Norton Safe Web Flagged My Website: How to Report a False Positive

What a Norton Safe Web flag looks like

A red Norton Safe Web warning page before the site loads, or a red 'dangerous' rating next to the result in search listings, for visitors running Norton 360, Norton AntiVirus or the Norton Safe Web browser extension. The public rating is visible to anyone at safeweb.norton.com.

Why clean sites end up flagged here

• A past compromise — malicious script, redirect or phishing page — that Norton's crawler recorded before the cleanup.
• A download on the site that Norton detects, which rates the whole site as dangerous.
• A phishing detection on a login or payment form.
• Community ratings from Norton users that pulled the rating down.

Where to submit: Norton Submission Portal — Report False Positive → Website

https://submissions.norton.com/reportfalsepositive

Account: None (a CAPTCHA check before submitting).

What it asks for:

1. Your email address (required)
2. Detection name (optional, max 30 characters)
3. Alert ID (optional — shown at the bottom of the Norton alert)
4. Website URL (required — the full URL including http:// or https://)
5. Description

Symantec's submission portal (symsubmit.symantec.com) serves Symantec Endpoint and Carbon Black products, not Norton Safe Web.

Step by step

1. Check the Safe Web rating. Search the domain on safeweb.norton.com and note the rating and any threat Norton lists. If a visitor sent you the Norton alert, note the detection name and Alert ID.
2. Fix or confirm the cause. Remove the content or file that matches the listed threat and verify from an external network. If Norton lists no threat and the site never hosted one, say so in the description.
3. Open the Report False Positive form. Go to the Norton Submission Portal's Report False Positive form and choose Website rather than File.
4. Fill in the fields and submit. Enter your email, the detection name if you have it (up to 30 characters), the Alert ID if you have it, the full URL including https://, and a description of why the site is safe. Complete the CAPTCHA and submit.
5. Recheck the rating. After Norton updates its verdict, search the domain on safeweb.norton.com again to confirm the rating changed. If a visitor is still warned, ask for a fresh screenshot of the alert.

What to write

Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.

{URL} is rated {rating shown} by Norton Safe Web. The site is a {one-line description of what the site is}. {Either: 'The content that caused the rating ({what}) was removed on {date}; the URL now returns {404 / the clean page}.' Or: 'The site has not hosted malware, phishing or unsafe downloads; it can be checked from any network.'}
Please re-evaluate the site and update its Safe Web rating.

Why requests get rejected, and the fix

• The dispute went to Symantec's enterprise portal. Norton Safe Web belongs to Gen Digital; use the Norton Submission Portal's Report False Positive form.
• The URL was entered without the protocol, or the file option was chosen. Choose Website and enter the full URL including https://.
• Norton re-checked and still found the listed threat. Search the site for the same pattern or file, remove it, and submit again with the removal date.

Who copies this verdict

• Products that use Norton's website ratings clear when Norton updates its verdict.

Sources

• Norton Support — Submit a file or URL to Norton for review
• Norton Submission Portal — Report False Positive
• Norton Safe Web — site rating lookup

Longer read: why Norton Safe Web flags clean sites and how unflagdomain handles it.