When people say their site has been “blacklisted by Google”, they usually mean one of a few different things. The browser may be showing a red full-screen warning. Their search listing may carry a grey line saying the site may be hacked. Their ads may have stopped. Or Search Console may have sent an email titled “security issues detected”. Each of these comes from a different part of Google, and each one is cleared in its own way.
This page explains how we get a website off those lists, as part of our wider hacked website repair work. The short version: Google does not remove a flag because you ask nicely. It removes it when the site is genuinely clean and a review confirms it. Our job is to make sure both of those happen.
Google does not keep one “blacklist”
Google does not use the word blacklist. What people mean by it is a set of separate signals, and it helps to know which one you are dealing with.
Safe Browsing
Google Safe Browsing maintains a list of web addresses that host malware, phishing pages or unwanted software. Chrome, and several other browsers, check addresses against that list. When there is a match, the visitor sees a full-page warning before your site loads, with wording such as “Dangerous site” or “Deceptive site ahead”. This is the most damaging flag, because it affects every visitor, however they reach you. We explain the phishing version in detail in our article on the deceptive site ahead message.
Hacked-site labels in search results
Separately, Google can add a note under your listing in search results when it believes someone else has changed your content, usually by adding spam. The site still opens, but fewer people click. Our explainer on the “This site may be hacked” label covers what triggers it.
Search Console’s Security Issues and Manual Actions reports
If you have a verified Search Console property, Google lists detected problems in the Security Issues report, with categories such as hacked content, malware and social engineering, and sample affected URLs. The Manual Actions report is a separate place where Google lists actions taken for spam, which hacked sites sometimes pick up too. These reports are where the review request lives, so they are central to the job. Our article on reading the Security Issues report explains each section in plain words.
Google Ads
Google Ads applies its own policies to the pages your ads point to. When a site is flagged for malware or deceptive content, ads can be disapproved. That review is handled inside the Ads account once the site is clean.
Checking which flag you have
Before any cleanup, we work out exactly which signals are active, because that decides which reviews will be needed. We check the site status in Google’s Transparency Report, which shows whether Safe Browsing currently considers an address unsafe. If you can log in to Search Console, we go through both its security and its manual action listings. We search for your site to see if a label appears. And we look at whether other services, such as Microsoft’s browser protection or antivirus products, are also blocking the address.
If you have never set up Search Console, that is one of the first things we help with. Without a verified property, there is no way to request a review for the hacked-content or malware issues that Search Console reports.
Who should own the Search Console property
A surprising number of flagged sites do have Search Console, but nobody at the business can reach it. The property was set up by a designer or an old marketing agency, the warning emails went to their inbox, and the owner only found out when a customer complained.
Part of the job is fixing that. The business owner should be a verified owner of the property, with any agency or developer added as a user underneath. That way the alerts reach someone who will act on them, and you never again depend on a former contractor to answer a review. If we need access to request the review, you add us as a user, and you can remove us the moment the work is done.
Why the cleanup has to come first
A review request is a statement that the problem is fixed. Google then checks for itself. If it still finds malware, spam or a phishing page, the review fails and the flag stays.
Failed reviews are not just a delay. Google has a policy for sites that are cleaned and then reinfected over and over, and a site treated that way can be made to wait before it may ask for another review. That makes it worth taking the time to clean thoroughly once, instead of rushing a request in the hope that it goes through.
So the real work happens before the request. We back up the site, remove the infection from files and database, find and close the backdoor, check that no spam pages or phishing kits remain anywhere in the hosting account, and confirm that nothing harmful is served to Google’s crawler or to search visitors. That is the same method used in our core WordPress malware cleanup. Where the flag was triggered by thousands of injected spam pages, our SEO spam cleanup service handles that side in depth.
How we write the review request
Once we are confident the site is clean, we submit a review from the Security Issues report. Google asks you to describe what you fixed. A vague line like “site cleaned, please review” gives the reviewer nothing to go on.
We write a short, factual account instead: the type of infection, its location, the material taken out, the route the attacker used, and the changes made so that route is closed. We do not overstate anything, and we do not paste in technical logs nobody asked for.
Where several issue types are listed, each needs to be resolved before the review covers them. If the Safe Browsing warning came from a phishing kit on a subfolder, that folder needs to be gone or returning an error, not just hidden.
Waiting for the result
Google states that review times vary with the type of issue. We do not give a date, because it is not ours to give. While the review is pending, we keep an eye on the site for any sign of reinfection and on Search Console for updates. When a decision is made, it appears in Search Console.
If the review is rejected, Google normally indicates that problems remain. We go back in, find what was missed, fix it, and request again with an updated explanation.
Other services that may still block you
Clearing Google’s flags does not always clear everyone else’s. Microsoft’s browser protection, Bing, and several antivirus and security vendors keep their own lists, and each has its own way to ask for a review. If customers say their antivirus is still blocking your site after Google has cleared it, that is a different job, covered on our page about a website flagged by antivirus software.
After the flag is lifted
When the warning disappears, traffic does not snap back instantly. Searchers who saw the label may need time to trust the site again, and spam URLs created during the hack can stay in Google’s index for a while. Getting those leftover pages out is handled by our service to remove hacked pages from Google. The longer recovery of rankings and traffic is the subject of our post on search recovery after a website hack.
We also recommend a few habits that make a second flag far less likely: keep plugins and themes current, remove anything abandoned, keep dated backups away from the server, and make sure Search Console alerts reach an inbox someone actually reads.
What you can do right now
- Take a screenshot of the warning, exactly as visitors see it.
- Open Search Console if you have it, and note what the Security Issues report lists.
- Do not request a review yet, even if you have removed something suspicious.
- Find your hosting and WordPress logins, or the person who has them.
If Google is warning visitors away from your site, start a WhatsApp chat with the word HACKED, attach a screenshot of the warning along with your domain, and we will work out which flags are active and what clearing them involves.