Website flagged as unsafe? How to check it and get the warning removed
Published on November 9, 2026 10 min read
Is a browser or antivirus blocking your website? Check whether it is really infected and request a review from each scanner that flags it.
A red browser warning or a block by an antivirus program does not automatically mean your website is infected. Often only one scanner or one company web filter flags it, based on reputation rather than on what is actually on your site. Check first whether something is wrong: if your website is clean, ask the party that blocks it for a review, and if it is infected, clean it up first and request the review afterwards.
Where does the warning come from?
Every scanner keeps its own list, and whoever shows the warning decides where you request the review. So ask the visitor who saw it for a screenshot of the whole page: it shows the name of the program and the exact address that was blocked.
| What the visitor sees | Where it comes from | What it means |
|---|---|---|
| A red page saying Dangerous site in Chrome, or a similar red warning in Firefox or Safari | Google Safe Browsing | Google has listed your site or one of its pages. Most visitors using these browsers see the warning, so deal with this one first. |
| A red page in Microsoft Edge saying This site has been reported as unsafe | Microsoft Defender SmartScreen | Microsoft has listed your site. Visitors using Edge see the warning. |
| A block page with the logo of an antivirus product such as Norton, McAfee, Bitdefender or ESET | The antivirus software on the visitor's computer | Only users of that product see the warning. |
| A block page on the network of a school, healthcare provider or company | That network's web filter, such as Fortinet, Sophos, Cisco, Palo Alto Networks or Zscaler | The filter has put your site in the wrong category. Only people on that network see the warning. |
| The address bar says the connection is not secure, or the browser shows a certificate error | The SSL certificate or insecure elements on your page | This is about the encrypted connection, not about a virus. See SSL certificate and fix mixed content and HTTPS errors. |
| An email from us with the subject Possible malware found on your website | The daily malware scan of LJPc hosting | We found files on your website that look malicious. The email lists the files and the type of malware we suspect. See what to do after a malware alert. |
If only one visitor sees a warning and nobody else does, it may come from that visitor's own computer: an antivirus program with a strict setting, or adware that shows fake warnings in the browser. A screenshot helps you tell the difference.
Is your website really infected? How to check
- Check Google. Enter your domain name in the Google Safe Browsing site status tool. If it says No unsafe content found, Chrome, Firefox and Safari are not blocking your site.
- Check the other scanners. Open VirusTotal, choose the URL tab and enter your website's address. VirusTotal runs it past more than 70 antivirus scanners and blocklists and shows the verdict of each one. If the report is old, use the Reanalyse button for a fresh check.
- Look in Google Search Console if you use it for your domain. The Security issues report shows exactly what Google found and on which pages.
- Check your inbox for an email from us titled Possible malware found on your website, and note which files it lists.
- Look at your site yourself. Search Google for
site:yourdomain.comand look for pages you do not recognise, for example in another language or about pharmacy or gambling. Check WordPress for administrators or plugins you did not add, and open your site on your phone too: some infections only redirect mobile visitors to another site. - Run a second remote scan with Sucuri SiteCheck. It looks at what a visitor gets to see and tells you whether your domain is on well-known blocklists.
| Result | What it usually means | Next step |
|---|---|---|
| One or a few scanners on VirusTotal flag it, Google and Microsoft find nothing, and you see nothing odd yourself | Most likely a false positive | Request a review from the scanners that flag it |
| Google reports a problem, or Search Console shows a security issue | Google found something concrete | Find and remove the cause, then request a review |
| You received a malware alert from us | There are files on your website that look malicious | Inspect the listed files and remove what does not belong |
| Many scanners flag it at once, or you see strange pages, administrators or redirects | Your website is almost certainly infected | Clean up your website before you request a review |
Why would a scanner block a clean website?
Scanners judge more than the content of your page; they also look at your domain's reputation. That is how a clean website can still end up on a list. Common causes:
- An old infection. Your site was infected once and has been cleaned, but the scanner has not looked at it again yet.
- A new or second-hand domain. Company filters are suspicious of domains that were registered recently or used to belong to someone else.
- Something that looks like phishing. A page with a login form, or a form that asks for personal details, can mislead an automated scanner.
- Content from other sites. A script, advert or link to a site that is listed itself can drag your site along.
- A company filter's category. A web filter at school or work sometimes blocks whole categories. If your site is in the wrong category, it cannot be reached there while it opens fine at home.
Your website is clean: how to get the warning removed
A scanner only removes your site from its list when you ask. VirusTotal cannot change verdicts itself, so you request a review from each scanner separately.
- Note what is blocked: your whole domain or a single page, and which scanners flag it. Keep the link to the VirusTotal report; many vendors ask for it.
- Look at the block page first. It often has a link to report a wrong warning. In Microsoft Edge it is More information > Report that this site doesn't contain threats.
- Otherwise use the vendor's form from the table below. If the scanner is not listed, see VirusTotal's list of vendor contacts.
- Keep it short and specific: the address, that it is your website, what you checked and with what result, and that you are asking for a new review. Send one request per vendor and wait for the answer.
