Reputation

Google Safe Browsing: how it flags sites and how to clear yours.

Published 2026-05-15 · Last updated 2026-05-15 · Vantyris editorial

What this means for your business

• Safe Browsing flags three classes of site: malware (drive-by downloads or hosted malware), phishing (impersonates another brand to steal credentials), and unwanted software (deceptive installers, browser hijackers). Most small-business listings are accidental — a CMS plugin got compromised and started serving malware to one in a thousand visitors.
• Listing typically happens hours or days after the compromise. Google's crawlers visit your site as a real browser would; if any page in any subdomain matches a malware or phishing pattern, the entire root domain can be flagged.
• Even after you've cleaned up the underlying issue, your domain stays on the list until Google re-crawls and verifies. That's typically 24-72 hours after you submit a review request — but only if you submitted one. Without a review request, the listing can persist for weeks.

How to fix

Use Google Search Console's Security Issues report to see what was flagged, fix the underlying compromise, then submit a review request. Re-crawl + clearance takes 24-72 hours typically.

1. Confirm the listing via Safe Browsing diagnostic. Open transparencyreport.google.com/safe-browsing/search?url=yourdomain.com to confirm your domain is flagged and read what was detected (malware, phishing, unwanted software). If you don't have a Search Console property yet, add one and verify your domain first.
2. Read Search Console's Security Issues report. Search Console → Security & Manual Actions → Security Issues. It lists specific URLs Google flagged and the threat type. This is your work list.
3. Find and fix the underlying compromise. For malware: scan your CMS database for injected JavaScript or PHP. Look in plugin files for recent modifications. Common entry points: outdated plugins, weak admin passwords, exposed admin URLs. For phishing: check whether your site is hosting attacker pages (e.g., a hacker uploaded a fake login page in a subdirectory). For unwanted software: check what your site is offering as downloads.
4. Verify the fix is complete. Use sucuri.net/scanner or virustotal.com to confirm the URLs no longer return malicious content. If they still do, repeat the previous step.
5. Submit a review request. Search Console → Security Issues → Request Review. Explain what you found, what you fixed, and how you've prevented recurrence (updated plugins, rotated passwords, added a WAF, etc.). Honest answers; reviewers see through hand-waving.
6. Wait for re-crawl. Typically 24-72 hours. You'll get an email when the listing clears. The browser warnings disappear within minutes of the listing being lifted.

Owner: Your web host's support team or your developer for the cleanup; you submit the review request from Search Console. · Time: 2-8 hours to clean up + 1-3 days to clear the listing.

Common gotchas

• Don't submit a review request before the underlying issue is fixed. Reviewers re-scan; if they still find malware, your listing extends and Google may rate-limit future review requests.
• If you can't find the compromise, the issue may be at your DNS or hosting layer (e.g., a subdomain you didn't realise existed serves malware). Vantyris's attack-surface scan finds shadow subdomains via Certificate Transparency.
• After you clear the listing, harden against recurrence: keep CMS + plugins on auto-update, rotate admin passwords, enable MFA on the hosting account, restrict the admin URL by IP if possible.
• Repeat listings are weighted heavily. A second listing in the same year extends review times and may damage your domain reputation longer-term.

How to verify the fix

Run a Vantyris verified scan; the Reputation category will show Safe Browsing as healthy once you're cleared. Or check transparencyreport.google.com/safe-browsing/search directly.

Cyber Essentials alignment

This finding informs the following UK NCSC Cyber Essentials control areas:

• A2. Secure configuration — devices and services hardened against the inherent default vulnerabilities.
• A3. Security update management — software supported, updated, and patched within 14 days for high-/critical-risk vulnerabilities.
• A5. Malware protection — internet-facing devices protected against malicious code.

Vantyris is not a CE certifying body. The mapping above is informational.

Common follow-up questions

References

• Google Safe Browsing transparency report Vendor
• Google: malware and unwanted software Vendor
• NCSC: handling a website compromise NCSC

Related explainers

• DNS-based blocklists: the silent reason your emails land in spam.
• What is DMARC, and why every business with a domain needs one.