"Deceptive site ahead" on a WordPress site: what the red warning means and how to get it lifted

The red full-page warning comes from Google Safe Browsing, a list of dangerous sites that most major browsers check before they open a page. Your site is on it because Google found something on the site, or loaded by it, that it classes as social engineering (phishing), malware or unwanted software. The warning goes only after the cause has been removed and Google has looked at the site again.

You cannot switch it off for your visitors from WordPress or from your hosting account. The work has three parts, in this order: find out what Google found, remove it, and ask for a review.

What the warning says in each browser

Chrome no longer shows the words "Deceptive site ahead". Its help page says the red warning now reads "Dangerous site", and Chrome's source code has that one heading for all three kinds of problem. Firefox still uses the older wording, and so does Google's own page for site owners about social engineering. Whichever wording you see, the problem and the way out are the same.

In Chrome, select "Details" on the warning. The paragraph that opens says which of the three it is: that Google Safe Browsing recently found malware, recently found phishing, or found harmful software on the site.

Microsoft Edge takes its warnings from a list of Microsoft's own. That list, and what Firefox and Safari consult, are covered further down.

How to tell it from a certificate warning

Go by the words on the page.

• A Safe Browsing warning is a full-page red screen that calls the site dangerous or deceptive. Chrome's help says that page means the site is flagged as unsafe by Google Safe Browsing. It is about what the site serves.
• A certificate warning is also a full page. In Chrome it says "Your connection is not private" and shows a code such as NET::ERR_CERT_DATE_INVALID. It is about the certificate that secures the connection, and it is fixed at your host: see how to fix "Your connection is not private".
• A page that loads, but is not shown as fully secure, is neither. On a site that has a certificate, the page is fetching something over plain http. See how to fix mixed content warnings.

Neither of the last two has anything to do with Safe Browsing, and a review request does nothing for them.

Find out what Google found

Do this before you change anything on the site. The names and addresses Google gives you are what you clean, and what you later describe in the review request.

The report's issue names map to the three kinds of problem like this.

In Google's own table of what it does about each kind of problem, the browser warning page belongs to malware and unwanted software and to phishing and social engineering. Hacked spam content is dealt with in search results.

The cause may not be a file on your server

A page is judged by everything it loads. Google's guidance is plain that a site can be flagged for content it does not host:

• An advert. Deceptive content inside an ad counts against the page that shows it. Ad networks rotate what they serve, so Google suggests reloading the page several times, and looking at both the mobile and the desktop view, before deciding an ad slot is clean.
• A script or frame from another server. Google's examples of injected code include a script tag that loads its code from an attacker's domain, and a hidden frame that loads a malicious site.
• A pop-up or a redirect. A page with no visible ad can still send visitors on to a deceptive page, and that counts against it too.
• A link or a download. Linking to a site that offers harmful downloads, or offering such a file yourself, is enough.

WordPress lets a plugin or a theme add a script by its full address, so the code a page runs can sit on any server. Look at what your plugins and theme load, and at any advert, chat or tracking code that was pasted into a settings box. In the list of resources that "View tested page" shows, every domain should be one you can account for.

Google notes that attackers often show their code only to certain visitors, such as those arriving from a search engine. How to check whether your WordPress site has been hacked shows how to request a page as a visitor from Google, and the hacked-site check makes both requests for you and compares them.

Remove the cause

If the report names a hack, or you find code nobody on your side added, this is a break-in and it is cleaned as one. Start with the hacked site runbook for the first hour, then follow how to remove malware from a hacked WordPress site, which covers the clean-up in full.

If the cause is an advert, an embed or a script you added yourself, remove that ad unit, embed or plugin. Then check the sample addresses again.

