How to remove a website from the Google Safe Browsing blacklist?

To remove a website from the Google Safe Browsing blacklist, confirm the flag with Google's Safe Browsing site status tool, then open the Security issues report in Google Search Console to see exactly what was detected. Remove the malware, phishing pages, or harmful downloads, fix the vulnerability that allowed them, and submit a review request in Search Console. For malware and phishing, Google usually processes reviews within a day or a few days once the site is genuinely clean.

A Safe Browsing flag is one of the most damaging things that can happen to a website. Chrome, Firefox, Safari, and other browsers that use Safe Browsing data show a full-page red warning, and most visitors turn back immediately. This guide explains how the blocklist works, how to confirm and diagnose the problem, how to clean your site whatever platform it runs on, and how to get delisted from Google and other blocklists.

What Is the Google Safe Browsing Blacklist?

Google Safe Browsing is a service that identifies unsafe websites and shares that data with browsers and other services. When Google's systems detect a threat on your site, your URLs are added to its lists, and anyone using a browser or product that checks those lists sees a warning.

Safe Browsing data is used by:

• Google Chrome, which shows a red interstitial page.
• Mozilla Firefox and Apple Safari, which both use Safe Browsing data for their warnings.
• Google Search, which may show warnings in search results.
• Gmail and other Google products, which may warn about links to flagged sites.
• Various third-party apps and services that integrate the Safe Browsing API.

Types of Safe Browsing Warnings

The warning text tells you what kind of threat Google found:

• "Dangerous site" or "The site ahead contains malware": Your site hosts or links to malware that can infect visitors' devices.
• "Deceptive site ahead": Social engineering, such as phishing pages that imitate banks, email providers, or login forms.
• "The site ahead contains harmful programs": Unwanted software downloads, such as bundled adware.
• "This page is trying to load scripts from unauthenticated sources" or warnings about specific resources: Your pages load content from a flagged third-party domain.

Knowing which type you have tells you where to look.

Step 1: Confirm the Blacklisting

Check your site's status with Google's own tools.

1. Safe Browsing site status: Visit Google's Transparency Report Safe Browsing page and enter your domain. It shows whether Google currently considers the site dangerous and gives a short summary.
2. Visit the site in Chrome: Use a browser where you haven't dismissed warnings before, so you see what visitors see.
3. Check subdomains and paths: Sometimes only a specific subdomain or folder is flagged.

Also check other blocklists, since some security vendors maintain their own:

• Sucuri SiteCheck: Checks your site against several blocklists at once.
• VirusTotal: Shows whether dozens of security vendors flag your URL.
• Norton Safe Web and McAfee WebAdvisor: Consumer security tools with their own ratings.
• Microsoft Defender SmartScreen: Used by Microsoft Edge and Windows, with a separate reporting process.

Step 2: Set Up Google Search Console

Search Console is essential. It tells you exactly what Google found and is where you request a review.

1. Add your site: A Domain property verified through a DNS TXT record covers all subdomains and both HTTP and HTTPS. A URL prefix property can be verified with an HTML file, meta tag, Analytics, or Tag Manager.
2. Check users and owners: Under Settings > Users and permissions, remove any owners you don't recognize. Attackers sometimes verify themselves as owners of compromised sites.
3. Open the Security issues report: Go to Security & Manual Actions > Security issues. Google lists the issue types and often shows sample URLs.

Common issue types include:

• Malware: Code on your site that installs malicious software or redirects to it.
• Social engineering: Phishing or deceptive content.
• Harmful downloads: Files flagged as unwanted or malicious software.
• Uncommon downloads: Files that haven't been seen often enough to be judged safe.
• Hacked content: URL, content, or code injection by a third party.

Enable email notifications in Search Console so you hear about new issues immediately in future.

Step 3: Find the Malicious Content

Sample URLs are clues, not a complete list. Use several methods to find everything.

Scan From the Outside

Run a remote scan with Sucuri SiteCheck and look at what it reports. Then inspect the flagged pages' source code in a browser, looking for:

• Unfamiliar <script> tags, especially ones loading from strange domains.
• Hidden <iframe> elements.
• Obfuscated JavaScript, such as long strings passed to eval() or atob().
• Redirect code using window.location or meta refresh tags.

You can fetch a page from the command line to see its raw HTML:

curl -s https://example.com/ | grep -iE "<script|<iframe|eval\(|atob\(|window\.location" | head -30

Some malware only triggers for certain visitors, such as mobile users or people arriving from search engines, so try varying the user agent and referrer:

curl -s -A "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X)" -e "https://www.google.com/" https://example.com/ | grep -iE "<script|window\.location" | head

Use Search Console's URL Inspection

The URL Inspection tool's live test shows the HTML Googlebot receives. This is the most reliable way to see cloaked malware.

Scan the Server

Remote scans only see public output. You also need to scan the files on your server:

• WordPress sites: Use a plugin such as Wordfence or MalCare, and verify core files with wp core verify-checksums.
• Other CMSs: Joomla, Drupal, and others have their own security extensions and integrity checks. Compare files against a fresh download of your CMS version.
• Custom sites: Compare files against your version control repository. git status and git diff quickly reveal changes if your site is deployed from Git.
• Server tools: ClamAV, Linux Malware Detect (maldet), or your host's scanner (often Imunify360) can help.

