How to remove Google's “dangerous site” warning, step by step

Which warning you have

There are several different warnings and they aren't resolved in exactly the same way. Identify yours:

• “This site may be hacked”, under your Google search result. Google has detected content added by a third party, almost always spam pages or links. According to Google's own help, the label isn't removed until the site owner takes action: it doesn't go away on its own.
• “Deceptive site ahead” (red screen in Chrome): Safe Browsing believes the site is trying to trick visitors, for example with phishing pages imitating a bank or a delivery company. Often an attacker created them inside your site without you knowing.
• “The site ahead contains malware” or “harmful programs”: the site tries to install something on the visitor's computer or loads resources from a site that does.
• “Not secure” in the address bar: this isn't malware. It means the page doesn't use HTTPS or the certificate has a problem. It's fixed with a certificate, not a review.

Step 1: check the status from outside

Look up your domain in Google's Safe Browsing transparency report. It tells you whether Google currently considers the site dangerous. Write down what it says: it's your starting point and you'll use it to check the result at the end.

Also search Google for site:yourdomain.com. If pages show up that aren't yours (Japanese text, casino, pharmacy, fake copies), you know what kind of content you'll have to remove.

Step 2: open Search Console

Google Search Console is Google's free tool for site owners, and it's where you request the review. If your site isn't verified, do it now. I recommend a Domain property, verified with a TXT record in DNS: it covers http, https, with and without www and every subdomain, and it doesn't depend on a file inside the site that the attacker could touch.

Step 3: read the Security issues report

In the side menu, open Security & Manual Actions → Security issues. If everything is fine, you'll see a green check mark. If not, you'll see the list of detected issues. Google groups them into three families:

• Hacked content: malware, code injection, content injection or URL injection (new pages created by the attacker).
• Malware and unwanted software: malicious downloads or links to them.
• Social engineering: deceptive pages, deceptive embedded resources (for example, ads that imitate system buttons) and other phishing variants.

Expand each issue: you'll see a list of sample URLs. Google notes that it's a sample, not the complete list. Copy them into a document, because they're the starting point of the cleanup and you'll use them to check it. Also read the Learn more link for each issue type: it explains exactly what Google saw.

Step 4: actually clean the site

This is the part that decides whether the review succeeds. You have to remove everything Google has seen and also what it hasn't:

• The spam or phishing pages created by the attacker (and remove them from the sitemap if they were added). They should return 404 or 410.
• The code injected into files, templates and the database.
• The backdoors, users and scheduled tasks that would let them reinfect the site.
• The flaw they got in through: an outdated plugin or module, a leaked password, a poorly protected upload form.

If the site is WordPress, the guide on how to tell if your WordPress site is hacked walks through where to look; if it's a PrestaShop store, the one on what to do if your PrestaShop store is hacked; for anything else, how to recover a hacked website.

Step 5: check before you request anything

Before you click any button, look at the site the way Google would:

1. Open every sample URL from Search Console in a private window, and from your phone on mobile data. They should return a 404 error or show your legitimate content.
2. In Search Console, run URL Inspection on some of them and click Test live URL: you'll see the HTML Googlebot receives, which may differ from what you see if the malware singles out the search engine.
3. Repeat the test with curl pretending to be Googlebot, to rule out content served only to the crawler:

curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://your-site.com/ | grep -iE "casino|viagra|<script[^>]+src=" | head

If any of this fails, you're not done yet. Requesting the review too early only delays the next one.

Step 6: request the review

Go back to Security issues and click Request review. Google asks that the problem be fixed on all affected pages and for all the issues listed, not just some. In the text, explain in a few concrete lines:

• What you found (for example: “2,300 spam pages generated by a PHP file in /wp-content/uploads/ and an administrator user created by a third party”).
• What you did to clean it (files replaced with the originals, pages removed with 404, database reviewed).
• What you did so it doesn't happen again (the vulnerable plugin updated or removed, passwords changed, users reviewed).

If you bought the domain recently and the problem came from the previous owner, say so in the request: Google takes it into account. For phishing warnings, besides Search Console there's the Safe Browsing error report form, which also triggers a review of pages that are already clean.

How long it takes

Google receives the request, sends you a confirmation email and then another with the decision. According to its documentation on how to request a review, phishing reviews are resolved in about a day, malware reviews in a few days and reviews of sites hacked with spam can take several weeks. Once approved, the warning disappears from Chrome and the search results gradually.

Don't send another request while one is pending. And don't request one without cleaning first: Google warns this can lengthen the response and get you treated as a repeat offender. Its repeat offender policy applies to sites that keep switching between clean and harmful, and it blocks them for 30 days with no option to request reviews.

If Google rejects the review

A rejection means Google still finds the problem. Don't request it again with nothing changed: go back to step 3, see whether the sample URLs have changed and look for what was left behind. In my cases it's usually one of three things: a backdoor that regenerated the pages, content served only to Googlebot, or a forgotten subdomain (an old staging. or blog.) that is also infected.

Other blocklists

Besides Google, your domain may be on other services' lists (antivirus vendors, email filters, Microsoft Defender SmartScreen). Each one has its own removal procedure. The free scan checks the most common ones.

If you want me to take care of it

I clean the site, request the review in Search Console with the right wording and follow up until the warning is gone. The Google review is included in the cleanup; other services' blocklists are a separate process.

• WordPress: €219 excluding VAT, with a 90-day guarantee (WordPress malware removal).
• PrestaShop or WooCommerce: €349 excluding VAT, with the payment review included (hacked PrestaShop repair).
• Any other website: all the options, and how to order the cleanup with priority over my other work, in hacked website repair.

Sources

• Google Search Help: “This site may be hacked” message (it isn't removed until the site owner takes action).
• Search Console Help: Security issues report (the three families of issues, sample URLs as a sample only, and the review once everything is fixed).
• Search Console Help: add a property (a Domain property, verified via DNS, includes http, https and subdomains).
• web.dev: request a review (review times: phishing about a day, malware a few days, spam up to several weeks).
• Google Search Central: Safe Browsing repeat offenders (the status lasts 30 days).
• Safe Browsing transparency report (current status of the domain).