Google Safe Browsing flags my website as deceptive after a successful security review

Hosting Support
1

Website URL

https://ekstrakodingmtsn3ciamis.rf.gd/

Error Message

Hello InfinityFree Support,

My website https://ekstrakodingmtsn3ciamis.rf.gd/ has been flagged by Google Safe Browsing as a deceptive site, with the issue described as “Social engineering content detected.”

Google Search Console lists these example URLs:

  • https://ekstrakodingmtsn3ciamis.rf.gd/login.php
  • https://ekstrakodingmtsn3ciamis.rf.gd/login.php?i=1

A previous security review was successful on September 28, 2026, but a new security issue was detected on October 1, 2026.

I inspected the login page and several related PHP, CSS, and .htaccess files. I have not found any obvious malicious code. Google’s live URL test also shows HTTP 200 OK, all page assets loaded, and no JavaScript console errors.

Could you advise how I can investigate this further and whether there may be a hosting-account or server-side issue that needs to be checked?

I have not included any passwords or database credentials.

Thank you.

Other Information

I have checked the files currently used by my website, including login.php, functions.php, style.css, header.php, footer.php, and the .htaccess file inside the uploads directory. I have not found obvious malicious code in the files inspected.

Google Search Console’s live URL test returned HTTP 200 OK, all page assets loaded successfully, and no JavaScript console errors were reported.

The previous security review was successful on September 28, 2026, but a new social engineering detection appeared on October 1, 2026.

Could you please advise what additional checks I should perform and whether the hosting platform or server logs can be checked for possible injected content or suspicious activity?

I can provide screenshots and further information if needed. No passwords or database credentials are included.

2

Welcome to the InfinityFree community forum! Good to have you here.

  • Most people answering here are volunteers. They’re often the fastest source of help. Admin (the only staff member) checks in about once a day for issues on our end.
  • Volunteers can’t see your account or website. Share what you actually see, like error messages and what happens when you try something. That’s more useful than your theory of what’s wrong.
  • AI tools often get InfinityFree wrong. If a volunteer’s advice differs from what an AI told you, please try the volunteer’s suggestion first.
  • Solving an issue is a joint effort. Try the suggestions you get and report back what happened.
3

Did you read this?

4

Yes, thank you. I have read the guide.

I verified my website in Google Search Console and checked the reported example URLs. I also inspected login.php, functions.php, style.css, header.php, footer.php, and the .htaccess file in the uploads directory. I have not found any obvious malicious code in those files.

Google’s live URL test returned HTTP 200 OK, all page assets loaded successfully, and no JavaScript console errors were reported.

My previous security review was successful on September 28, 2026, but Google detected a new “Social engineering content” issue on October 1, 2026, affecting the login page.

Could you please advise what I should investigate next, given that the reported login page looks normal in Google’s live test?

Thank you for your help.

5

In my experience, Google Safe Browsing is very likely to flag websites as deceptive if the website only has a login page publicly visible. It seems that Google believes that your login page is a phishing page.

That doesn’t mean that your page is actually a phishing page. You know what the login page actually does, and whether it’s a legitimate login page or a phishing page. Google doesn’t know that, they only see the public page.

Usually, my first recommendation would be to setup a public page because Google hates websites that are only a login page, but you already have that.

So the only thing you can do is to make your login page look less suspicious. I have no idea what that would be though, since your login page looks perfectly normal to me, but Google seems to believe differently.

So in short: I don’t know. Google made this decision, and it seems like they judged your website incorrectly. But Google is Google, and if Google says that you’re bad, then that’s what you have to deal with.

6

Thank you for your response.

My website already has a public homepage and other public pages, including About, Programs, Schedule, Registration, and Contact information. The login page is only intended for registered students, mentors, and administrators of the extracurricular coding program at MTsN 3 Ciamis.

The login page does not ask users for their Google account credentials. It uses accounts registered in my own website database.

I will improve the login page to make its purpose and school identity clearer.

Do you have any specific recommendations for making a legitimate school website login page less likely to be flagged by Google Safe Browsing?

Thank you for your guidance.

7

After doing everything said by others, fill out this form and submit it.

8

You’re asking the wrong people in the wrong place. A Google Safe Browsing report is between you and Google, and doesn’t involve your hosting provider. Nobody except for the responsible people within Google know exactly how it works.

Besides that, there is nothing I can tell you that I haven’t told you already. Your site looks safe to me, and I don’t know why Google would flag it.

Explaining the nature of your site to us and repeating the question won’t change that answer. We’re not an authoritative source for Google Safe Browsing disputes.