Google lists the website as dangerous, so Chrome and other browsers show visitors a red warning page instead of it. This usually means the website has been hacked, and it costs almost all of its traffic until it’s fixed.
What it means
Google keeps a list of unsafe websites, flagged for malware (software that infects visitors’ devices), phishing (pages that trick people into giving passwords or card details) or unwanted software. The issue names which. Most browsers check this list before opening a page.
What triggers it
Once a day the Blacklist & malware check asks Google’s Web Risk API whether the website’s home address is listed. A listing raises this Critical issue, and owners and admins are alerted by email and chat straight away, then again a week later if it’s still listed.
This part of the check needs a Google Web Risk API key, saved in the Blacklist & malware dialog on Data connections.
Common causes
- An out-of-date CMS, theme or plugin let attackers inject code, redirects or files.
- Stolen admin, hosting or FTP passwords.
- Phishing pages uploaded into a folder you don’t use.
- A third-party script, ad network or download that serves harmful content.
How to fix it
- Open Security issues in Google Search Console for the website, which shows what Google found and example addresses.
- Clean the website: remove injected code, unknown files and unknown admin users, or restore a clean backup. Your host or a security specialist can help.
- Update the CMS, themes and plugins, and change every password: CMS admins, hosting, FTP and database.
- Once it’s clean, click “Request review” under Security issues in Search Console. Google usually reviews within a few days.
When it clears
The issue clears at the first daily check after Google removes the listing, which follows an accepted review. If URLhaus lists the website too, see Malware downloads listed on the domain.
If you mark the action done and the problem is still found 14 days later, it comes back as “Fix didn’t work”. See Using the action plan.