First, what is Norton?
Norton is a consumer security brand of Gen Digital. Its products block websites, and Norton Safe Web gives every site a rating that people can look up. The products also scan files and remove the ones they detect.
A wrong verdict on your domain puts a warning in front of your visitors, and a wrong verdict on your installer removes it from their computers. Symantec enterprise products belong to Broadcom, a separate company, and they use a different channel. A Symantec false positive is not a Norton false positive.
Who can't reach you right now
Where it's used, and who shares it
Norton shares its engine with these Gen Digital brands, so the same detection can show up in all of them:
AvastSame engine
AVGSame engineThese engines are independent from Norton. If they flag you too, each one needs its own request:
Kaspersky →
ESET →
Bitdefender →
Microsoft Defender →How to tell if you're flagged
Norton Safe Web (safeweb.norton.com). Look up your site to see its rating. We found no public Norton scanner for files.
VirusTotal. Scan the URL or file. We found no Norton row guidance, so check the Avast and AVG rows, because Norton uses that engine. The same scan shows whether other engines flag you too.- A clean test machine. Install a trial in a virtual machine, update it and open your site or run your file.
- User reports. Ask affected users for a screenshot of the Norton alert. It shows the detection name, and the Alert ID sits at the bottom of the alert popup.
WS.Reputation.1Broadcom documents this name for Symantec Endpoint Protection. It is a file reputation detection that "does not indicate that the file is a threat". New or rarely seen files typically trigger it.Asking Norton to fix it
Collect the details
Write down the detection name and the Alert ID. The Alert ID is at the bottom of the Norton alert popup. For a website, copy the full URL. For a file, keep the file itself.
Check that it is a mistake
Scan your server and your scripts for injected code, and rebuild files from clean source. Fix anything you find before you report.
Report a website
Open the Norton submission portal at submissions.norton.com/reportfalsepositive. Choose the URL option, which Norton labels Website. The form asks for your email address, the detection name, the Alert ID, the website URL, a description and a captcha. You need no account. The form does not ask for a company email address, so a personal one is fine. A phishing flag on a website has no file to send. Say what the site is, who owns it and what each form on the page collects.
Website flagged as phishing
Email: name[at]example[.]com
Option: URL (Website)
Detection name: <name exactly as Norton shows it>
Alert ID: <ID from the bottom of the alert popup>
URL: hxxps://example[.]com/page
Description: hxxps://example[.]com is the website of our company,
Example Ltd. Norton blocks it as phishing. We own
the domain and run the site ourselves. The only form
is the customer login, and it sends data to our own
server. The site has no downloads. Please review
the verdict.
Captcha: solved
Dispute a Norton Safe Web rating
If the problem is the Safe Web rating, look your site up at safeweb.norton.com and click Submit dispute. Fill in your email address, the current category, the suggested category and your comments. Site owners have a second route. Sign in with a Norton account, open My Activity, then My Sites, and click Add site. Verify the site with a meta tag or an uploaded HTML file, click Verify Now, then click Submit dispute.
Safe Web dispute
Email address: name[at]example[.]com
Current category: <category Safe Web shows for the site>
Suggested category: <category you think is right>
Comments: hxxps://example[.]com is the website of our
company, Example Ltd. We own the domain and
run the site ourselves. It has no malicious
content and no downloads. Please review the
rating.
Report a file
Use the same portal and choose the File option. A ZIP or RAR archive can hold one file only, the maximum size is 500 MB, and the archive must not have a password. Norton says: "This process is for detected files only. Undetected files will not be processed." Enter the detection name and the Alert ID, and add a description.
File flagged as malware
Email: name[at]example[.]com
Option: File
File: example-app-setup.zip (one file, no password)
Detection name: <name exactly as Norton shows it>
Alert ID: <ID from the bottom of the alert popup>
Description: This file is the installer of our product
Example App 2.1. Norton detects it as a threat.
We built it from our own source. The official
download page is hxxps://example[.]com/download.
Please review the verdict.
Captcha: solved
Wait and check the result
For a Safe Web dispute, Norton says: "Dispute resolution could take upto 2 days and you will receive email confirmation once validated". The submission portal states no time. When the wait is over, look your site up on Safe Web again and scan it on VirusTotal. Ask affected users to update their Norton product and try again.
Other ways to report
Norton explains its own rules for false positives on these pages: