Clean the site and ask Google to review the listing

Why it matters

Google's Web Risk list flags this site as dangerous (malware, phishing or unwanted software), so browsers and search can show visitors a red warning page. It usually means the site was compromised or is hosting something harmful.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. Treat this as a security incident. Tell whoever runs the site and hosting, and keep a copy of the current state (files and database) before you change anything, so you can investigate how it happened.
2. Verify the site in Google Search Console (a DNS record is the most reliable way) and open its Security Issues report. It shows the kind of problem Google found and example URLs. Do not rely on a quick page check alone, because malicious content can be shown only to some visitors, such as people arriving from search or on mobile.
3. Stage 1, contain. If you cannot clean the site quickly, take it offline or show a maintenance page. Change every password and key for the hosting, control panel, SSH or FTP, database, CMS administrators and any API keys stored on the server. Remove accounts and keys you do not recognise.
4. Stage 2, find and remove the cause. Compare the files with a known clean copy or a fresh install of the same software, and look for unknown files, recently changed files, injected scripts (obfuscated JavaScript, hidden iframes, redirects), unknown scheduled jobs and unknown administrators. Check your own third-party scripts and ad or widget code as a possible source. Restore from a backup taken before the compromise when you have one.
5. Stage 3, close the hole. Update the CMS, plugins, themes and server software, remove what you do not use, and fix the weakness that was used. Without this the site is likely to be infected again.
6. Stage 4, request a review only when the site is clean. In Search Console open the Security Issues report and choose Request a review, with a short description of what you removed and fixed. Requesting a review while the problem still exists only prolongs the listing.
7. Be patient and do not expect a fixed date. Google's guidance says reviews typically take about a day for phishing and a few days for malware, and the warnings are lifted afterwards. If the review is rejected, Google shows more example URLs to guide further cleanup.
8. Afterwards, keep software updated, use unique passwords and two-factor authentication, keep off-site backups, and consider file-integrity monitoring.

# look at how the page looks to a search visitor and to a phone
curl -s -A "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 Chrome/126 Mobile Safari/537.36" -e "https://www.google.com/" https://example.com/ | grep -i -E "<iframe|<script[^>]*src=|eval\(|atob\(|document\.write"

# files changed in the last 7 days (run on the server, in the web root)
find . -type f -mtime -7 -not -path "./.git/*" | head -n 100

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Google Web Risk check