Google "Dangerous Site" or "Deceptive Site Ahead" Warning: How to Fix It

A red "Dangerous site", "Deceptive site ahead" or "The site ahead contains malware" screen in front of your website means Google Safe Browsing has flagged it. Most visitors turn back at that screen, and Google Search may add a warning to your listing too. This guide explains what the warning means, how to confirm it, how to clean the site properly and how to ask Google to remove the warning.

1. What the warning means

Google Safe Browsing scans the web for sites that harm visitors. When it flags a site, Chrome and Firefox (and Safari, in most regions) show a full-page red warning before the visitor reaches it. The exact wording changes between browser versions, but the common ones are:

Older articles call this the "Google attack page" or "Reported attack site" warning. It is the same system.

2. Confirm the problem and find out what Google saw

Check two places before you change anything.

Google Safe Browsing site status

Open the Google Transparency Report site status tool and enter your domain. It tells you whether the site is currently flagged and, in general terms, why. Anyone can use it; you do not need to own the site.

Search Console "Security issues" report

Google Search Console gives the detail you need to clean up:

1. Sign in and open your site's property. If you have never added the site, add it as a Domain property and verify it with the DNS TXT record Search Console gives you.
2. Open Security & manual actions, then Security issues.
3. Note the issue type, such as "Hacked: Malware", "Hacked: Code injection", "Hacked: URL injection" or "Deceptive pages".
4. Note the sample URLs. They show you where to start looking.

Also check your email. Google sends a Search Console message when it detects a problem, and it often names the issue.

3. Emergency steps: the first hour

Do not panic, and do not start deleting files at random. Work in this order.

4. Find and remove the malware

Attackers rarely leave just one file. Check every area below, even after the scanner reports "clean". Most examples are for WordPress because most hacked sites run it, but the same ideas apply to any CMS.

WordPress core, plugin and theme integrity

WordPress publishes checksums for its core files and for plugins from the official directory. If you have SSH access, WP-CLI compares your files against them:

cd ~/public_html
wp core verify-checksums
wp plugin verify-checksums --all

Any file reported as changed or unexpected needs attention. The simplest fix for core files is to replace them with a fresh copy of the same WordPress version: replace the wp-admin and wp-includes folders completely, and keep wp-config.php and wp-content. See Restoring and Resetting WordPress Core Files for the step-by-step method.

For plugins and themes, delete the folder and install a fresh copy from the official source. Remove any plugin or theme you do not use, and never keep "nulled" (pirated) premium plugins or themes. They are one of the most common ways malware gets in.

Unknown administrator users

Attackers add their own administrator account so they can come back. List every administrator:

wp user list --role=administrator

Or check Users in the WordPress dashboard and filter by Administrator. Delete any account you do not recognise, and assign its content to a real user when WordPress asks.

Recently modified and unfamiliar files

Look for files that changed around the time the problem started, and for PHP files where they do not belong:

# PHP files changed in the last 14 days
find ~/public_html -type f -name "*.php" -mtime -14 -ls

# PHP files inside the uploads folder (there should normally be none)
find ~/public_html/wp-content/uploads -type f -name "*.php"

# Common obfuscation patterns used by malware
grep -rlE "eval\(base64_decode|gzinflate\(base64_decode|str_rot13\(|assert\(\\\$_(POST|GET|REQUEST)" ~/public_html

A search result is a lead, not proof: some legitimate plugins use these functions. Compare suspicious files with a fresh copy before you delete them. Without SSH, use your control panel's File Manager and sort by modification date.

.htaccess redirects

Malware often adds rules to .htaccess that redirect visitors from Google or on mobile phones to spam or scam sites, while you see the normal site. Check the .htaccess file in your website folder and in its subfolders. A clean WordPress .htaccess is short; compare yours with the default WordPress .htaccess file and remove any rules you did not add yourself, especially ones that check the referrer or user agent.

Database injections

Some infections live in the database rather than in files. Check these places:

• Site address: in wp_options, the siteurl and home values must be your own domain.
• Posts and pages: injected script tags or hidden links in post content.
• Widgets and theme options: injected code in wp_options.

With WP-CLI you can search the whole database:

wp option get siteurl
wp option get home
wp db search "<script" --all-tables
wp db search "eval(" --all-tables

Your table prefix may not be wp_; check $table_prefix in wp-config.php. Take a fresh database export before you edit any row.

Other places attackers hide

• Cron jobs in your control panel that download the malware again every few minutes.
• Extra FTP accounts and SSH keys you did not create.
• Email forwarders that copy your mail to an outside address.
• Files outside the website folder, such as in your home directory.

5. Close the hole and harden the site

Cleaning without fixing the entry point means the site will be hacked again, often within days. The usual entry points are an outdated or pirated plugin or theme, a weak or reused password, or an old, forgotten installation in a subfolder.

• Update everything: CMS core, every plugin and every theme. Delete what you do not use, including old test installs.
• Use a supported PHP version. Choose one from the PHP selector in your control panel that your CMS and plugins support.
• Use strong, unique passwords stored in a password manager, and turn on two-factor authentication for every administrator.
• Give each person their own account with the lowest role they need. Do not share one admin login.
• Protect the login page with a security plugin that limits login attempts.
• Set safe file permissions: normally 644 for files and 755 for folders, with wp-config.php stricter where your host allows it.
• Keep SSL on and force HTTPS.

For the full checklist, read The Complete WordPress Hardening Guide.

6. Request a review from Google

Request a review only when the site is fully clean. A failed review does not help, and Google may take longer to review the site again.

How long does it take? It varies. Google's own documentation says a security review can take from a few days to a few weeks. If the review is rejected, the message tells you what Google still found. Fix it and request another review.

If the warning came only from the Safe Browsing site status and your site is not verified in Search Console, verify it first. Search Console is the only direct way to request a review.

7. Prevent a repeat

See also How to Back Up and Restore Your Website and Security Checklist: What to Do If Your Website Has Been Hacked or Defaced.

8. Help from Domain India

Domain India's cPanel and DirectAdmin shared hosting plans include server-level security: Imunify360, a web application firewall (WAF), malware removal tools, DDoS protection and CloudLinux, which keeps each hosting account isolated from the others on the server. Webuzo hosting has Imunify malware scanning but not CloudLinux. These layers block many common attacks and catch many known malware files. They do not replace keeping your own site updated: a vulnerable plugin or a stolen password can still let an attacker in.

If your site is on Domain India hosting and has been flagged:

• Open a support ticket from the client area. Tell us the domain and paste the issue type and sample URLs from Search Console.
• Support can check the server-side scan results for your account, so you can see which files the server scanner has flagged.
• Keep the cleanup of your website files, plugins and database in your own hands, or with your developer, unless support confirms otherwise in the ticket.

Read Understanding Imunify360 Security in cPanel to learn what the scanner does. If you are choosing hosting for a new or rebuilt site, these plans include the security features above:

Compare all plans on cPanel hosting, DirectAdmin hosting and Webuzo hosting. Card prices are Domain India list prices on 19 September 2026, excluding 18% GST.

Frequently asked questions

Ready to secure your site? Open a ticket from the client area if your Domain India site has been flagged, work through the WordPress hardening guide, or compare cPanel hosting plans with built-in Imunify360 security.