How to Remove the Google Dangerous Site Warning From Your Website

To remove the Google dangerous site warning, you need to clean the whole site, close the hole the attacker used, and then ask Google to review it through the Security Issues report in Google Search Console. Google says that if the review finds the site clean, the warnings in browsers and search results are removed within 72 hours.

The order matters. A review request sent before the site is fully clean usually fails, and repeated failures can slow down your next request. This guide walks through the process in the order we follow when we clean up a flagged WordPress site.

What the warning means

Google runs a service called Safe Browsing that scans the web for sites that spread malware, trick people into giving up personal information, or have been hacked. When it flags a site, visitors may see:

• A full-page red warning in Chrome and other browsers that use Safe Browsing, such as “Dangerous site” or “Deceptive site ahead”.
• A label in Google search results, such as “This site may be hacked”.
• Hacked pages removed from search results.

The cost is real. Most visitors leave when they see a red warning screen, and ad platforms and email services may also start blocking your links. The good news is that the process for getting off the list is clear, and Google documents it well.

Step 1: Confirm the problem and get the details

Check the site status

Google’s Safe Browsing site status tool shows whether a site is currently flagged. Anyone can use it, and it does not require you to visit the site.

Verify your site in Google Search Console

To see the details and request a review, you need access to your site in Google Search Console. If you have not set it up, add your site and verify ownership. A domain property, verified with a DNS record, covers every version of your site, including www and non-www addresses and all subdomains.

Read the Security Issues report

Open Security & Manual Actions, then Security Issues. Google’s Security Issues report help page explains each issue type. The report tells you:

• The type of problem, such as malware, deceptive pages, hacked content or unwanted software.
• Sample URLs where Google found it.

The sample URLs are examples, not a full list. Google is clear that the problem has to be fixed across the whole site, not just on the pages it lists.

Step 2: Clean the whole site

This is the step that decides whether your review succeeds. On a hacked WordPress site, cleaning means more than deleting the pages Google found.

1. Take a full copy first. Save files, database and server logs before you change anything. Our guide to the first hour after a WordPress hack explains why.
2. Replace software with clean copies. Reinstall WordPress core, plugins and themes from trusted sources at the same versions.
3. Search for backdoors. Attackers leave hidden ways back in: PHP files in uploads, must-use plugins, rogue admin users, scheduled tasks and database injections. Our guide to finding WordPress backdoors covers each one.
4. Remove injected content. Hacked sites often contain thousands of spam pages, or spam links added to real pages. Remove them, and make sure the removed URLs return a 404 or 410 status.
5. Check what Google sees. Some malware only shows itself to search engines or to visitors arriving from Google. Use the URL Inspection tool in Search Console to view a page the way Googlebot sees it.

Close the entry point

If you clean the site but leave the way in open, the attacker returns, often within days. The usual causes are an outdated or abandoned plugin, a weak or reused password, or another infected site in the same hosting account. Update everything, remove what you do not use, change every password, and replace the secret keys in wp-config.php so all users are logged out.

Our WordPress security hardening checklist covers the follow-up work.

Step 3: Request a review

When you are confident the site is clean, go back to the Security Issues report and select Request Review.

What to write in the request

Google asks for a clear description of what you fixed. A good request explains:

• What the problem was. For example, “Our site was hacked through an outdated plugin, and attackers added spam pages and a redirect script.”
• What you did to fix it. For example, “We replaced all core, plugin and theme files with clean copies, removed all injected spam pages, deleted the unknown admin accounts, updated all plugins and changed all passwords.”
• The result. For example, “We rescanned the site and checked the sample URLs, and they now return a 404 status.”

Be specific and honest. A short, factual request is better than a long, vague one.

How long the review takes

According to Google’s guide to requesting a review:

If the review succeeds, Google says warnings in browsers and search results are removed within 72 hours. You will get a message in Search Console either way.

If your review is rejected

A rejection means Google still found a problem. It usually comes with new sample URLs. Do not resubmit straight away:

1. Check the new sample URLs, and look for the same pattern elsewhere on the site.
2. Look again for backdoors. If the problem came back after you removed it, something is recreating it.
3. Request a new review only when you have fixed the new findings.

Avoid repeat offender status

Google’s Safe Browsing repeat offender policy applies to sites that keep switching between clean and harmful. Once a site is marked as a repeat offender, its owner cannot request a review for 30 days. Google’s Security Issues help also warns that asking for a review before the problem is fixed can lead to longer waits next time. One careful request is faster than three rushed ones.

What to do while you wait

A review can take days, so use the time well:

• Tell people what is happening. If customers rely on your site, a short note by email or on social media explains the warning and stops them from worrying.
• Keep checking the site. Watch for new admin users, changed files and spam pages coming back. If the infection returns during the review, the review will likely fail.
• Pause paid ads that point to the site. Ad platforms may reject or suspend ads that link to a flagged site. Restart them once the warning is gone.
• Do not send a second review request. Google asks site owners to wait for a final decision on the current request before sending another.

Check other blocklists too

Google is not the only service that keeps a list of unsafe sites. The WordPress.org guide FAQ: My site was hacked notes that Bing, other search engines and desktop antivirus apps run their own lists, and that visitors may be blocked by any of them. After your Google review succeeds:

• Register your site in Bing Webmaster Tools and check for security warnings there.
• Check major antivirus and web reputation services that your visitors are likely to use, and use their review process if your site is listed.
• Ask your host whether your server’s IP address landed on email blocklists. Hacked sites are often used to send spam, which can stop your business email from being delivered.

Keep the warning from coming back

Once the warning is gone, keep it gone:

• Keep Search Console set up, with email alerts going to someone who reads them.
• Update plugins, themes and WordPress on a schedule, and remove anything abandoned.
• Use two-factor authentication for every administrator.
• Watch for new admin users and unexpected file changes.

This is the kind of routine work covered in our guide to what WordPress maintenance includes.

Need help getting off the list?

If your site is flagged and you want it handled properly the first time, our WordPress malware removal service includes the full cleanup, the root-cause fix and the review request to Google. We give a fixed quote after a short assessment. Contact us with your site address and what you are seeing.

Frequently asked questions

How long does it take Google to remove a dangerous site warning?

Google says malware reviews take a few days, phishing reviews about a day, and reviews for sites hacked with spam can take several weeks. If the review succeeds, warnings are removed within 72 hours.

Can I remove the warning without Google Search Console?

Google may clear the warning on its own after it rescans a clean site, but there is no set timeline. Verifying your site in Search Console and requesting a review is the reliable way to get it removed.

What happens if my review request is rejected?

Google keeps the warning and usually gives you more sample URLs that still have problems. Fix those, check the whole site again, and then submit a new request.

What is a Safe Browsing repeat offender?

It is a site that keeps switching between clean and harmful. Google blocks review requests from repeat offenders for 30 days, so make sure the site is truly clean before you ask for a review.