webzod
account

Clean the site and ask Google to review the listing on WordPress

reputation.webrisk.listed · effort: a project

Why it matters

Google's Web Risk list flags this site as dangerous (malware, phishing or unwanted software), so browsers and search can show visitors a red warning page. It usually means the site was compromised or is hosting something harmful.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

  1. Put the site into maintenance mode or take it offline, and back up the files and database for analysis.
  2. Change every password. That means hosting, FTP or SSH, the database user (and the matching value in wp-config.php), and all WordPress administrator accounts. Delete users you do not recognise, and replace the secret keys and salts in wp-config.php, which signs out every session.
  3. Check core and plugin files against the official copies with WP-CLI. Plugin verification only covers plugins from wordpress.org, so premium and custom plugins and themes need a manual comparison with a clean copy. Review the output before reinstalling anything, then replace the core files from a clean download only if core files were reported as changed.
  4. Look in wp-content for files that do not belong, especially PHP files in uploads, and in the database for injected scripts in posts, options and widgets. Remove plugins and themes you do not use, including the inactive ones, and any that are abandoned or pirated.
  5. Update WordPress, all plugins and the theme to current versions, which closes the usual way in.
  6. Request a review in the Search Console Security Issues report once the site is clean. If you are not sure it is clean, ask your host or a security service to scan it first.
bash 
wp core verify-checksums
wp plugin verify-checksums --all    # only covers plugins hosted on wordpress.org
# review the output above first, then only if core files changed:
wp core download --force --skip-content --version="$(wp core version)" --locale=<your-locale>    # leaves wp-content alone; use your site language, for example en_US
wp user list --role=administrator
wp plugin list

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.