You check your website and find a full-screen red warning telling visitors your site is dangerous. Panic sets in. Your phone stops ringing, enquiries dry up, and customers are being actively warned to stay away from your business.
Google Safe Browsing has flagged your site, which means it detected something harmful like malware, phishing pages, or malicious scripts.
In this guide we will walk you through why it happens, how to find the problem, and the step-by-step process to clean your site and get the warning removed.
What the Google Safe Browsing warning means
If Google flags your site as “dangerous,” it’s telling you that Google Safe Browsing has detected malware, phishing, or unwanted software on your pages.
The first step is to check the Security Issues report in Google Search Console to see exactly what Google found. From there, you can remove the malicious content and submit a review request to get the warning lifted.
So what exactly is Google Safe Browsing? It’s a free service that scans billions of websites looking for harmful content. When it spots a threat on your site, Google adds you to a list of dangerous websites and shows a big red warning to anyone who tries to visit.
There are different warnings that’ll be displayed depending on the exact issue.
“Not secure”: This grey warning in your browser’s address bar simply means your site doesn’t have an SSL certificate and isn’t using HTTPS encryption. It’s a privacy concern, but doesn’t always mean your website has been comprimised. Just that your SSL certificate isn’t setup or ran out.
“Dangerous site”: This full-screen red warning means Google has found something actively harmful on your pages, like malware, malicious scripts, unwanted software installers, or phishing content. It’s far more serious. The message will vary depending on the issue so you can get some idea of what’s up.
“The page ahead may try to charge you money“: This appears if your website has been comprimised and is redirecting to a malicious website that may charge the user money by deception or phishing scams.
Dangerous download blocked: If your website’s downloading a file automatically or if you offer downlaodables that are comprimised these will usually get flagged. In Chrome, the download will be blocked and beneath it, it’l read “dangerous download blocked”. Malicious files aren’t always flagged, as they may bypass the browsers virus/malware scanner.
There’s also a dozen other warnings covering things like infected Android or iOS apps, social engineer warnings, and more.
Why Google flagged your website as dangerous
Google’s automated scanners crawl the web constantly, looking for threats. When they find something suspicious on your site, you get flagged. For WordPress sites in particular, there are a handful of common reasons this happens.
Your site was hacked
Here’s the tricky part: hackers often inject malicious code without leaving any visible signs. Your site might look perfectly normal to you while quietly doing something harmful in the background.
Hackers typically get in through weak admin passwords or vulnerabilities in outdated software. You might not even realise your site has been compromised until Google sends you a warning.
Malware or malicious scripts were detected
Malware is software designed to harm your site or the people visiting it. These scripts can hide in your theme files, plugins, or even your database.
One common example is a “drive-by download.” This is when malware automatically downloads to a visitor’s computer just by loading your page. Google’s scanners are specifically looking for this kind of threat, and finding one triggers an immediate warning.
Phishing pages or deceptive content
Phishing involves creating fake login pages that look legitimate to steal usernames and passwords. Sometimes attackers create these pages in hidden directories on otherwise trustworthy websites.
The site owner often has no idea the pages exist. Meanwhile, Google’s scanners find them and flag the entire site.
Unsafe third-party ads or plugins
Even if your own code is perfectly clean, resources loaded from external sources can cause problems. Malicious content can be served through ad networks or plugins that pull content from compromised servers. Sometimes, even legitimate ad networks can have comprimised ads so if you do notice an issue and run ads, don’t rule your ad network out.
This is one of the more frustrating scenarios because you haven’t done anything wrong yourself. Yet your site still gets flagged because of something a third party is serving.
Outdated WordPress core, plugins, or themes
This is the most common cause for WordPress sites being flagged. Outdated software contains known security vulnerabilities, and hackers actively exploit them.
Think of it like leaving your front door unlocked. The vulnerability is public knowledge, and attackers have tools that scan for sites running old versions. Keeping everything updated is one of the most important parts of website maintenance but sometimes, updated plugins themselves contain secuirty issues or bugs that can break your website. We recommend using a care plan that’ll help minimise the chance a bad update happens.
How to check if Google flagged your site
You can verify your site’s status using a few different methods. The official Google tool is the most definitive, but there are other options too.
Use the Google Safe Browsing check URL tool
Head to transparencyreport.google.com/safe-browsing/search and enter your website’s URL. This is Google’s official tool, and it’ll tell you straight away whether your site is on the list of dangerous websites.
Review security issues in Google Search Console
If you’ve verified your site in Google Search Console, you can access the “Security Issues” report. This is actually more useful than the transparency report because it tells you exactly which URLs are flagged and why.
The report gives you a clear starting point for your investigation. Instead of guessing where the problem might be, you’ll know exactly which pages to examine.
Test your site in an incognito browser window
Opening your website in an incognito or private browser window bypasses your browser’s cache. This shows you exactly what a first-time visitor would see.
If your site is flagged, you’ll encounter the full-screen red warning page. It’s a quick way to confirm the problem without any special tools.
What visitors see when Google issues a web warning
When someone tries to visit a flagged site, they’re stopped by a large, full-screen red warning. The message typically says “Dangerous Site” or “Deceptive site ahead” and explains that the site may contain malware or attempt to steal information.
Most visitors leave immediately. They don’t click through, they don’t come back, and they certainly don’t become customers. The business impact is direct: lost trust, lost leads, and lost sales.
