Google Safe Browsing reports: “This site is unsafe.”
It states that the website contains harmful content, including pages that may trick visitors into sharing personal information or downloading software.
Google Search Console reports a security issue: “Deceptive pages”.
Other Information
Hello InfinityFree Support Team,
My website has been flagged by Google Safe Browsing for deceptive pages.
The affected URLs reported by Google Search Console include:
/login.php
/login.php?i=1
/scoreboard.php
/student_dashboard.php
/timetable.php
I have reviewed the relevant application PHP files but have not identified an obvious phishing mechanism.
During testing, I noticed that ordinary visitors receive a JavaScript cookie challenge that loads /aes.js, sets a __test cookie, and redirects to /login.php?i=1.
Could you please investigate whether my hosting account contains malware, injected scripts, suspicious redirects, or hosting-level content that might explain Google’s detection?
I would also like to know whether this cookie challenge is an expected hosting security feature and whether it could be contributing to the warning.
I have not yet identified the cause and would appreciate your help investigating it before making further changes.
Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
The cookie challenge is expected, and it’s very unlikely to be the cause. It’s a browser security system that runs on every free hosting account and can’t be turned off. It loads /aes.js, sets the __test cookie and redirects to the same URL with ?i=1 added. The article below says Google’s own crawler is exempt from it.
Google flags these pages because of how they look to its scanner, not because of the hosting. Our article on this warning lists the usual causes: a copy of another site’s login page, another brand’s name or logo, a hacked site, or a new site where the first thing visitors see is a login form. The URLs you listed (/login.php, /student_dashboard.php and so on) are mostly behind a login, which fits that last case. The article also says we can’t remove the listing. Only Google can, after you request a review.
It also covers what to check, how to fix it and how to request the review. If the site is legitimate, it recommends a public homepage that explains what the site is, plus an about page and contact details, in front of any login form. It also says to remove any file you don’t recognise, in case the account was hacked.
Two things would help narrow it down. What’s at the root of your site: a public homepage, or does it go straight to the login form? And does your login page use the name, logo or design of another organisation, such as a school or a well-known service?
The login page uses my own Kiba-dev Academy branding, name and logo. It does not imitate another organisation, school, or well-known service.
I have also reviewed the relevant PHP files, including the login page and student dashboard, but have not identified any obvious phishing functionality.
Could you please advise what else I should investigate, particularly regarding the possibility that Google is interpreting the protected learner pages as deceptive?