Get access

Guide · 11 November 2026

Cloudflare shows "Suspected phishing" in front of my site. What now?

If your site runs through Cloudflare and visitors get a Cloudflare warning page about phishing instead of your page, Cloudflare has placed a Trust and Safety block on that link. It is Cloudflare's action, not a browser list and not your internet provider. Look for it on the Blocked Content and Abuse Reports pages of your Cloudflare account, remove whatever was reported, then press Request Review.

Source: Cloudflare Docs, Complaint types, updated 20 April 2026 · Cloudflare Docs, Blocked Content, updated 1 May 2026

Why does Cloudflare show a phishing warning?

Cloudflare shows the warning after a phishing report about a link on your site, once it has confirmed that the phishing page exists. Its documentation says a valid phishing report must name the domain and the specific link to the phishing page. When Cloudflare confirms it, visitors who open that link get a warning page, and Cloudflare tells the site owner to clean the malicious files from the origin server (your own server behind Cloudflare).

The warning does not delete anything. In a 2019 post on its approach to abuse, Cloudflare explained that the warning page stands in front of the content, which stays on the hosting server, and that the site owner or the host still has to remove it.

Source: Cloudflare Docs, Complaint types, updated 20 April 2026 · Cloudflare Blog, 27 February 2019

Why is only one page affected?

Because on a hacked site the warning is usually placed per URL, not per domain. In the same post Cloudflare described two cases. When a legitimate site has been hacked, for example through an outdated content management system, Cloudflare can put the warning in front of that specific phishing content, usually at the level of one URL. When a site exists only to deceive, Cloudflare takes broader action: a warning in front of the whole domain, and in some cases it ends its service.

So a homepage that opens normally proves little. Check the exact path that was reported, such as a login, checkout or file download page. Cloudflare's guidance to people who report abuse points the same way: one website can have parts hosted by different providers, so reports should name the URL of the specific item.

Source: Cloudflare Blog, 27 February 2019 · Cloudflare Docs, Providing specific URLs, updated 20 April 2026

Where do I find the reason in the Cloudflare dashboard?

Two pages in your Cloudflare account show it. The Abuse Reports page lists abuse reports filed against your zones and the actions Cloudflare took in response. The Blocked Content page lists the blocks themselves, in three groups:

Active
The block is in effect now.
Pending
Cloudflare will place the block at a scheduled time.
Resolved
Recently ended blocks, kept for 30 days. No action needed.

You need the Admin, Super Admin or Trust and Safety role in the account to open Blocked Content. If a colleague set up Cloudflare, ask them or have them add you.

Source: Cloudflare Docs, Brand Protection, checked 11 November 2026 · Cloudflare Docs, Blocked Content, updated 1 May 2026

Did Cloudflare tell me?

Probably, but perhaps not at the address you read. Cloudflare sends abuse messages to the abuse contact address set on your account, and if none is set, to one of the account's Super Administrators. You can set it under Manage Account, Configurations, "Abuse report contact email address". Cloudflare asks customers to keep that address monitored, suggests a shared mailing list, and asks them to respond to any abuse report notification within 24 hours. If you do not respond or do not address the report, Cloudflare says it may remove or block the reported content, or suspend the account's services.

Source: Cloudflare Docs, Abuse contact, updated 20 April 2026 · Cloudflare Docs, Abuse report obligations, updated 20 April 2026

How do I appeal?

Fix first, then ask for the review in the dashboard. The order that follows from Cloudflare's documentation:

  1. Read the abuse report to see which URL was reported and why.
  2. Remove the reported content from your origin server. If the site was hacked, close the hole as well, or the page may come back.
  3. On the Blocked Content page, select Request Review on the active block. Its status changes to In Review and the Trust and Safety team looks at it.
  4. For a block that is still pending, Request Review cancels the scheduled action, so the block is not placed.
  5. When you answer the abuse report, include any information you believe is relevant to Cloudflare's assessment.

Cloudflare's documentation gives no time for a review, and it describes no setting in your zone that removes this warning: the Trust and Safety team removes it.

Source: Cloudflare Docs, Blocked Content, updated 1 May 2026 · Brand Protection · Abuse report obligations

What can I not control?

You do not choose who reports your site, and a report about one link is enough to start the process. While the block is active, every visitor who reaches that URL through Cloudflare gets the warning instead of your page, whatever their provider or browser. Our note on red warnings and lost visitors shows how few people click past browser phishing warnings.

The Cloudflare warning is also separate from the lists browsers use. A clean result in Google's Safe Browsing or Microsoft SmartScreen does not lift it, and lifting it does not clear those lists. If Chrome or Edge warn as well, see "Deceptive site ahead" and SmartScreen "reported as unsafe".

Cloudflare also sorts domains into content and security categories. That is a separate system: if you find a wrong security category on your domain in the Investigate section of the dashboard, you can request a change there, and Cloudflare says it does not guarantee approval.

Source: Cloudflare Docs, Change categorization, updated 12 October 2026

Does linkspect detect Cloudflare's phishing warning?

Not yet. linkspect does report when a CDN (the network in front of your server, such as Cloudflare) shows its own block page for a legal order, but Cloudflare's phishing warning page is not one of the pages it recognises today. Every check does look the URL and the domain up in Google Web Risk, the commercial counterpart of Google Safe Browsing, and reports a hit next to the per-provider answers. Verdict reference · Get early access