Google says “Deceptive site ahead”. Here is how to clear it.

The short answer

“Deceptive site ahead” means Google Safe Browsing has flagged pages on your domain as phishing or social engineering: content built to trick visitors into handing over passwords or card numbers, or into installing something. On a small business website that usually means the site was hacked and someone is using it to host a scam.

Do three things now: confirm the warning in Google’s Safe Browsing site status check, open the Security Issues report in Google Search Console to see which pages are flagged, and stop the damage without deleting the evidence of how they got in. When every flagged page is clean and the way in is closed, request a review in Search Console. The warning comes down once Google agrees.

What “Deceptive site ahead” means, and why your site has it

Google keeps a list of web pages it believes are dangerous, called Safe Browsing. Chrome and other browsers check that list, and when a page is on it they put a full red screen in front of it. Google’s guidance on deceptive sites describes the “Deceptive site ahead” screen as the warning for social engineering: phishing pages that pose as a bank, a browser or a government body, and deceptive content such as fake “update required” prompts or tech support scams. Newer versions of Chrome may show the same kind of block under the heading “Dangerous site”, as Chrome Help lists it.

Your business did not set out to deceive anyone, so how did it get here? Google says it plainly: attackers take over innocent websites to host this content. The usual routes are an outdated plugin, a reused password, or another site on the same hosting account that was already compromised. Google also counts deceptive ads and pop-ups embedded in your pages against your site, even when a third party serves them.

The first three things to do

1. Check the status from outside. Google’s Transparency Report has a Safe Browsing site status page. Type in your domain and it tells you whether Google currently considers the site unsafe, and whether only some pages are affected. Do not click through the warning on your own computer to look.
2. Open Google Search Console. The Security Issues report lists what Google found and gives sample URLs. If you have never set up Search Console, verify your domain now with the TXT record it gives you, added at your DNS provider. While you are there, check the owners and users for anyone you did not add.
3. Contain it, but do not delete anything yet. Take a full copy of the files and the database, change the passwords for WordPress, the hosting account, FTP and the email tied to the admin account, and tell your host. The infected files are the trail that shows how the attacker got in. The full checklist is in what to do in the first hour after a hack.

Clean everything before you ask for a review

Google is clear that a partial fix earns nothing. Every issue on every page has to be gone before the review, and the sample URLs in the report may not be the whole list. A proper cleanup covers:

• Phishing pages and kits removed from the server, including folders nobody normally looks in.
• WordPress core, the theme and every plugin replaced with clean copies from the source, and the uploads folder checked for PHP files that should never be there.
• The database searched for injected content and administrator accounts you did not create.
• The way in found and closed: the vulnerable plugin removed or updated, the reused password retired.
• Ads, embeds and third-party scripts checked. The URL Inspection tool in Search Console shows what Google sees on desktop and on mobile.

Some infections only show their content to certain visitors, such as people arriving from a Google search or on a phone, so a page that looks fine to you is not proof. This is the core of WordPress malware removal, and it is the part that decides whether the warning stays down. If you want to know what kind of infection you are dealing with, the common WordPress hacks are explained one by one.

How to request a review in Search Console

1. Open the Security Issues report and confirm that every listed issue is fixed and tested.
2. Select Request Review.
3. In the box, explain what was wrong, what you did about it and how you checked: which files and pages were removed, which plugin was replaced, which accounts were deleted, which passwords were changed.
4. Submit once, then wait. Google asks you not to resubmit before it gives a final decision, and says a review can take from a few days to a few weeks.

If Search Console lists no issues but the warning is still there and you are confident the site is clean, Google offers two routes: request a security review anyway, or use the Safe Browsing error report form to report a warning you believe is wrong.

Microsoft Edge and antivirus warnings

Google’s list is not the only one. Microsoft Edge uses Microsoft Defender SmartScreen, which keeps its own. If Edge blocks your site, Microsoft’s instructions are to open the block page, look under More information and choose the link to report that the site does not contain threats. Microsoft confirms with an email from its SmartScreen Reputation Group, and you can reply to that email if the matter is urgent.

If a customer says their antivirus software blocked you, ask which product. Each vendor keeps its own list and its own way to dispute it, and clearing Google does not clear them.

After the warning comes down

The red screen is the loudest damage, not the only damage. Spam pages created during the hack may still sit in Google’s index under your name. They leave when your server answers them with a 410 Gone, and that takes weeks of recrawling, not days. I wrote up how that works in the rebuild, the redirects and the Google cleanup.

It is also the moment to decide whether the old site deserves another chance. If it was old, built by someone who is gone, or hacked through software nobody maintains, a rebuild on a clean host is often the better spend.

Keep it from happening again

• Keep WordPress, the plugins and the theme updated, and delete what you do not use.
• Use unique passwords and two-factor sign-in on WordPress and on the hosting account.
• Keep backups off the server, and restore one now and then to prove they work.
• Put a firewall such as Cloudflare in front of the site.
• Have someone watching, so a changed file is caught in hours instead of when a customer mentions a red screen.

That last point is what my WordPress maintenance plans and managed WordPress hosting are for. Every site I host, in Louisville or anywhere else, sits behind Cloudflare firewall rules, is checked from outside every 60 seconds, and has its database backed up offsite every day.

Frequently asked questions

How long does it take for “Deceptive site ahead” to go away?

Google says a security review can take from a few days to a few weeks after you request it. The clock only starts once the site is fully clean and the review is submitted, so the fastest route is a thorough cleanup the first time.

Can I tell customers to click past the warning?

No. If the warning is right, you would be sending customers into the very thing it protects them from. If it is wrong, the fix is a review request or an error report, not a workaround.

Is my website blacklisted everywhere?

Google’s Safe Browsing list is used by Chrome and other browsers. Microsoft Edge checks its own SmartScreen list, and antivirus vendors keep theirs. Check each one, because clearing one does not clear the others.

What if Google flagged my site by mistake?

It happens, but check carefully first, because some hacks only show their content to visitors arriving from Google or on phones. If you are confident the site is clean, request a review in Search Console or use Google’s Safe Browsing error report form.

Do I need a new domain?

Almost never. The problem is on the pages, not the name. A clean site and a successful review clear the warning, and a new domain would throw away everything the old one has earned.