# Clear a "Deceptive site ahead" warning
Source: https://docs.webgee.com/en/security-ssl/deceptive-site-ahead-how-to-request-google-to-review-a-compromised-site



Visitors see a red **"Deceptive site ahead"** interstitial instead of your site.
Applies to any site flagged by Google Safe Browsing.

Google flags sites it believes host malware, phishing pages, or misleading
content. The warning appears in Chrome, Firefox and Safari, so in practice the
site is unreachable for most visitors.

<Callout type="warn">
  **Clean the site before requesting a review.** Google re-scans on request, and
  a failed review does not just leave the warning — repeated failed requests slow
  down subsequent reviews. Work through
  [Clean malware from your website](/en/security-ssl/steps-to-cleaning-malware-from-your-website)
  first, and make sure you closed the entry point rather than only deleting
  files.
</Callout>

## Request the review [#request-the-review]

1. Sign in to [Google Search Console](https://search.google.com/search-console).
2. Select the affected property. If the site is not listed, add and verify it
   first — verification is usually a DNS TXT record or an uploaded file.
3. Open **Security & Manual Actions → Security issues**.
4. Read what Google found. It names the issue type and, usually, example URLs.
5. Tick **I have fixed these issues**.
6. Select **Request a Review**.
7. Describe what you actually did — which files were infected, what you replaced,
   which passwords you changed, how the attacker got in.

Be specific. A review request saying "fixed it" is weaker than one listing the
compromised plugin, the version you replaced it with, and the credentials you
rotated.

## How long it takes [#how-long-it-takes]

A few days, typically. The warning stays visible throughout — that is expected
and does not mean the request failed.

Check back in Search Console; the security issues section shows the review
status.

## While you wait [#while-you-wait]

* **Do not remove the site.** Google needs to fetch it to verify the fix.
* **Do not request repeatedly.** It does not speed anything up.
* **Fix the example URLs Google listed** if any still serve bad content — the
  review checks those first.

## If the review fails [#if-the-review-fails]

Something is still infected. Common causes:

* **A backdoor was missed.** Files were cleaned but the mechanism that uploaded
  them was not.
* **Only the homepage was cleaned.** Injected content often lives in
  subdirectories or in old, unused installations on the same account.
* **The database is infected**, not just files. Injected scripts in post content
  survive a file clean entirely.

Re-scan the whole account, not just the affected site — see
[Scan your site for malware](/en/security-ssl/malware-scanner-how-to-scan-your-sites-for-malware).

## Related [#related]

* [Clean malware from your website](/en/security-ssl/steps-to-cleaning-malware-from-your-website)
* [Scan your site for malware](/en/security-ssl/malware-scanner-how-to-scan-your-sites-for-malware)