Useful command-line checks:

cd /var/www/example.com/public_html

# Files modified in the last two weeks
find . -type f -mtime -14 -printf "%TY-%Tm-%Td %p\n" | sort -r | head -50

# PHP files in folders meant for uploads or media
find . -path "*uploads*" -type f -name "*.php"

# Common obfuscation patterns in PHP and JS
grep -rlE "eval\(|base64_decode\(|gzinflate\(|fromCharCode|atob\(" --include="*.php" --include="*.js" . | head -50

Check Third-Party Resources

If Google flags your site because of an external resource, such as an ad network, a compromised CDN script, or a widget, the fix is to remove or replace that resource. Look at every external script your pages load and confirm each one is still legitimate.

Check for Phishing Pages

For social engineering warnings, look for folders or files you didn't create, especially ones imitating login pages for banks, email providers, or payment services. These are often placed in deep, randomly named directories. Check for recently added HTML and PHP files and for unfamiliar ZIP archives, which phishing kits are often uploaded as.

Step 4: Clean the Site

Always back up the current site before cleaning, even though it's infected, so you can recover from mistakes.

1. Put the site in maintenance mode or restrict access to protect visitors while you work.

2. Replace software with clean copies: Reinstall your CMS core, plugins, extensions, and themes from official sources. For custom code, redeploy from a known-good version in your repository.

3. Remove malicious files: Delete phishing kits, web shells, and unknown scripts. Be careful not to delete legitimate files you need.

4. Clean the database: Remove injected scripts from content and settings. For WordPress, search the wp_posts and wp_options tables for <script, <iframe, and obfuscation functions.

5. Remove unknown user accounts: Especially administrator or high-privilege accounts.

6. Check server configuration files: Look at .htaccess, Nginx config includes, and PHP settings for rules that redirect visitors or execute unexpected files.

7. Remove malicious downloads: If the flag was for harmful downloads, remove or replace the offending files and make sure your download pages link only to verified files.

If you have a clean backup from before the infection, restoring it may be faster. Make sure the backup truly predates the compromise, then still change credentials and patch the vulnerability.

Step 5: Secure the Site Before Requesting Review

If the site is reinfected after review, you'll be flagged again, and repeated offenses can mean longer waits. Secure the site first:

• Update everything: CMS, plugins, themes, server software, and PHP.
• Change all credentials: CMS admin accounts, database, hosting control panel, SFTP, SSH, and any API keys stored on the site.
• Rotate secrets and session keys: For WordPress, regenerate the salts in wp-config.php. For other frameworks, rotate the application secret key.
• Enable two-factor authentication for all admin accounts.
• Add a web application firewall: A cloud WAF like Cloudflare or Sucuri, or a plugin WAF like Wordfence, blocks many exploit attempts.
• Remove unused software and old test sites that might be vulnerable.

Adding security headers can also reduce the impact of some future injections. For example, on Nginx:

add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Frame-Options "SAMEORIGIN" always;

A carefully built Content Security Policy goes further by restricting which domains can load scripts on your pages, though it needs testing to avoid breaking legitimate features.

Step 6: Request a Review in Search Console

Once you're confident the site is clean and secure:

1. Go to Security & Manual Actions > Security issues.
2. Confirm that you've fixed the issues by checking the box.
3. Click Request Review.
4. Write a clear explanation: what type of infection you found, what you removed, how the attacker got in, and what you changed to prevent a repeat.

Google's documentation indicates that malware and phishing reviews typically take a day to a few days, while hacked spam reviews can take longer. If the review fails, Google provides updated details. Investigate further, clean what remains, and resubmit.

Don't request a review before the site is fully clean. Repeated failed reviews or repeat infections can lead Google to delay future reviews.

Step 7: Request Delisting From Other Blocklists

If other vendors also flagged your site, request reviews from them after you've cleaned up:

• Microsoft SmartScreen: Submit a report through Microsoft's site review form for incorrectly blocked sites.
• Norton Safe Web: Use the dispute or re-evaluation option on your site's Safe Web page.
• McAfee: Submit a reclassification request through its customer URL ticketing system.
• Other vendors found via VirusTotal: Each vendor has its own false-positive or review process, usually on its website.

Most vendors update their status within a few days of a successful review, though timing varies.

Step 8: Monitor After Delisting

• Keep Search Console notifications enabled so you're warned quickly if issues return.
• Schedule regular scans of both the public site and server files.
• Watch for file changes with a file integrity monitoring tool or your security plugin.
• Review access logs for suspicious requests to unusual files.
• Keep regular off-site backups for fast recovery.

Preventing Future Blacklisting

Most Safe Browsing flags result from compromised sites rather than site owners doing anything intentionally harmful. Prevention comes down to strong security basics:

• Keep software updated and remove anything you don't use.
• Use strong, unique passwords and two-factor authentication.
• Use a WAF and scan regularly.
• Vet third-party scripts, ad networks, and widgets before adding them.
• Avoid pirated themes, plugins, and extensions.
• Separate sites into different hosting accounts so one infection doesn't spread.

---

FAQ: Removing a Site From the Google Safe Browsing Blacklist

---

Conclusion

Getting removed from the Google Safe Browsing blacklist follows a clear path: confirm the flag, use Google Search Console to see exactly what was detected, find and remove the malicious content, and secure the site before requesting a review. Checking pages from the outside, inspecting what Googlebot sees, and scanning server files together give you the best chance of finding everything the first time.

After Google clears your site, request delisting from any other vendors that flagged it, and keep monitoring closely. Most blacklistings come from preventable compromises, so strong basics like updates, strong authentication, a firewall, careful vetting of third-party scripts, and regular scans are what keep your site off the list for good.