Google Safe Browsing False Positive: How to Get the Warning Removed

What a Google Safe Browsing flag looks like

A full-page red interstitial in Chrome, Firefox, Safari and Edge — 'Deceptive site ahead', 'The site ahead contains malware', 'The site ahead contains harmful programs' — and a 'This site may harm your computer' or 'This site may be hacked' label under the result in Google Search. Ads on the domain are disapproved at the same time.

Why clean sites end up flagged here

• A hack that has since been cleaned: injected redirect, spam pages or a phishing directory that Google crawled before you removed it.
• A phishing or malware page on a subdomain or under a path you do not look at (old test folders, user uploads).
• A third-party script or ad tag that served malicious content for a while.
• Content that Google's social-engineering classifier reads as deceptive — fake download buttons, login forms that mimic another brand, misleading ads.
• A genuine false positive on a clean page, which is rarer than owners expect: Google re-crawls before it removes the flag, so 'still flagged' usually means 'something is still there'.

Where to submit: Search Console → Security Issues → Request Review

https://search.google.com/search-console/security-issues

Account: Google account with a verified Search Console property for the domain (owner or full-permission user).

What it asks for:

1. Checkbox confirming the issues were fixed
2. Free-text description of what was done, per issue

If Search Console lists no security issue but Chrome still warns, the flag is on a URL Google attributes to another property, or the data is stale. Use the Safe Browsing 'Report incorrect phishing warning' form only for a URL you do not own in Search Console.

Step by step

1. Open the Security Issues report. In Google Search Console, select the verified property for the domain and open Security & Manual Actions → Security issues. Each issue names the category (Social engineering, Malware, Harmful downloads, Hacked content) and lists sample URLs.
2. Fix every sample URL, then look for what the samples imply. The list is a sample, not the full set. For each URL, remove the content or confirm it is clean; then search the site for the same pattern (same directory, same injected string, same redirect). Check subdomains — a flag on one can warn on all.
3. Verify from outside. Fetch the sample URLs as Googlebot (URL Inspection → Live test), from a mobile user agent, and from a different network. Cloaked malware shows clean to the owner and dirty to Google. Confirm they return 404 or clean content.
4. Request review. Back in Security issues, tick 'I have fixed these issues' and describe, per issue, what was found and what was removed — specific files, paths, dates. Submit once. Duplicate requests do not speed anything up.
5. Wait, then confirm. Google says most reviews finish within a few days; harmful-download reviews can take longer. When the issue disappears from the report, browser warnings clear within hours as the Safe Browsing list propagates. Then clear the vendors that copied Google's verdict.

What to write

Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.

Issue: {category} on {sample URL}.
What was found: {e.g. injected JavaScript redirect in wp-content/themes/{theme}/header.php; a phishing page under /old/secure-login/}.
What was done: {files removed / restored from clean backup, dated}; {plugin/theme} updated to {version}; all admin passwords and API keys rotated; a WAF is now in place.
Verification: the listed URLs now return 404 (or the clean page), checked with URL Inspection live test and from an external network on {date}.
The site no longer hosts the reported content. Please re-check and remove the warning.

Why requests get rejected, and the fix

• The content is still reachable — on a URL that was not in the sample list, on a subdomain, or only when fetched as Googlebot or on mobile. Search the whole site for the same pattern, test with URL Inspection live test and a mobile user agent, and remove it before re-submitting.
• Repeat Offender status: the site went clean → flagged → clean within a short window, and Google has disabled Request Review for 30 days. Nothing shortens the 30 days. Use them to find the reinfection path (compromised credentials, an unpatched plugin, a backdoor file) so the next review holds.
• The description was empty or generic ('site is clean now'). Name what was found and what was removed, with paths and dates. Reviewers look for evidence the owner understood the problem.

Who copies this verdict

• Most browser and DNS-filter warnings mirror Google's list, so clearing Google clears them without a separate request.
• Antivirus vendors do not copy Google automatically — Norton, McAfee, ESET, Bitdefender and the others each need their own request.

Sources

• Google Search Console Help — Security Issues report
• Google Search Central — Social engineering (phishing and deceptive sites)
• Google Search Central — Prevent abuse on your site

Longer read: why Google Safe Browsing flags clean sites and how unflagdomain handles it.