A red warning from Google (Deceptive site ahead): what it means and how to ask for a review

Security·· 32 views· 3 min read

The short answer: if someone opening your site sees a red browser page saying “Deceptive site ahead” or “The site ahead contains malware”, Google has flagged it as dangerous. Almost always it is because the site was hacked and someone put a fake page or malicious code on it. The warning only goes after you clean the site and ask for a review.

What the site needs

What What to do
“Deceptive site” A page imitates another (a bank, an e-mail login) to steal data. It is usually hidden in a folder on your site.
“Malware” The site tries to install or download something harmful to its visitors.
“Dangerous site” A more general warning. See the reason in Google’s tool.
Where to see the reason In Search Console, under “Security issues”, if the site is registered: Search Console.
How long it lasts Until Google reviews the site once clean. Asking before cleaning only delays it.

Getting started

1 Do not delete everything blindly. First see what is there: Search Console shows sample addresses.
2 Scan the site: Malware scan in cPanel and, if the warning persists, where an infection hides.
3 Restore a clean copy if you have one: After a hack, which backup to restore.
4 Change all passwords (cPanel, FTP, database, WordPress) and update whatever is out of date: Protecting the WordPress login.
5 Only once clean, ask for the review in Search Console, explaining what you did. The answer may take a while; the warning disappears when Google confirms.
If you ask for the review without cleaning, the request is refused and the wait gets longer. If the fake page comes back, the attacker’s way in was not closed (a password, an old plugin): cleaning without closing the door does not solve it. Files that must never be public.
If you received a fake message and clicked: How to recognise a fake message. To stay protected afterwards: Ransomware.

Does your site have the red warning and you want help cleaning it? Open a ticket with the address, right away.

Open a support ticket

SEE ALSO

Getting your site indexed in Google Search Console, step by step

Scanning your site for malware in cPanel: what Imunify finds and what to do with the result

The scan says clean but the site still redirects: where an infection hides

After a hack, which backup do you restore? Choosing a clean copy

How to recognise a phishing e-mail or message, and what to do if you clicked

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.59/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Security 499 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Security 402 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
Security 911 How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
Security 812 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
Security 366 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Security 559 How to activate and install a paid SSL certificate Every domain here already gets a free certificate automatically - see what an SSL certificate is. This page is only for...