# How to remove Google's “dangerous site” warning, step by step

> “This site may be hacked”, “Deceptive site ahead” or a malware warning: what each Google warning means and how to remove it in Search Console, step by step.

URL: https://webintacta.com/en/guides/google-says-site-is-dangerous
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** A “Deceptive site ahead” or “This site may be hacked” warning means Google has found malware, phishing or spam on your website. To remove it you clean the site first and then request a review in Search Console; according to Google, phishing reviews take about a day, malware reviews a few days and hacked-with-spam reviews can take weeks. The review request is included in a WebIntacta cleanup (€219).


By Jose Soriano (WebIntacta) · published 2026-10-24

Google's warning isn't an arbitrary penalty: it means its systems (Safe Browsing or Search) have found something harmful on your website. To remove it you clean the site and then request a review in Search Console. In that order, and without rushing the second step.

## Which warning you have

There are several different warnings and they aren't resolved in exactly the same way. Identify yours:

- **“This site may be hacked”**, under your Google search result. Google has detected content added by a third party, almost always spam pages or links. According to Google's own help, the label **isn't removed until the site owner takes action**: it doesn't go away on its own.
- **“Deceptive site ahead”** (red screen in Chrome): Safe Browsing believes the site is trying to trick visitors, for example with phishing pages imitating a bank or a delivery company. Often an attacker created them inside your site without you knowing.
- **“The site ahead contains malware”** or **“harmful programs”**: the site tries to install something on the visitor's computer or loads resources from a site that does.
- **“Not secure”** in the address bar: this isn't malware. It means the page doesn't use HTTPS or the certificate has a problem. It's fixed with a certificate, not a review.

## Step 1: check the status from outside

Look up your domain in [Google's Safe Browsing transparency report](https://transparencyreport.google.com/safe-browsing/search?hl=en). It tells you whether Google currently considers the site dangerous. Write down what it says: it's your starting point and you'll use it to check the result at the end.

Also search Google for `site:yourdomain.com`. If pages show up that aren't yours (Japanese text, casino, pharmacy, fake copies), you know what kind of content you'll have to remove.

## Step 2: open Search Console

[Google Search Console](https://search.google.com/search-console) is Google's free tool for site owners, and it's **where you request the review**. If your site isn't verified, do it now. I recommend a **Domain** property, verified with a TXT record in DNS: it covers `http`, `https`, with and without `www` and every subdomain, and it doesn't depend on a file inside the site that the attacker could touch.

> If you find owners or users in Search Console you don't know, remove them and also remove their verification method (the HTML file or the meta tag). An attacker with Search Console access can, for example, submit their own spam sitemaps.

## Step 3: read the Security issues report

In the side menu, open **Security & Manual Actions → Security issues**. If everything is fine, you'll see a green check mark. If not, you'll see the list of detected issues. Google groups them into three families:

- **Hacked content**: malware, code injection, content injection or URL injection (new pages created by the attacker).
- **Malware and unwanted software**: malicious downloads or links to them.
- **Social engineering**: deceptive pages, deceptive embedded resources (for example, ads that imitate system buttons) and other phishing variants.

Expand each issue: you'll see a **list of sample URLs**. Google notes that it's a sample, not the complete list. Copy them into a document, because they're the starting point of the cleanup and you'll use them to check it. Also read the **Learn more** link for each issue type: it explains exactly what Google saw.

## Step 4: actually clean the site

This is the part that decides whether the review succeeds. You have to remove everything Google has seen and also what it hasn't:

- The spam or phishing pages created by the attacker (and remove them from the sitemap if they were added). They should return `404` or `410`.
- The code injected into files, templates and the database.
- The backdoors, users and scheduled tasks that would let them reinfect the site.
- **The flaw they got in through**: an outdated plugin or module, a leaked password, a poorly protected upload form.

If the site is WordPress, the guide on [how to tell if your WordPress site is hacked](https://webintacta.com/en/guides/how-to-tell-if-wordpress-is-hacked) walks through where to look; if it's a PrestaShop store, the one on [what to do if your PrestaShop store is hacked](https://webintacta.com/en/guides/prestashop-hacked-what-to-do); for anything else, [how to recover a hacked website](https://webintacta.com/en/guides/recover-hacked-website).

## Step 5: check before you request anything

Before you click any button, look at the site the way Google would:

1. Open every sample URL from Search Console in a private window, and from your phone on mobile data. They should return a `404` error or show your legitimate content.
2. In Search Console, run **URL Inspection** on some of them and click **Test live URL**: you'll see the HTML Googlebot receives, which may differ from what you see if the malware singles out the search engine.
3. Repeat the test with `curl` pretending to be Googlebot, to rule out content served only to the crawler:

```
curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" https://your-site.com/ | grep -iE "casino|viagra|<script[^>]+src=" | head
```

If any of this fails, you're not done yet. Requesting the review too early only delays the next one.

