A customer messages you to say your website “has a virus”. You open it yourself and, instead of your home page, Chrome shows a full red screen that says “Deceptive site ahead”, with a line about attackers trying to trick visitors into revealing passwords or card details. You did not change anything. Enquiries have gone quiet, and you have no idea where to start.
This warning is serious, but it is fixable. It almost always means something has been added to your site that you did not put there. Find that, remove it, close the way in, and ask Google to check again.
Where the red warning comes from
The warning is driven by Google Safe Browsing, a service that keeps a list of web addresses Google has found hosting phishing, malware or other harmful content. Chrome checks addresses against that list and shows the red page when there is a match. “Deceptive site ahead” is the version for phishing and social engineering: pages built to trick people into handing over logins, payment details or personal information, or into downloading something they should not.
Chrome is not the only browser affected. Firefox and Safari also use Safe Browsing data and show their own versions of the warning, so switching browsers will not make the problem go away for your visitors. Microsoft Edge relies mainly on Microsoft’s own SmartScreen service, which keeps a separate list, so a site can be flagged in one and not the other.
A visitor can click through the warning, but most will not. They close the tab and assume your business is unsafe. If you run Google Ads, ads that point to a flagged site can also be disapproved, so paid traffic can stop at the same time.
How it differs from “This site may be hacked”
These two warnings get confused all the time, and they mean different things.
| “Deceptive site ahead” | “This site may be hacked” | |
|---|---|---|
| Where it appears | In the browser, as a full red page, before your site loads | In Google Search results, as a line under your listing |
| Who sees it | Anyone opening the address in an affected browser, however they arrived: a search, a link in an email, a typed URL | People searching on Google |
| What it usually points to | Phishing pages, deceptive downloads or harmful redirects | Spam content or pages added by an attacker |
| Effect on visitors | Most people leave at the warning | The site still opens, but fewer people click |
A site can have both at once. We cover the search result label separately in the “This site may be hacked” warning explained.
Common causes on a WordPress site
Phishing pages planted by an attacker
This is the classic cause. Someone gets into the site through an outdated plugin, a weak password or a leftover file, and uploads a fake login page for a bank, an email provider or a delivery company. It often sits in a folder you would never open, such as somewhere deep inside wp-content or uploads. The attacker then sends that link out in spam emails. Your home page can look perfectly normal while the phishing kit lives a few folders away.
Malicious redirects
Injected code can send some visitors from your pages to a scam site: a fake prize, a fake virus alert, a fake software update. Because your address is the starting point, your domain gets flagged. These redirects are often designed to hide from the site owner, which is why you may never see them yourself. We explain how they work in WordPress site redirecting to spam sites.
Compromised ads, scripts or third-party code
Sometimes the site itself was not broken into. A script loaded from somewhere else, such as an ad network, a chat widget or an old analytics snippet from a service that no longer exists, starts serving something deceptive. Safe Browsing sees the result on your pages and flags your address. Old snippets pasted into a header or footer box years ago are worth a hard look.
A false positive
It does happen, for example when a page innocently resembles a login screen. But treat this as the last explanation, not the first. In practice the cause is usually real.
Check what Google has actually found
Before you change anything, find out exactly what Google is complaining about.
- Open Google Search Console for your site and go to Security & Manual Actions, then Security issues. If Google has flagged deceptive pages, they will be listed there, usually with sample URLs. Those samples are the best clue you will get.
- If you do not have Search Console set up, set it up now and verify ownership. You need it to request a review later anyway.
- Check the address on Google’s Safe Browsing site status page, which is part of the Google Transparency Report. It tells you whether the site is currently flagged and gives a general reason.
- Look at the sample URLs carefully. Do not enter any details into a page you find there, and if you open one, do it in a private window while logged out of everything.
Cleaning the site
The full process is in our guide to fixing a hacked WordPress website. For this particular warning, these are the parts that matter most.
- Take a copy of the site as it is now, files and database, before deleting anything. It helps later if you need to work out how the attacker got in.
- Change passwords for WordPress administrators, hosting, FTP or SFTP, and the database, from a device you trust.
- Remove the flagged pages and folders, and then look for more. Phishing kits rarely arrive alone. Look for recently changed files, PHP files inside uploads, and folders with names that do not belong to any plugin or theme you use.
- Replace WordPress core, plugins and themes with fresh copies from their official sources rather than trying to edit infected files by hand.
- Check for administrator accounts you did not create, and remove them.
- Review every script in headers, footers and widgets, and remove anything you cannot explain.
- Close the way in. Update everything, delete plugins and themes you do not use, and turn on two-factor authentication for administrators. If you skip this step, the pages tend to come back within days.
Scanners such as Wordfence or Sucuri SiteCheck help, but a clean scan does not prove a clean site. Some phishing kits are plain HTML files that scanners treat as harmless.
Requesting a review
Once you are confident the site is clean, go back to the Security issues report in Search Console and use the Request review option. Explain briefly and honestly what you found and what you did: which files were removed, how you think the attacker got in, and what you changed to stop it happening again. A vague “it’s fixed now” is a weak request.
Google rechecks the site after the request. If the pages are gone and nothing harmful remains, the warning is removed. If something is still there, the request is rejected and the warning stays, so it pays to be thorough before you submit rather than after. The review is not instant, and there is no way to speed it up, which is another reason to get the cleanup right the first time.
After the warning lifts, keep an eye on Search Console for a few weeks. A new security issue soon after a review usually means a backdoor was missed.
If you would rather hand it over
If you would prefer someone else to find the planted pages, clean the site and handle the Google review, our WordPress malware removal service covers exactly that. A standard cleanup is a flat ₹2,999. If the site is badly damaged or keeps getting reinfected, we look at it first and give you a quote before starting.
If you want the flag cleared for you, our Google blacklist removal page covers the review process, and our page on sites flagged by antivirus software covers warnings that come from security vendors rather than Google.
Next in this series: WordPress Site Redirecting to Spam Sites: How to Fix It
