If you visit your website and see a bright red warning page like this one, your website has been flagged by Google Safe Browsing:
Deceptive site ahead
Attackers on example.com may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards).
This article explains what the warning means, why websites get flagged, and how to get the warning removed.
What does this warning mean?
Google Safe Browsing is a blocklist of websites Google considers harmful. It’s used by Chrome, Firefox, Safari and most other browsers, so a listing blocks your site for nearly all visitors.
The “Deceptive site ahead” warning specifically means Google believes your site is a phishing or social engineering site. In other words, Google thinks the site tries to trick visitors into entering passwords or payment details, or into downloading something they shouldn’t.
There are other Safe Browsing warnings, such as a malware warning (“Dangerous site” or “The site ahead contains malware”) and a harmful programs warning. The steps in this article apply to those as well, but the causes are different.
We cannot remove this warning for you. Only Google can remove a Safe Browsing listing, and only after you request a review.
Why was my website flagged?
Safe Browsing listings are created by automated systems that scan websites and look for signs of phishing. They judge what your site looks like, not what you intended. Common reasons for a listing are:
- Your site contains a copy of another site’s login page. This includes clones of social media, banking, gaming or email login pages, even if you only made it as a school project, demo or learning exercise. To Google, a working copy of someone else’s login page is phishing.
- Your site uses another brand’s name or logo. For example, a website name, page title or design that suggests it belongs to a well known company or service.
- Your site was hacked. Outdated software, like old WordPress plugins or themes, can let attackers upload phishing pages to your account without you noticing.
- Your site looks like phishing, even though it isn’t. This mostly happens to sites where the first thing a visitor sees is a login form, with little else to explain what the site is or who runs it. New websites with little history are judged more strictly.
The last case is a false positive, and it does happen. Fortunately, it’s also the easiest to fix.
How to check what was flagged
- Check the status in the Google Transparency Report. Enter your website’s address on the Safe Browsing site status page. It shows whether your site is currently listed and what kind of issue Google found.
- Add your website to Google Search Console. Create a Google Search Console account and add your website. To verify that you own it, follow our article on verifying your website in Google Search Console.
- Open the Security Issues report. In Search Console, go to Security & Manual Actions > Security Issues. It lists the type of issue Google found and some example URLs of pages that were flagged.
Note that the example URLs are only a sample. Other pages on your site may have the same problem.
How to fix the issue
If your site contains deceptive content
Remove it completely. That means all copied login pages, brand names and logos, not just the pages listed in Search Console. If you didn’t put the content there yourself, your site was likely hacked:
- Remove all files you don’t recognize.
- Update your website software, plugins and themes, or reinstall them from a clean copy.
- Change the passwords of your website’s admin accounts and your hosting account.
If your site is legitimate
Make it obvious to both visitors and Google’s scanners what your website is:
- Add a public homepage. Don’t make a login form the first thing visitors see. Explain what your website or service does, so there is real content before anyone is asked to log in.
- Say who runs the site. Add an about page, contact information and, if you collect user data, a privacy policy.
- Use your own branding. Don’t use the names, logos or designs of other companies, and don’t use templates that copy the look of well known login pages.
Request a review
Once everything is fixed, ask Google to review your site:
- In Search Console, open the Security Issues report.
- Check I have fixed these issues and click Request review.
- Describe what you did. If your site is legitimate, explain what the site is for and what the login form is used for. A clear, specific explanation helps.
Google says phishing reviews usually take about a day, and malware reviews a few days. The result will appear in Search Console.
Only request a review once, and only after everything is fixed. Don’t submit a new request while one is still pending. Requesting reviews for sites that aren’t fixed slows down your next review, and repeated rejections can block you from requesting reviews for a while.
If you can’t use Search Console, you can also report an incorrect phishing warning through Google’s report error form.
Other browsers and blocklists
Microsoft Edge uses its own blocklist, Microsoft Defender SmartScreen. If Edge still shows a warning after Google removed yours, you can report the mistake from the warning page in Edge, or through Microsoft’s SmartScreen feedback site.
Antivirus software and other security tools may use their own blocklists as well. If one of them still blocks your site, contact that vendor directly.
Preventing future warnings
- Keep your website software, plugins and themes up to date.
- Keep a public homepage that explains what your site is, in front of any login form.
- Never host copies of other websites’ login pages, not even for testing.
- Keep your Search Console account, so you’re notified quickly if Google finds a problem again.