How this check works
Scanaris looks your URL up in Google Safe Browsing, the blocklist used by Chrome, Firefox, Safari, Android and Google Search itself to warn about dangerous sites. It asks about four threat types: malware, social engineering (phishing), unwanted software and potentially harmful applications. If Safe Browsing returns no match, there is no finding: the vast majority of sites are clean and there is no point saying so. If it returns any, it opens a critical-severity finding, the most serious there is, with the threat types detected. If the lookup fails, nothing is invented.
Why it matters
Being on Safe Browsing is, in practice, being off the internet. Every visitor on Chrome, Firefox or Safari sees a full-screen red page saying your site is dangerous and advising them not to enter; most do not. Google adds a warning to the results and, if it persists, deindexes you. Emails with links to your site go to spam. And what lies behind it is usually worse than the flag itself: it almost always means someone got into your server and injected code that redirects to scams, shows ads or steals your users' data. In other words, it is not a false positive to be removed, it is a security incident to be resolved.
How to fix it
- Confirm what Google sees. In Search Console, the "Security issues" section tells you which URLs and which type of problem. Google's Transparency Report also shows it without an account.
- Find the injected code. Look for recently modified files you did not touch, obfuscated scripts at the end of JS or PHP files, redirects in
.htaccessor in the configuration, admin users you do not recognise, plugins or themes you did not install. On WordPress, a malware scanner helps; on any stack, comparing against your clean repository is the most reliable. - Clean up and close the door. The safest route is to redeploy from clean code, not to patch what is infected. Then whatever let the attacker in: update everything (WordPress, plugins, dependencies), change every password and key (panel, database, FTP, API, hosting), review the WordPress, outdated libraries and sensitive files checks, and turn on two-factor authentication at the host.
- Request a review. In Search Console, under "Security issues", the "Request review" button. Explain what you found and what you did. Google usually responds within a day or two and the flag disappears from browsers shortly after.
- Keep watch. Reinfections are common if the door is still open. Scan again after a week and after a month.
Check it is fixed
Open Google's Transparency Report and look up your domain:
https://transparencyreport.google.com/safe-browsing/search?url=yourdomain.comIt should say no unsafe content has been detected. In Search Console, "Security issues" should be empty. And open your site in Chrome from an incognito window: no warning should appear.
Frequently asked questions
My site is clean, so why am I flagged?
Sometimes the flag comes from a resource you load: a compromised third-party script, a malicious ad, a plugin that injects redirects only for certain visitors or countries. What you see in your browser may not be what a mobile user in another country sees. Check the Search Console reports, which give the exact URL and type.
How long does it take to be removed?
After cleaning up and requesting the review, usually between 24 and 72 hours. If you request the review without having cleaned up, it is rejected and the next attempt takes longer.
Does this check detect attacks in progress?
No: it detects that Google has already flagged you, which is the consequence. Live intrusion attempts (brute force on the login, credential theft) need an agent inside your application; that is what the live threats service on the Pro plans does.