"Deceptive Site Ahead" or "Dangerous Site" Warning: How to Fix It

On this page

1. Why it happens
2. Step 1: Confirm the issue
3. Step 2: Clean the site thoroughly
4. Step 3: Close the hole
5. Step 4: Request a review
6. Step 5: Check other blocklists
7. Prevent it happening again

A red full-screen warning saying "Deceptive site ahead" or "The site ahead contains malware" is one of the worst things that can happen to a business website. Most visitors turn back immediately. The warning comes from Google Safe Browsing, which is used by Chrome and other browsers, and it can be removed once the cause is fixed.

Why it happens

• Hacked site: hidden phishing pages, malicious redirects or injected malware, the most common cause
• Compromised third-party scripts loaded on your pages
• Hosted downloads flagged as harmful
• Open redirects abused by spammers
• Occasionally, a false positive

Step 1: Confirm the issue

• Check Google Search Console's Security issues report, which lists the problem and sample URLs
• Check your site in Google's Safe Browsing site status tool (Transparency Report)

Step 2: Clean the site thoroughly

• Take a backup of the current state for investigation
• Scan files and database for malware
• Remove malicious files, unknown admin users and injected code
• Replace WordPress core, themes and plugins with clean copies
• Remove nulled (pirated) themes or plugins, a common source of infections
• Change all passwords: WordPress, hosting, database, SFTP

Partial clean-ups often leave backdoors, and the site gets reinfected. See signs your site is hacked, or get professional malware removal.

Don't miss hidden access points; see finding and removing backdoors.

Step 3: Close the hole

Find out how attackers got in: an outdated plugin, a weak password or a vulnerable theme. Update everything and harden logins; see securing your WordPress login.

Step 4: Request a review

In Search Console's Security issues report, confirm you've fixed the problems and request a review, explaining what you found and fixed. Reviews commonly take from a day to a few days. If the review fails, Google shows sample URLs that still have problems.

Seeing a label in search results instead? See removing "This site may be hacked".

Step 5: Check other blocklists

Some antivirus and security vendors keep their own blocklists. Check your domain on multiple site-reputation checkers and request removal where needed.

Prevent it happening again

• Keep everything updated, and remove unused plugins and themes
• Use a firewall and security monitoring
• Keep off-site backups
• Watch Search Console for security emails

See the WordPress security checklist.