Why does my antivirus or Google flag my own website as "dangerous"?

If Chrome, Firefox or Safari shows a red "Dangerous site" or "Deceptive site ahead" page on your own website, Google Safe Browsing has found malware, phishing or hacked content on it. In most cases the site really was compromised, even if it looks normal to you. Open the Security issues report in Google Search Console to see what was found, clean the cause and close the way in, then click "Request Review". If only Microsoft Edge or one antivirus blocks the site, that's a separate list with its own reporting route.

The warning isn't a permanent punishment, and it's almost always fixable. What matters is the order: first work out which system flagged you and why, then clean the real cause, and only then ask for a review. Asking before the site is clean only slows things down.

Which warning are you seeing?

Different warnings come from different systems, and each one has its own fix. Start by matching what you see:

The Google list matters most because it's shared: Chrome, Firefox and Safari all check Google Safe Browsing. Edge relies on Microsoft's own SmartScreen, and antivirus programs keep their own lists. If all you see is "Not secure" in the address bar, you haven't been blacklisted. That's a certificate problem, covered in why your browser says "Not secure".

What Google actually found

Google's Security issues report groups problems into a few families. Knowing yours tells you where to look:

• Hacked content: malware, injected code (malicious redirects, crypto-mining scripts), injected spam text and links, or whole spam pages an attacker created on your domain.
• Deceptive pages (social engineering): pages that imitate a bank, a browser or a login screen to trick people into handing over data.
• Deceptive embedded resources: the problem isn't your own code but something you load, such as an ad, a widget or a third-party image.
• Harmful downloads: a file on your site, or a link to one, flagged as malware or unwanted software.
• Uncommon downloads: a milder warning for files Google Safe Browsing hasn't seen before.

While you're there, also open the Manual actions report in the same section. It covers spam-policy problems rather than security, and those are fixed through a separate review.

Why your own site got flagged

In most cases the site really was compromised. The malicious code is often hidden: it may only fire for mobile visitors, for people arriving from Google or for visitors from certain countries, and never for you while you're logged in on your desktop. Common causes:

• A hacked site: injected redirects, pharma or casino spam, hidden phishing pages. This is the most common cause.
• An outdated CMS, theme or plugins. An old WordPress install is the classic target.
• Pirated ("nulled") themes or plugins, which often come with a backdoor already built in.
• An admin, hosting or FTP account with a weak or stolen password.
• An infected or deceptive third-party resource: an ad network, a widget, a plugin whose developer abandoned it. Ads rotate, so the bad one may not show every time you load the page.
• A downloadable file (an installer, a ZIP, a document with macros) flagged as malware.
• A domain name that looks very similar to a well-known brand, which can trigger Chrome's lookalike warnings.
• A genuine false positive. These are more likely on new domains, on pages with login forms, or on shared hosting with a poor reputation. Microsoft, for example, lists newly registered domains and the hosting provider among the reputation signals SmartScreen uses.

How to diagnose the problem

Don't guess. These tools tell you what was actually detected:

• Google Search Console → Security & Manual Actions → Security issues. It shows the issue type, sample URLs and the date the problem was first detected. No account yet? Add your site now. It's free, and you can verify ownership through DNS or an HTML file.
• [Google Safe Browsing site status](https://transparencyreport.google.com/safe-browsing/search) in Google's Transparency Report. Paste your domain to see its current status, even without Search Console access.
• URL Inspection → Test live URL → View tested page in Search Console. It shows the HTML and a screenshot as Google's crawler gets them, which is how you catch code that hides from you.
• A site: search. Type site:yourdomain.com into Google and look for pages you never created: pharma, casino, or pages in Japanese or another language you don't use.
• VirusTotal or an online scanner such as Sucuri SiteCheck for a second opinion on which engines flag the URL and why.

