“Deceptive site ahead” and other Google warnings

The red warning in Chrome comes from Google Safe Browsing. Google has found something on the site that may trick or harm visitors, either because the site is hacked or because of ads or content embedded from other sites. It can be a fake login page, malware or code that sends visitors elsewhere. The warning reads "Dangerous site" or "Deceptive site ahead", and in search results Google may show "This site may be hacked" under your site. Firefox and Safari use the same lists, so they show the warning too.

The warning remains until the problem is fixed. Google rechecks the site automatically after a while, but it's faster to request a review in Search Console once the site is clean.

See what Google flagged

1. Look up your domain in Google's Safe Browsing site status. It shows whether the site is currently flagged as unsafe.
2. Log in to Search Console and open the Security Issues report. It shows which type of problem Google found, with example URLs.
3. If you don't use Search Console yet, add the domain and verify ownership with a TXT record in DNS. You add the TXT record wherever the domain's DNS is managed. If you have no access to DNS, add the site as a URL-prefix property instead and verify it with an HTML file in the root folder.

The type of problem shows where to look

• Deceptive pages means content that tricks visitors into giving away information or downloading something, for example a fake login page. The cause can also be ads or content from other sites embedded in yours.
• Hacked: Malware means the site is infected with malware or spreads it.
• Hacked: Code injection means harmful code in your pages, for example code that redirects visitors.
• Hacked: Content injection means spam text or spam links in pages you created.
• Hacked: URL injection means new pages the attacker created, with spam text or malicious links.

Clean up

1. Back up the files and the database before you delete anything.
2. Find the files behind the example URLs. If a URL points to a folder, for example under wp-content/uploads, open the same folder over FTP or in your hosting panel's file manager.
3. Delete what the attacker added, but don't stop there. Write down and lock out unknown administrators, change every password and update WordPress, plugins and themes, or the attacker comes back through the same vulnerability. Delete the unknown administrators last.
4. Remove ads or embedded content from other sites if the report points to them.
5. Paste the example URLs into URL Inspection in Search Console and run a live test, because the code can show Google something different from what it shows you. The URLs should return a 404 or show your own content.
6. Scan the site from outside with Sucuri SiteCheck. It shows whether the site still serves malware, and whether the domain is on blocklists other than Google's.

Request a new review

1. Once the whole site is clean, select Request Review in the Security Issues report.
2. Describe the problem, what you did to remove it, and how you checked that the site is clean.
3. Wait for a response. According to Google, a review takes from a few days to a few weeks. You get an email when Google receives the request and when it has been processed.
4. Don't submit a new request before you get a response. Submitting before the problem is fixed can make the next review take longer.

Once Google has confirmed the site is clean, the warning is removed.

If the warning doesn't go away

If the request is rejected, Google found more, and the report shows new examples. If the problem returns after every clean-up, the vulnerability the attacker uses is still open. Someone has to go through the files, the database and the server logs, which requires access to the hosting account and experience with WordPress security. If you can't verify the site in Search Console, you need access to the domain's DNS or to the files on the server.