How to remove the Google Safe Browsing "Dangerous site" warning

First, what is Google Safe Browsing?

Google Safe Browsing is a list of unsafe web resources kept by Google. A site lands on it for phishing, malware, unwanted software or social engineering, and a download lands on it when Google rates the file as dangerous or uncommon. Google says the list protects over five billion devices.

Chrome and other browsers check the list before they open a page or finish a download. When your site is on it, the visitor sees a full-page warning instead of your content. Google shows the details to the site owner in the Security Issues report of Search Console.

Who can't reach you right now

Chrome users

Visitors see a red Dangerous site page or a Deceptive site ahead page instead of your site.

Safari and Firefox users

Both browsers read Google's list, so the same warning appears for their users.

People who download your files

Chrome marks the download as dangerous or suspicious, and many users stop there.

Gmail and Android users

Google says it uses the list in Gmail and Android as well.

Where the list is used

How to tell if you're flagged

Site status tool of the Google Transparency Report (transparencyreport.google.com/safe-browsing/search). Enter your domain to see what Google holds for it.
Security Issues report in Search Console. It lists the issue type and sample URLs. Flagged downloads show up there as Harmful downloads or Uncommon downloads.
Chrome on a test machine. Open your site or start the download and read the warning page.
User reports. Ask affected users for a screenshot of the warning page.

Reading the warning

Dangerous siteRed Chrome page for phishing, malware, unwanted software or social engineering.

Deceptive site aheadChrome page for social engineering.

Dangerous (download)Chrome download warning for a file Safe Browsing rates as dangerous.

Suspicious (download)Chrome download warning that reads "An uncommon or unfamiliar file". Google says it does not keep your page or site out of Google Search results, and it lifts once Safe Browsing verifies the files.

Did you mean ...? / Fake site aheadLookalike warnings. They have their own review process, separate from the Security Issues report.

Asking Google to fix it

Find the reason in Search Console

Open the Security Issues report for your site. You need a Google account and a verified site in Search Console. The report names the issue and lists sample URLs. Flagged downloads appear here too, under Harmful downloads or Uncommon downloads.

Fix the whole site

Remove the cause from every page, not only the sample URLs. Google says fixing the issue on just some pages will not earn you a partial return. Check third-party ads and embedded resources as well, because they can carry the problem.

Request a review in Search Console

When the fix is complete, select Request Review in the Security Issues report. A good request explains the exact issue and describes the steps you took to fix it. Google sends an email when it receives the request and another when the review completes. The sample below is for a site flagged for deceptive pages.

Issue:   Search Console reports deceptive pages (phishing) on
         hxxps://example[.]com/login-help/.
Cause:   An outdated plugin let an attacker upload a fake login
         page to /login-help/.
Fix:     We deleted the fake page and the attacker's files,
         updated the plugin, changed all admin and hosting
         passwords, and checked every other page and our
         third-party scripts. The Security Issues report now
         lists no sample URLs.
Result:  hxxps://example[.]com has no deceptive pages. Please
         review the site.

Report an error when nothing was wrong

If you believe Safe Browsing classified a page in error, use the form Report a Page to Google Safe Browsing. Set Report Type to "This page is safe", enter the URL and add up to 800 characters under Additional details. The form has no email field, so it asks for no company address. A flagged download has no separate form. It shows up in the Security Issues report.

Google Report a Page to Google Safe Browsing form with This page is safe selected and a sample URL

Report Type:         This page is safe
URL to report:       hxxps://example[.]com/page
Additional details:  This page belongs to our company, Example Ltd. It is
                     a normal sign-in page for our own customers and sends
                     data only to our own server. We found no malware or
                     injected code. Please review the verdict.

Wait for the review

Google says: "A review can take from a few days to a few weeks to complete." Do not resubmit while the request is pending.

Check the result

Look up your domain in the site status tool and read the completion email. Open the site in Chrome to confirm the warning is gone. Safari and Firefox read the same list.

Google Transparency Report Safe Browsing site status page with a lookup for example.com

Other ways to report

Google Safe Browsing explains its own rules for false positives on these pages:

A few things worth knowing

Send the review request only after the fix is complete. Google says an early request can mean a longer turnaround for the next request, or get the site marked as a repeat offender.

A partial fix earns nothing. If one page is clean and another still carries the problem, the warning stays.

Third-party ads and embedded resources can bring the problem back after you clean your own files. Check them before you ask for a review.

Google recommends signing your code. An unsigned binary is not a reason for flagging.

An uncommon download warning does not mean the file is malicious. Google says the warning lifts once Safe Browsing verifies the files.

Warning still there after the review

Send us your case and we'll review your submission.

Get help