Then check the site itself: recently modified files, unknown admin users, odd scheduled (cron) tasks, redirect rules in .htaccess, unexpected files in the uploads folder. Remember that some code only fires for mobile visitors or for people arriving from search, so it may never show when you open the site the usual way. Google advises against opening suspected malware pages directly in your everyday browser, because they can infect your computer. The live URL test above, or a command-line tool such as cURL with Google set as the referrer, shows you what those visitors get more safely. If an ad is the problem, reload the page several times, because ads rotate. Your hosting provider can see the server logs and often runs its own malware scans, so ask them too.

How to clean the site, step by step

Work in this order:

• If visitors are being redirected or infected right now, put the site into maintenance mode or take it offline for a while. Google itself recommends this for hacked sites.
• Back up the current state, infected or not, as evidence and in case something breaks.
• Change ALL passwords: CMS admin, hosting/cPanel, FTP/SFTP, database, email. Turn on two-factor authentication wherever you can.
• Update the CMS, themes and plugins. Delete everything you don't use and replace any nulled software with the official version.
• Find and remove the injected code: scan with a security tool (on WordPress, for example Wordfence, Sucuri or MalCare) or compare your files against clean copies.
• Delete unknown admin users, suspicious cron jobs and files you can't explain.
• If a third-party ad or widget caused the flag, remove it or switch providers.
• If you have a clean backup from before the infection, restoring it is often the fastest route. Patch the hole straight afterwards, or the attacker gets back in the same way.

Don't just hide the symptom (the redirect). If you don't find the entry point, the infection usually comes back. If you're not comfortable reading code and server settings, get a specialist involved before you request a review; a rejected request only costs you time. For a WordPress site, our guide on how to tell if WordPress is infected and clean it goes deeper. Before you request a review, re-check the sample URLs from Search Console, run the live URL test again and repeat the site: search.

How to request a review (and how long it takes)

Only once you're confident the whole site is clean:

• In Search Console, open Security issues and click Request Review. Explain briefly what you found, what you removed and how you closed the entry point (updated plugin, new passwords, removed ad script).
• Google emails you when it receives the request and again when the review is complete.

On timing, Google's own help pages say malware reviews usually take a few days, while reviews of hacked spam content can take up to several weeks. After approval, allow a few more days for the warning to disappear everywhere, because the change has to travel between the Safe Browsing list, Chrome and Search Console.

Two rules save you time. Don't send another request while one is still pending. And don't request a review before the site is clean: Google warns this can slow down your next request or even get you marked as a repeat offender. If a request is rejected, read the reason, look for what you missed (often a leftover backdoor or spam pages), fix it, then submit again.

If it's Microsoft Edge or your antivirus

• Microsoft Edge (SmartScreen): on the block page, under More information, select the option to report that the site doesn't contain threats. You'll get a confirmation email from Microsoft's SmartScreen Reputation Group. If it's urgent, reply to that email.
• An antivirus: first make sure the site is genuinely clean; VirusTotal shows which engines flag it. Then use that vendor's false-positive route (usually a form or a support request), send the URL and explain briefly.
• A lookalike warning in Chrome ("Did you mean…?", "Fake site ahead"): this isn't a malware flag. Chrome compares your domain with popular sites, and Chrome's help page explains these warnings and links to instructions for site owners.

How to stop it from happening again

Once the site is clean, keep it that way:

• Keep the CMS, themes and plugins updated, or choose a platform that doesn't depend on dozens of plugins.
• Fewer plugins and third-party scripts mean fewer ways in.
• Automatic backups stored off the server, with a test restore now and then.
• Strong passwords, two-factor authentication and a separate account for each person who needs access.
• A valid SSL certificate and HTTPS everywhere, with no mixed content.
• Search Console connected to the site, with alerts going to an inbox someone actually reads. It's often where you hear about a problem first.

Many small-business sites end up here because they run on a WordPress install with dozens of plugins nobody has touched in years. At MPO Web Studio, a small web studio in Cluj-Napoca, we build fast sites with a small attack surface and maintenance included, and we make you a free demo first so you see the result before paying anything. If you're stuck right now with a red screen on your own site, message us on WhatsApp and we'll help you clean it and request the review.