Remove your site from Google Safe Browsing
Google Safe Browsing removal is a manual review requested in the Security Issues report of Google Search Console, and only a verified owner of the property can file it. Google publishes no API for that submission, so no tool or agency can automate or expedite it. The warning lifts when Google re-crawls the site and finds the flagged content gone; its help says a review can take from a few days to a few weeks. A repeat flag shortly after a cleared review locks reviews for 30 days.
Cleaned your site but Chrome still shows the red interstitial — “Deceptive site ahead”, “The site ahead contains malware” — and Search Console still lists a security issue? There is exactly one path, and every step of it is on your side of the fence.
| Where | Google Search Console → Security & Manual Actions → Security issues → Request Review |
|---|---|
| Who can file | An owner or full-permission user of the verified property. Nobody else, no API. |
| Google states | A review can take from a few days to a few weeks to complete. |
| What resets it | A rejected review. A repeat flag within a short window: 30-day Repeat Offender lockout. |
| Clears with it | Chrome, Firefox, Safari, Edge interstitials and most DNS filters that mirror Google's list. |
| Does not clear with it | Antivirus vendors (Norton, McAfee, ESET, Bitdefender, Kaspersky…), each of which keeps its own verdict. |
- 01
Confirm the flag and read the category
In Google Search Console, open Security & Manual Actions → Security issues for the verified property. Google names the category — Social engineering, Malware, Harmful downloads, Hacked content, Uncommon downloads — and lists sample URLs. The category tells you what Google expects to be gone.
- 02
Clean every sample URL, then what the samples imply
The list is a sample. Remove the flagged content and search the whole site for the same pattern: the same injected string, the same directory, the same redirect. Check every subdomain and every property variant (http, https, www, non-www). Then close the way in: update the CMS and plugins, rotate passwords and API keys, remove unknown admin users.
- 03
Verify from outside
Use URL Inspection → Test live URL on the sample URLs, and fetch them with a mobile user agent from a different network. Cloaked malware shows clean to the owner and dirty to Googlebot. Every sample must return 404 or genuinely clean content.
- 04
Request review — once, with specifics
Back in Security issues, tick 'I have fixed these issues' and describe, per issue, what was found and what was removed, with paths and dates. Submit once. Duplicate requests do not move the queue.
- 05
Wait for the re-crawl, then clear the other vendors
Google's help says a review can take from a few days to a few weeks. When the issue disappears from the report, browser warnings follow as the Safe Browsing list updates. Antivirus vendors keep their own verdicts and each need a separate request.
Google's Safe Browsing policy has a rule owners discover the hard way: if a site is cleared on review and then flagged again within a short window, Google classifies it a Repeat Offender and disables Request Review in Search Console for 30 days. The warning stays up for the whole period. There is no appeal and no shortcut.
The rule targets cosmetic cleanups — deleting the visible spam page while the backdoor that created it stays. Before the first review, close the way in: update the CMS, themes and plugins; rotate every password and API key; remove admin users you did not create; look for PHP files in upload directories and for scheduled tasks you do not recognise. A review that holds is faster than two reviews.
Short, specific, impersonal. What was found, what was removed, when, and how it was verified. Reviewers look for evidence the owner understood the problem, not for apologies.
Issue: {category} on {sample URL}.
What was found: {e.g. injected JavaScript redirect in wp-content/themes/{theme}/header.php; a phishing page under /old/secure-login/}.
What was done: {files removed / restored from a clean backup, dated}; {plugin/theme} updated to {version}; all admin passwords and API keys rotated; unknown admin user removed; a WAF is now in place.
Verification: the listed URLs now return 404 (or the clean page), checked with URL Inspection live test and from an external network on {date}.
The site no longer hosts the reported content. Please re-check and remove the warning.The content is still reachable.
On a URL that was not in the sample list, on a subdomain, under a different property, or only when fetched as Googlebot or on mobile. Search the whole site for the pattern, test with the live URL inspection and a mobile user agent, and re-submit only when every path is clean.
Repeat Offender status.
The site went clean → flagged → clean within a short window. Google disables Request Review for 30 days and the warning stays. Nothing shortens it; use the time to find the reinfection path (credentials, an unpatched plugin, a backdoor file) so the next review holds.
The description was empty or generic.
'Site is clean now' gives the reviewer nothing to check. Name what was found and what was removed, with paths and dates.
The flagged resource is not yours.
A third-party script, an ad tag or an embedded page served the malicious content. Remove or replace the resource, then request review — Google flags the page that loaded it.
// related: the short Google Safe Browsing guide · the complete removal guide, every vendor · what “Deceptive site ahead” means · check a URL against Safe Browsing · Google Ads disapproved for “Compromised site”
A hack that reached Google's list usually reached a few antivirus vendors too, and those do not clear when Google does. Scan the domain to see every vendor involved before you start. If more than Google is flagging you, we send the request to each of them for €49, once, and prepare the Search Console text for you to paste.
// free scan · payment only if vendors flag you and there are requests to send
Clean the flagged content, verify it is gone from outside your own network, then request a review in the Security Issues report of Google Search Console for the verified property. Google re-crawls and removes the warning if it finds nothing; its help says a review can take from a few days to a few weeks. There is no instant removal.
No. Google publishes no API for review submissions, no support line and no paid channel. Any service, including ours, can only prepare the request text; the submission and the review are Google's. Claims of expedited Google delisting are not credible.
Google's help says a review can take from a few days to a few weeks to complete, and that a request filed before the issue is fixed can make the next one take longer. A rejected review resets the clock; a repeat flag locks reviews for 30 days.
If a site is flagged again shortly after a review cleared it, Google marks it a Repeat Offender and disables Request Review in Search Console for 30 days. It exists to stop cosmetic cleanups — remove the visible symptom, get cleared, get reinfected. The defence is closing the way in before the first review.
The flagged URL belongs to a property you have not verified (a subdomain, http vs https, www vs non-www), the warning is on a resource your page loads rather than the page itself, or the data is stale. Verify every variant as its own property and check the report on each.
No. Browser warnings and DNS filters that mirror Google's list clear on their own. Most antivirus URL reputation systems keep their own verdict and need a separate request through their own channel; a few brands share an engine or a feed with another vendor, so one reclassification can clear more than one entry.
Because the review is manual and owner-only, we do not submit it. We prepare the exact text for you to paste into Search Console, and in the same dispatch we send the removal requests to every other vendor flagging the domain. We never claim to automate or expedite Google's review.