- Check again afterwards with Google's site status tool and a new analysis on VirusTotal.
| Scanner or filter | Where you meet it | How to request a review |
|---|---|---|
| Google Safe Browsing | Chrome, Firefox, Safari | In Google Search Console, in the Security issues report, with the Request Review button. Without Search Console, use the Safe Browsing report form and choose This page is safe. |
| Microsoft Defender SmartScreen | Edge, Windows | From the warning via More information > Report that this site doesn't contain threats. In the form, choose that you are the owner of the website. You receive a confirmation by email. |
| Bitdefender | Antivirus | False positive form, with URL as the sample type |
| ESET | Antivirus | By email, following ESET's instructions |
| Kaspersky | Antivirus | Look up your domain in Kaspersky OpenTIP and click Submit to reanalyze |
| Norton | Antivirus | Norton Safe Web: sign in with a Norton account, add your site, verify that it is yours and click Submit dispute |
| McAfee | Antivirus | Via McAfee's guide for a website that was rated incorrectly |
| Avast and AVG | Antivirus | The form of Avast or AVG, choose website |
| Trend Micro | Antivirus | Look up your site in the Site Safety Center and request a new review there |
| Fortinet (FortiGuard) | School and company networks | Form for a URL wrongly rated as malicious, or the category form for a wrong category |
| Sophos | Company networks, antivirus | By email, following Sophos' instructions |
| Webroot (OpenText) | Antivirus, company filters | Change request |
| Cisco Talos, Palo Alto Networks, Zscaler | Company networks | Requires an account or is only open to their customers. So also ask the IT administrator of the network: they can allow your site straight away. |
How long a review takes depends on the vendor. Google says a few days to a few weeks, Trend Micro usually two to seven days and FortiGuard usually within 24 hours. Do not resubmit while your first request is pending: according to Google, that slows things down.
The Request Review button requires a verified domain in Google Search Console. You verify a domain with a TXT record in your DNS; add DNS records for a third-party service explains how to add one.
Your website is infected: how to clean it up
- Record what you have. Note which files the alert lists and make a backup of the current state in Plesk. That way you keep recent orders or messages, and you can see later what changed. Give that backup a clear name so you never restore it by mistake.
- Change your passwords: for WordPress administrators, FTP and SFTP accounts and the customer portal. Remove administrators you do not recognise and turn on two-factor authentication for the customer portal. Use Have I Been Pwned to check whether your email address appears in a data breach.
- Restore a clean version. If you have a backup from before the infection, restore it as described in how to back up your website. We also back up the whole server every night; how to get an earlier version back from it is explained in backups at LJPc hosting.
- Or clean WordPress yourself. In Plesk, go to WordPress, click Check WordPress Integrity for your site and then Verify Checksums. If WordPress's own files differ, click Reinstall WordPress Core; your content stays in place. This step does not check
wp-config.phpor the files inwp-content: replace plugins and themes with fresh copies and delete files you do not recognise. - Update everything: WordPress, plugins and themes, and remove plugins you do not use. See update WordPress safely. Then switch on the recommended security measures under Security on your site's card in WP Toolkit. Make a backup first, as not every measure can be undone.
- Check again with the steps above and only then request a review. If something is still on your site, the request is usually rejected and the process takes longer.
What LJPc hosting takes care of
- A malware scan every night. We scan the websites on our hosting servers for malware every night. If we find files that look malicious, you receive an email with the files and the type of malware we suspect. Your website stays exactly as it is: you decide what happens, and we help if you want us to. Files we found before are checked again on every scan.
- The alert goes to the right person. In the customer portal, signed in with the main account, go to My account > Notifications and choose under Malware alerts which email addresses receive it, for example your web developer's. If you leave the field empty, it goes to your account's email address.
- A backup of the server every night, on a separate backup server, so we can restore an earlier version of your website.
- Help when you want it. Would you like us to investigate, clean up your website or request the reviews from the scanners for you? Create a support ticket. We do this work at our hourly rate: you see beforehand what we will do and how many hours it takes, and we only start after your approval.
Frequently asked questions
My website is flagged as unsafe. Does that mean it has been hacked?
Not necessarily. Check your domain with the Google Safe Browsing site status tool and on VirusTotal. If Google finds nothing and only one or a few scanners on VirusTotal flag it, it is most likely a false positive. If you see strange pages, unknown administrators or redirects, or many scanners flag it at once, assume your site is infected and clean it up first.
How do I get my website off an antivirus blacklist?
Request a review from each scanner that blocks your site. The block page often has a link to report a wrong warning; otherwise use that vendor's form. For Google, use Request Review in Search Console; for Microsoft, use More information and Report that this site doesn't contain threats. VirusTotal cannot change verdicts itself.
How long does it take for the warning to disappear?
It depends on the vendor. Google says a few days to a few weeks, Trend Micro usually two to seven days and FortiGuard usually within 24 hours. Do not resubmit while your first request is pending; according to Google, that slows things down.
Why do I not see the warning while a visitor does?
The warning then comes from something only that visitor has: their own antivirus, the web filter of the network they are on, or sometimes adware on their computer. Ask for a screenshot of the whole page. It shows which program gives the warning and where to request a review.
My website is only blocked at school or at work. What can I do?
The web filter of that network is blocking your site, often because it is in the wrong category. Ask the network's IT administrator to allow your site, and request a new category from the filter vendor, for example Fortinet.
Can LJPc get the warning lifted for me?
Yes. Create a support ticket and we will investigate, clean up your website if needed and request the reviews from the scanners for you. We do this work at our hourly rate and only start after your approval. We also scan your website for malware every night and email you if we find something.