Guide

Browsers show "Deceptive site ahead" for your site. Here's how it comes off.

by Ken Armitt, Founder · updated 31 July 2026

The full red screen is Google Safe Browsing flagging phishing or malware on your site — harsher than the "may be hacked" text label in search results. Remove it by finding and removing the flagged content and the backdoor behind it, then requesting a review in Search Console under Security Issues. Safe Browsing usually re-checks within a day of a genuine clean.

What the red screen means

Unlike the grey "this site may be hacked" note in search results, the full-page red interstitial is Google Safe Browsing warning that your site is actively serving phishing or malware. It is shown in Chrome, Safari, Firefox and Android, so it cuts your traffic to near zero until cleared. It usually means injected malicious scripts, a phishing page planted on your domain, or malicious downloads.

Clean it properly

Verify the site in Google Search Console and open Security Issues — Google lists the flagged URLs and the category. Remove the malicious pages and scripts, find the backdoor that placed them, and close the entry point. As with every hack, deleting the visible payload without the access method just buys a day or two.

Requesting the review

Only once the site is genuinely clean, use Security Issues → Request Review with a short, honest note on what you removed. Safe Browsing re-scans and typically clears legitimate sites within about 24 hours. Requesting before you're clean fails the review and slows the next attempt — clean first, request once.