Why does my antivirus or Google flag my own website as "dangerous"?

You open your own website and, instead of your homepage, you get a red screen: "Deceptive site ahead" or "Dangerous site." Or your antivirus simply blocks access. It's an ugly feeling — like someone seized your business overnight.

The good news is that this is almost always fixable. The warning isn't a permanent punishment; it's a temporary label placed by an automated safety system. But to lift it you have to do things in the right order: first understand why it appeared, then clean the actual cause, and only at the end request a review. If you request the review before cleaning, you make it worse — and the next attempt takes longer. Let's go through it step by step.

What the warning actually means (and who shows it)

Behind the "Deceptive site ahead" or "Dangerous site" messages sits Google Safe Browsing — a shared safety list used not only by Chrome, but also by Firefox, Safari and many antivirus programs. It isn't a personal punishment from Google. It's a single database that several programs check at once.

When your site lands on that list, every visitor using those browsers sees the red screen before entering. The main categories:

• "Malware" — harmful code on your pages;
• "Deceptive / phishing" — pages that appear to steal data;
• "Unwanted software" — suspicious downloads.

Your antivirus can also block locally, independently of Google, if it detects a script. In both cases, the label lifts once you clean up and request a re-check.

Why your own site of all sites got flagged

In most cases the site really was compromised — even if it looks perfectly normal to you. The malicious code is often hidden, or only triggers for mobile visitors or people arriving from Google. Common causes:

• A hacked site: someone injected redirects, pharma spam or hidden phishing pages. This is the number-one cause.
• An outdated CMS, theme or plugins (an old WordPress is the classic target).
• An admin account with a weak or stolen password.
• An infected third-party script: an ad, a widget, a plugin from a developer who abandoned it.
• A download file flagged as malware.
• A false positive: sometimes the antivirus is simply wrong — especially on new sites, sites with a login form, or on shared hosting where an infected "neighbour" taints the shared IP.

How to diagnose the problem

Don't guess — look where the system tells you exactly what it found:

• Google Search Console → Security & Manual Actions → Security Issues. Here Google shows what it detected and sample pages. If you don't have an account, add it now (verify via DNS or a file — it's free).
• Google's Safe Browsing Site Status report, where you check your domain's current status.
• VirusTotal — paste the URL and see which engines flag it and why.

Then look at your code and files: strange redirects, hidden iframes, unknown admin users, recently modified files. Test the site from a phone and in an incognito window — the bad code often only shows under certain conditions, not while you're logged in on desktop.

How to clean the site, step by step

Do things in this order:

• Back up the current state (even infected) — as evidence, in case you break something.
• Change ALL passwords: CMS admin, hosting/cPanel, FTP, database, email.
• Update the CMS, themes and plugins; delete anything you don't use.
• Find and remove the injected code: scan with a tool (on WordPress — Wordfence, Sucuri, MalCare) or compare files against a clean version.
• Delete unknown admin users and suspicious cron jobs.
• If you have a clean backup from before the infection, restore it — often the fastest route.

Don't just hide the symptom (the redirect). If you don't find the entry point, the infection returns within days. If you're unsure, get a specialist involved before requesting a review — a rejected request slows you down.

How to request a review (and how long it takes)

Only after you're sure the site is clean:

• In Search Console → Security Issues → "Request Review." Briefly describe what you found and what you cleaned.
• For an antivirus false positive: each has a reporting form (Google Safe Browsing, Norton, McAfee, Avast, etc.). Submit the URL and explain briefly.

As for timing, Google's re-check for malware or deceptive content usually takes a few days. Don't send repeated requests — you reset the queue and delay the answer.

The most important warning: if the site is still infected when you request the review, the request is rejected, and next time the process takes longer. Clean everything first, verify again, then submit.

How to stop it from happening again

Once it's clean, keep it that way:

• Keep the CMS, themes and plugins always updated — or choose a platform that doesn't depend on dozens of plugins.
• Automatic backups, stored off the server.
• Strong passwords plus two-factor authentication.
• A valid SSL certificate and HTTPS everywhere, with no mixed content.
• Fewer plugins means fewer doors in.

Many small-business sites hit this precisely because they run on a WordPress with dozens of plugins left untouched for years. At MPO Web Studio we build fast sites with a small attack surface and maintenance included, delivered remotely across the country — and we build you a free demo first, so you see the result before paying anything. If you're stuck right now with a red screen on your own site, message us on WhatsApp and we'll help you clean it and request the review.