What "removed" has to mean for the review to pass

• The content is gone from every page. Google says that fixing only some pages earns no partial return, and that every issue in the report has to be fixed. The samples are examples. Search the rest of the site for the same thing.
• The way in is closed. Google's list of what must be true before a review includes correcting the vulnerability, not only removing what the attacker left. A cleaned site with the same out-of-date plugin or the same stolen password can be broken into again, and flagged again.
• The site is back online and Google can read it. The cleanup guide has you take the site offline while you work. For the review, the pages must be reachable, and not blocked by robots.txt or by a noindex tag. In WordPress, check that "Discourage search engines from indexing this site" under Settings, Reading is not ticked, and that no maintenance page is still in front of the site.
• Each flagged address answers properly. A page you keep returns a clean page. A page the attacker created is deleted, and its address returns a 404. Google's guidance also describes malware placed in a site's error page, so request an address that does not exist and read what comes back.

Google recommends checking with curl or Wget and not with a browser. This prints the status code an address answers with: 200 for a page that is there, 404 for one that is gone. The HTTP status and redirect checker shows the same without a terminal.

Ask Google for the review

How long each kind of review takes

These are Google's own figures, from its guide to requesting a review and its Search Console help.

After an approval, Google's guide says warnings in browsers and in search results are removed within 72 hours. Its Search Console help adds that an update can take a day or two to reach browsers, so one can go on showing the warning for a short while after the site status page has cleared.

If Google decides the problem is still there, the warning stays, and the report may show more sample addresses to help you look again.

What Google says about repeat offenders

Google introduced the term in 2016 for a site that switches back and forth between clean and harmful in order to pass a review. Such a site cannot request another review through Search Console for 30 days, the warnings stay up, and the owner is told by email. The same announcement says that hacked sites are not classified as repeat offenders, only sites that post harmful content on purpose.

That does not make an early request harmless. Google's Search Console help says a request sent before the issue is fixed can lengthen the turnaround of the next one, and can even get a site marked as a repeat offender.

Lists other than Google's

A review at Google clears Google's list. Browsers that consult that list follow it. Other products keep lists of their own, and each has to be asked separately.

• Microsoft Edge uses Microsoft Defender SmartScreen, which checks sites against Microsoft's own list of reported phishing and malware sites. Microsoft's help gives the route from the warning page: select "More information", then "Report that this site doesn't contain threats", and follow the instructions on Microsoft's feedback site.
• Firefox checks pages against lists of reported sites that it updates about every 30 minutes. For a site listed as deceptive that has been repaired, or was listed in error, Mozilla points to Google's report form. Google's guide says that form also triggers a review of a cleaned phishing page.
• Safari checks an address with Google Safe Browsing and with Apple, by Apple's account, and may also use Tencent Safe Browsing on devices set to the China mainland or Hong Kong region. WebKit's warning for a deceptive site carries a link for reporting an error to the provider that listed it.
• Antivirus and security products. WordPress's documentation notes that desktop antivirus applications and other search engines keep blacklists too, and that a visitor may be using any of them. The warning a visitor sees names the product that raised it. Ask them which one, and use that product's own form.

What not to do

• Do not request a review before the site is clean. Google says it only prolongs the time the site stays flagged, and the next request can take longer.
• Do not send the request twice. Google asks you to wait for the decision on the first.
• Do not just move the site to a new domain. The warning follows what the pages serve. Copy the same files and database to a new address and the same content is there for Google to find, since it checks the pages it indexes for malicious scripts and downloads. The old address stays flagged, and every link, bookmark and search result that points to it still meets the warning.
• Do not tell visitors to click through. Chrome's warning offers a way past it, and Chrome's help says using it is not recommended. Until the review passes, assume the page can harm the people who open it.

When to hand it over

Get help when the report names a hack and you cannot find the code, when a review comes back refused and you do not know why, or when the site takes orders and each day behind the warning costs sales.

Our malware removal service is a one-time clean-up with hardening, a blacklist removal request and a written report. The company that issued the warning reviews the site and decides, so nobody can promise the outcome or how long it takes.