A customer messages to say they tried to open your website and got a full-page warning from their antivirus. Another says it works fine for them. You search for your business on Google and see no warning at all. It is confusing, and it is tempting to put it down to a problem on that one customer’s computer.
Usually it is not. Antivirus programs, browser security extensions and the filters that protect office networks all rely on reputation data that security companies collect for themselves. When one of them lists your domain, its users are blocked, whatever Google thinks of the site. This page explains how that happens and how we deal with it. For problems that also involve Google’s own warnings, start at our hacked website repair page, which links to each specific situation.
Who is doing the blocking
Several kinds of product can stand between a visitor and your site, and they do not share one list.
- Desktop and mobile antivirus suites from companies such as Norton, McAfee, Kaspersky, Bitdefender, ESET and Avast, which check addresses before a page loads.
- Browser extensions that rate links and pages, often made by those same companies.
- Built-in browser protection. Chrome, Firefox and Safari use Google Safe Browsing. Microsoft Edge uses Microsoft Defender SmartScreen, which has its own data.
- Business network filters, meaning the firewalls and DNS filtering services that companies use to block categories of sites for their staff.
Because of that split, a site can be blocked for one visitor and open for the next. It also means the Google route, covered on our Google blacklist removal page, only fixes the browsers that rely on Safe Browsing. Every other vendor has to be dealt with on its own terms.
What gets a website flagged
Real malware on the site
This is the most common cause, and the one to rule out first. Injected JavaScript that redirects visitors, hidden iframes, a phishing kit in a subfolder, or a script that pushes a fake download. Security vendors’ crawlers often find these on pages the owner never visits, such as an old landing page or a file deep in the uploads folder. Our post on the symptoms owners usually spot first may help you recognise others.
Something you host for download
Software installers, zip archives, macro-enabled documents and even PDFs get scanned by vendors. A file that was infected on the computer it came from, or one an attacker swapped on your server, can get the whole domain marked.
Third-party code
Your site may be clean while something it loads is not. An ad network serving a bad creative, a chat widget whose provider was compromised, an old analytics or visitor counter script from a domain that has since changed hands. The vendor sees bad content on your pages and lists you alongside the source.
Links to flagged sites
Spam comments, a hacked blogroll, or links injected into old posts that point at malicious domains can drag your own reputation down with some vendors.
Spam sent from your server
If the server, or a form on the site, is being abused to send junk mail, the domain and IP address can land on reputation lists that some security products also use for web browsing. Fixing the mail side is covered on the page about stopping a website from sending spam.
False positives
These do happen. Heavily compressed or obfuscated code that is harmless, a brand-new domain with no history, a shared server IP that previously hosted something nasty. A false positive still has to be argued for properly, with evidence that the site is clean.
How we clear a vendor listing
The first step is finding out who lists the domain and what they say about it. Multi-engine checkers such as VirusTotal show which vendors flag a URL, and most vendors also have a lookup page of their own that gives a category or reason. That tells us whether the issue is “malicious”, “phishing”, “suspicious” or simply an unrated new site, and each one calls for a different response.
Next we trace each verdict back to a cause on the site. Scanning matters here, and so does reading the pages the way a vendor’s crawler sees them, including every script loaded from another domain. If you want to take a first look yourself, our guide to ways to scan a website for malware explains the options and their blind spots.
If there is malware, it is removed before anything goes to any vendor. Asking a vendor to recheck a site that is still infected wastes the request and may make later requests less likely to be taken at face value. The cleanup itself follows our malware removal process for WordPress.
Then come the review requests. Each vendor has its own form or address for disputes and false-positive reports, and each wants slightly different information. We write each request with what was found, what was fixed, and the exact URLs concerned. Some vendors reply. Others never reply but quietly update their verdict. So we recheck the listings afterwards rather than waiting on an inbox.
If a listing stays in place, we look again. Sometimes the vendor has flagged a specific URL we had not yet seen, and that turns up a second problem.
Looking past the pages: the domain and the server
Not every listing is about content. Some vendors score the domain itself, and a domain registered recently, or one that changed owner, can be treated with suspicion until it builds a history. Others score the server’s IP address. On shared hosting, your site may sit on an address that also hosts hundreds of strangers, and one bad neighbour can affect how some products treat everyone there.
We check both. If the domain is simply uncategorised, the fix is often a category submission rather than a malware dispute, since many business filters block unrated sites by default. If the IP address is the problem, the conversation is with your host, and moving to a different address or a better plan may be the realistic answer. Neither of those needs any change to your website, which is exactly why they get missed when people only scan the files.
Why office networks matter more than they seem
For a business that sells to other businesses, the network filter case is the one that hurts quietly. A purchasing manager clicks your link from a work laptop, sees a block page from the company firewall, and moves on to a competitor. Nobody tells you. Most of those filters draw on the same commercial reputation feeds that antivirus vendors maintain, so clearing the vendor listings usually clears them too, but it is worth asking a friendly client to test from their office once the work is done.
What you can do now
- Ask the customer who saw the warning for a screenshot, the name of the security product, and the exact page they were trying to open.
- Do not tell customers to ignore the warning or add your site as an exception. If there is real malware, you would be sending them straight into it.
- Think about what changed recently: a new plugin, a new ad or chat script, a file uploaded for customers to download.
- If the same customers also see a red warning in Chrome, read our explanation of the Deceptive site ahead warning, because that one comes from Google.
Preventing a repeat listing
Most repeat flags come from the same places as the first one: an outdated plugin that lets malware back in, or third-party scripts that nobody reviews. Keeping a short list of every external script your site loads, and removing the ones you no longer use, cuts that risk. So does scanning files before you offer them for download, and keeping the site’s software current.
Asking us to look
Send us the site address, the product that blocked it, and the screenshot if you have one. If the block is costing you sales or bookings, write HACKED at the start of your WhatsApp message and it jumps the queue of routine jobs. A backup comes before any change, then a plain explanation of what the vendors are reporting and a realistic start point, followed by WhatsApp updates as each listing is dealt with. If the flag turns out to come from a planted login page, the phishing page removal service covers that case.