Clear a "Deceptive site ahead" warning

Google blocks a compromised site until it re-checks. Clean it first, then request a review through Search Console.

Visitors see a red "Deceptive site ahead" interstitial instead of your site. Applies to any site flagged by Google Safe Browsing.

Google flags sites it believes host malware, phishing pages, or misleading content. The warning appears in Chrome, Firefox and Safari, so in practice the site is unreachable for most visitors.

Clean the site before requesting a review. Google re-scans on request, and a failed review does not just leave the warning — repeated failed requests slow down subsequent reviews. Work through Clean malware from your website first, and make sure you closed the entry point rather than only deleting files.

Request the review

Sign in to Google Search Console.
Select the affected property. If the site is not listed, add and verify it first — verification is usually a DNS TXT record or an uploaded file.
Open Security & Manual Actions → Security issues.
Read what Google found. It names the issue type and, usually, example URLs.
Tick I have fixed these issues.
Select Request a Review.
Describe what you actually did — which files were infected, what you replaced, which passwords you changed, how the attacker got in.

Be specific. A review request saying "fixed it" is weaker than one listing the compromised plugin, the version you replaced it with, and the credentials you rotated.

How long it takes

A few days, typically. The warning stays visible throughout — that is expected and does not mean the request failed.

Check back in Search Console; the security issues section shows the review status.

While you wait

Do not remove the site. Google needs to fetch it to verify the fix.
Do not request repeatedly. It does not speed anything up.
Fix the example URLs Google listed if any still serve bad content — the review checks those first.

If the review fails

Something is still infected. Common causes:

A backdoor was missed. Files were cleaned but the mechanism that uploaded them was not.
Only the homepage was cleaned. Injected content often lives in subdirectories or in old, unused installations on the same account.
The database is infected, not just files. Injected scripts in post content survive a file clean entirely.

Re-scan the whole account, not just the affected site — see Scan your site for malware.