Fix an antivirus false positive on your website or app
Find out which engine flags your site or file, then follow the steps to ask that vendor to clear it.
Check a URL or file
Paste a domain, URL, file hash or a VirusTotal report link to see which engines flag it.
Antivirus engines and blocklists
Pick the one that flags you. Engines marked Guide have a full walkthrough.
What an antivirus false positive is
A false positive happens when an antivirus engine or a blocklist marks a safe website or file as dangerous. Your visitors see a warning page, or their antivirus deletes your installer, and nothing is wrong on your side.
Each vendor decides on its own. Kaspersky can block a domain that ESET and Google rate as clean, so one flag reaches only the people who use that product. You fix it by asking that vendor for a review.
Why engines flag safe sites and files
Reputation systems trust what many people already use. A domain registered last week or a build released today has no history yet.
Heuristic and machine learning detections judge a file by how it looks and behaves. Packers, and installers that change system settings, can trip them.
Shared hosting, free subdomains and URL shorteners can carry the reputation of other sites on the same service.
A hacked plugin or a third-party ad script can serve harmful content from your site. Rule this out before you ask for a review.
How to fix a false positive
The order is the same for every vendor.
-
1
Find out who flags you
Use the checker on this page, or scan your address or file on VirusTotal. Note each engine that reports a detection and the detection name.
-
2
Make sure it is a mistake
Scan your server and rebuild your files from clean source. A review request fails when the problem is still there.
-
3
Send the request the vendor asks for
Each vendor has its own form or email address and its own rules for attachments. Our guides give you the address and a sample message.
-
4
Confirm the fix
Scan again after the vendor answers. Ask affected users to update their antivirus so the old verdict clears.
Who these guides are for
Website owners
A browser blocks your domain or one of your pages, or a blocklist such as Google Safe Browsing or Spamhaus lists it. Start with the engine that most of your visitors use.
Software developers
An antivirus deletes your installer, or Windows warns people when they download it. Sign your builds, then report the file to each vendor that detects it.
Common questions
What is a false positive?
An antivirus marks a safe website or file as dangerous. Users see a warning or a block page even though nothing is wrong.
How do I find out which antivirus blocks my website?
Scan the address on VirusTotal or paste it into the checker on this page. The report shows each vendor with its verdict, and only the flagged rows need action.
How long does a fix take?
It depends on the vendor. Avast says it reviews a report within 48 business hours. Google says a Safe Browsing review can take a few days to a few weeks.
One engine flags me on VirusTotal. Should I care?
Yes, if your visitors use that product. VirusTotal itself says that one detection, or even five, does not automatically mean a file is bad.
If I fix one engine, are the others fixed too?
Only for products that share that engine. AVG runs on the Avast engine, so one report covers both. Independent engines each need their own request.
Can VirusTotal remove a detection?
No. VirusTotal shows the verdicts of other vendors and cannot change them. Contact each vendor that flags you, then use Reanalyse on the report.
Do I need to pay?
No. The vendors in our guides review false positive reports for free.
Tell us what is blocking you
Send us the details and we will point you to the right channel or help you word your request.