The idea
Google crawls an enormous amount of the web. When it finds a page serving malware, running a phishing page, or pushing software people did not ask for, it records that.
That list is published for browsers to use. Chrome checks it. So do Firefox, Safari and others, which is why one flag ends up warning almost everyone rather than only Chrome users.
When it matches, you get the red screen. Not a small notice at the top of the page. A full page telling you to go back, with the real site tucked behind a warning you have to deliberately override.
What being flagged actually means
For a site owner, this is not a badge of shame. It is a tap you cannot turn back on.
- →Browsers actively warn people away. Most visitors will not click through a red screen, and they should not. Your traffic does not decline. It ends.
- →It reaches search. Flagged sites can carry a warning in results, so people are turned away before they even click.
- →It follows your links everywhere. Some platforms and email providers check the same data, so your address can stop working in messages and posts too.
- →It is not instant to undo. Cleaning the site does not clear the warning by itself. You have to ask for a review, and then wait.
Getting a flag lifted
The order matters, and skipping the first step just wastes the review.
Fix the actual problem first. Find and remove the injected code, close whatever let it in, and change the passwords that may have been taken. If you only remove what you can see, it will come back, and a second flag is harder to shake.
Then verify ownership of the site in Google Search Console. It will show you what was found and where, which is usually the fastest way to understand the scope. Once the site is genuinely clean, request a review from there.
Reviews are not immediate. That gap is why the sensible time to care about this is before it happens.
Staying off the list
Nothing exotic. Sites get flagged because something got in, so the defence is the ordinary one.
- →Keep your platform, plugins and themes updated.
- →Use unique admin passwords and turn on two-factor authentication.
- →Limit what your pages can load and run with a Content Security Policy.
- →Review the third-party scripts on your site, especially anything near a checkout. See web skimming for why.
- →Verify your site in Search Console now, so a warning reaches you rather than your customers.
Checking a site without opening it
If you are a shopper and a site feels off, you do not have to visit it to find out. That is the wrong way round.
Our free check queries Safe Browsing for you, along with the site's certificate, headers and domain records. You paste the address and get a verdict, and the risky page never loads on your device.
One thing to be clear about: a clean result means the site is not on the list. It does not mean the site is honest. New scam sites are new, and the list is a record of what has already been caught. Read it alongside the other signals in how to spot a scam website, and how to check a website for malware if that is your specific worry.