## Step 6: request the review

Go back to **Security issues** and click **Request review**. Google asks that the problem be fixed on **all** affected pages and for **all** the issues listed, not just some. In the text, explain in a few concrete lines:

- What you found (for example: “2,300 spam pages generated by a PHP file in /wp-content/uploads/ and an administrator user created by a third party”).
- What you did to clean it (files replaced with the originals, pages removed with 404, database reviewed).
- What you did so it doesn't happen again (the vulnerable plugin updated or removed, passwords changed, users reviewed).

If you bought the domain recently and the problem came from the previous owner, say so in the request: Google takes it into account. For **phishing** warnings, besides Search Console there's the [Safe Browsing error report form](https://safebrowsing.google.com/safebrowsing/report_error/?hl=en), which also triggers a review of pages that are already clean.

## How long it takes

Google receives the request, sends you a confirmation email and then another with the decision. According to its documentation on [how to request a review](https://web.dev/articles/request-a-review), **phishing** reviews are resolved in about a day, **malware** reviews in a few days and reviews of **sites hacked with spam** can take several weeks. Once approved, the warning disappears from Chrome and the search results gradually.

Don't send another request while one is pending. And don't request one without cleaning first: Google warns this can lengthen the response and get you treated as a **repeat offender**. Its [repeat offender policy](https://developers.google.com/search/docs/monitor-debug/security/safe-browsing-repeat-offenders?hl=en) applies to sites that keep switching between clean and harmful, and it blocks them for 30 days with no option to request reviews.

## If Google rejects the review

A rejection means Google still finds the problem. Don't request it again with nothing changed: go back to step 3, see whether the sample URLs have changed and look for what was left behind. In my cases it's usually one of three things: a backdoor that regenerated the pages, content served only to Googlebot, or a forgotten subdomain (an old `staging.` or `blog.`) that is also infected.

## Other blocklists

Besides Google, your domain may be on other services' lists (antivirus vendors, email filters, Microsoft Defender SmartScreen). Each one has its own removal procedure. The [free scan](https://webintacta.com/en/free-website-security-scan) checks the most common ones.

## If you want me to take care of it

I clean the site, request the review in Search Console with the right wording and follow up until the warning is gone. The Google review is included in the cleanup; other services' blocklists are a separate process.

- **WordPress**: €219 excluding VAT, with a 90-day guarantee ([WordPress malware removal](https://webintacta.com/en/wordpress-malware-removal)).
- **PrestaShop or WooCommerce**: €349 excluding VAT, with the payment review included ([hacked PrestaShop repair](https://webintacta.com/en/hacked-prestashop-repair)).
- **Any other website**: all the options, and how to order the cleanup with priority over my other work, in [hacked website repair](https://webintacta.com/en/hacked-website-repair).

## Sources

- [Google Search Help: “This site may be hacked” message](https://support.google.com/websearch/answer/190597?hl=en) (it isn't removed until the site owner takes action).
- [Search Console Help: Security issues report](https://support.google.com/webmasters/answer/9044101?hl=en) (the three families of issues, sample URLs as a sample only, and the review once everything is fixed).
- [Search Console Help: add a property](https://support.google.com/webmasters/answer/9008080?hl=en) (a Domain property, verified via DNS, includes `http`, `https` and subdomains).
- [web.dev: request a review](https://web.dev/articles/request-a-review) (review times: phishing about a day, malware a few days, spam up to several weeks).
- [Google Search Central: Safe Browsing repeat offenders](https://developers.google.com/search/docs/monitor-debug/security/safe-browsing-repeat-offenders?hl=en) (the status lasts 30 days).
- [Safe Browsing transparency report](https://transparencyreport.google.com/safe-browsing/search?hl=en) (current status of the domain).

## Frequently asked questions

### Can I write to Google and ask them to remove the warning?

There's no other channel for the security warning: the review is requested from the Security issues report in Search Console, and only someone who has verified the site can request it. For phishing there's also the Safe Browsing error report form.

### What does “This site may be hacked” mean?

That Google has detected content added by a third party on your site, usually spam pages or links. It doesn't go away on its own: you have to clean the site and request a review in Search Console.

### How long does Google take to remove the dangerous site warning?

According to Google, phishing reviews are usually resolved in about a day, malware reviews in a few days and reviews of sites hacked with spam can take several weeks.

### Will I lose my rankings?

While the warning is active, traffic drops sharply. Once it's resolved, traffic usually recovers as Google recrawls the clean site.

### What if I don't have access to Search Console?

You can verify the site at any time if you control the domain (DNS) or the files. Without verification there's no way to request a review of the security warning.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos