edge, Yandex, Norton Safe Web or McAfee). If a warning persists only in one of them, look for that vendor's site review or false-positive form and submit the cleaned address there.
Frequently asked questions
I cleaned the site, but the warning is still there. Why?
Either the review has not been processed yet, or Google still finds something. Check the Security issues report again: a rejected review comes with new sample addresses. Infection that returns after cleaning almost always means the entry point (an outdated plugin, a stolen password) is still open.
Can TopHost remove the warning for me?
No. Only the owner of the site, signed in to Search Console, can ask Google for a review. We can tell you what Imunify360 found on the account and help restore a clean backup. Write to us in a support ticket.
Is my e-mail affected too?
The browser warning concerns the website. If messages from your domain are being rejected or end up in spam, that is a separate problem; see spam notice or blacklisted IP.