Click here to preview your posts with PRO themes ››
| Warning Type | What Visitors See | What It Means |
|---|---|---|
| Dangerous site | Red screen with “Dangerous” | Active threat detected, such as malware or malicious scripts |
| Deceptive site | Red screen with “Deceptive” | Phishing or social engineering suspected |
| Not secure | Grey padlock warning in URL bar | Missing SSL certificate, no HTTPS encryption |
How to remove the dangerous site warning from Google
Getting the warning removed involves a clear sequence of steps. Follow them in order, and don’t skip ahead to requesting a review before your site is actually clean.
Step 1. Confirm the warning type and scope
Start with the Security Issues report in Google Search Console. This tells you exactly which pages are flagged and what type of threat Google detected.
Understanding the specific issue is crucial. A malware infection requires different cleanup than a phishing page hidden in a subdirectory.
Step 2. Scan your website for malware
Use a reputable security scanner to find malicious code. Free options like Sucuri SiteCheck work well for an initial scan. For more thorough results, plugin-based scanners like Wordfence can examine your files and database in detail.
The scan results will show you infected files and code injections. Make note of everything that’s flagged because you’ll be cleaning it in the next step.
Step 3. Remove malicious code and fix security issues
This is where the real work happens. You’ll be cleaning infected files, removing any “backdoors” hackers left behind, and updating all compromised passwords.
If the infection is severe, you may be better off restoring from a known clean backup. This is faster and more reliable than trying to clean a heavily compromised site file by file.
If you’re not comfortable doing this yourself, it’s time to call in professional help. A botched cleanup can make things worse or leave hidden threats behind.
Step 4. Request a security review from Google
Once you’re certain your site is completely clean, submit a review request through the Security Issues report in Google Search Console.
Here’s the important part: your site absolutely has to be clean before you request the review. If Google’s scanners still find problems, your review will be rejected. Failed reviews cause significant delays because you’ll have to wait before submitting again.
Step 5. Monitor your site during the review period
The review process typically takes a few days to a week. During this time, keep monitoring for any signs of reinfection.
You can check whether the warning has been removed by using the Google Safe Browsing check tool or visiting your site in an incognito window. Once the warning disappears, your visitors will be able to access your site normally again.
How to prevent future Google Safe Browsing warnings
Prevention is always easier and cheaper than cleaning up a hacked site. A few ongoing practices can dramatically reduce your risk.
Keep WordPress core, plugins, and themes updated
This is your first line of defence. Use automatic or scheduled updates to ensure you’re always running the latest versions.
Even “minor” updates often contain critical security patches. A plugin update that seems unimportant might actually be closing a vulnerability that hackers are actively exploiting.
Install security monitoring and malware scanning
A security plugin like Wordfence or Sucuri Security provides ongoing, real-time monitoring. These tools can often catch threats before Google’s scanners do.
That means you can fix issues proactively rather than finding out about them from a customer who can’t access your site.
Use only trusted plugins and third-party content
Before installing a new plugin, take a moment to vet it. Check the reviews, look at when it was last updated, and research the developer’s reputation.
Avoid “nulled” or pirated premium themes and plugins. They’re a common source of malware infections because someone has modified the code before distributing it.
Maintain regular backups for quick recovery
Regular, automated backups are your safety net. If your site gets hacked, a clean backup allows for fast and complete restoration.
Store your backups off-site, such as in cloud storage. If your server is compromised, backups stored on the same server might be compromised too.
Enable HTTPS with a valid SSL certificate
While this specifically prevents the “not secure” warning rather than the “dangerous” warning, it’s a baseline security expectation for all modern websites.
An SSL certificate encrypts data between your site and its visitors. It builds trust and is something Google expects to see on any legitimate business website.
When you need professional help with a flagged WordPress site
For many business owners, dealing with a hacked site is overwhelming. It’s time-consuming, technically complex, and risky if you’re not sure what you’re doing.
Complex hacks, repeated infections, or simply not having the time to fix it yourself are all good reasons to bring in a professional. At Site Design Squad, we offer a one-off Fix My Website service for emergency cleanup, backed by a no-fix-no-fee guarantee.
For ongoing protection, our Website Care Plans include regular updates, security monitoring, and daily backups. The goal is to prevent these problems from happening in the first place, so you never have to see that red warning screen again.
Key Takeaways
Google flags sites with malware, phishing, or malicious content Check Google Search Console for specific security issues Scan, clean malware, then request Google security review Keep WordPress core, plugins, and themes regularly updated Use security monitoring and maintain regular site backups
FAQs
A “not secure” warning means your site lacks HTTPS encryption. A “dangerous site” warning means Google Safe Browsing detected an active threat like malware or phishing. The latter is far more serious and requires immediate action.
Yes, being flagged can significantly impact your visibility. Google may demote or remove flagged pages from search results. The warning itself also drives visitors away. Resolving the issue quickly minimises lasting damage.
Google typically processes security review requests within a few days, though complex cases may take up to a week. Make sure your site is fully cleaned before submitting. Rejected reviews cause delays because you’ll have to wait before resubmitting.
No. Google Safe Browsing uses automated scanning rather than user reports to detect threats. There’s no individual “reporter” to identify. Focus on fixing the detected issues rather than trying to find out how Google discovered them.
A rejected review means Google still detects issues on your site. Run another thorough malware scan, check for overlooked backdoors or signs of reinfection, clean completely, then submit a new review request.
