Guide · 11 November 2026

Chrome says "Deceptive site ahead" on my site. What now?

The red "Deceptive site ahead" or "Dangerous site" page means Google Safe Browsing has listed pages on your site. "Deceptive site ahead" is the warning for social engineering: content that tricks visitors into revealing confidential information or downloading software. Open the Security issues report in Google Search Console to see what Google found and on which URLs, remove it from every page, then press Request Review. Only Google can lift the warning.

Source: Google Search Central, Social engineering, updated 10 December 2025 · Google Chrome Help, checked 11 November 2026

What is Google Safe Browsing?

Safe Browsing is Google's list of unsafe web pages, and Chrome shows its red warning when a visitor opens a URL on that list. Google finds phishing sites with statistical models and scans its web index daily. A listed site appears on the list within minutes of detection, and Google says it takes about half an hour on average to show up for users. Chrome uses the same "Dangerous site" warning for phishing, malware, unwanted software and social engineering.

Source: Google Transparency Report, Safe Browsing FAQ, checked 11 November 2026 · Google Chrome Help, checked 11 November 2026

Why would Google flag a legitimate site?

A legitimate site usually gets flagged because something on its pages behaves like a scam, even if the owner did not put it there. Google's documentation names these cases:

• Hacked pages. Attackers change existing pages or add new ones to collect data such as card numbers.
• Ads and other embedded content. A deceptive ad counts as a violation for the page that hosts it, even when it is not visible and only opens pop-ups, pop-unders or redirects. Images and third-party components can do the same.
• Login pages that look like someone else's. The warning "Possible phishing detected on user login" means a password reuse warning fired when a user signed in on one of your pages. Google notes that attackers sometimes trick users into reusing their passwords on pages that look like official login pages.
• Unlabelled third-party services. If you run pages for another organisation, for example a donation platform collecting for a charity, every page must make the relationship clear. Google recommends standard services such as OAuth for sign-in.

Source: Google Search Central, Social engineering, updated 10 December 2025 · Search Console Help, Security issues report, checked 11 November 2026

Where do I see the reason?

The Security issues report in Search Console is the place: it lists each issue with the date Google first detected it, a short description and sample URLs. Google calls the report the "source of truth", even when you cannot reproduce the warning yourself. The sample list is partial, and no sample URLs does not mean no pages are affected. Google advises registering your site in Search Console before anything goes wrong so it can notify you promptly.

Issue names tell you what kind of problem it is. "Deceptive pages" and "Deceptive embedded resources" are errors; "Suspected deceptive pages" and "Possible phishing detected on user login" are warnings. Hacked content has its own labels (malware, code, content or URL injection).

Anyone can also look up a URL or domain in Google's Safe Browsing site status tool in the Transparency Report. It returns the most recent Safe Browsing result for that page without visiting it. Google says site owners find additional diagnostic information in Search Console.

Source: Search Console Help, Security issues report, checked 11 November 2026 · Safe Browsing FAQ · Google Search Central Blog, March 2017 · Safe Browsing site status

How do I check the flagged pages without being fooled?

Open the sample URLs from a computer outside your own network, because Google warns that attackers can switch off their content when they think the visitor is the site owner. Ad networks rotate ads, so reload a page several times. Ads can also differ between phone and desktop: the URL Inspection tool in Search Console shows both views.

Source: Google Search Central, Social engineering, updated 10 December 2025

How do I request a review?

Fix every listed issue on every page first, then press Request Review in the Security issues report. Google says a partial fix does not earn a partial return. In the request, explain the exact problem, the steps you took and the result. If you bought the site recently and the problem came with it, say so.

Wait for the answer before you send another request. Google says that asking for a review before the problem is really fixed can make the next review slower and can get the site treated as a repeat offender. You get an email when the request is received and another when the review is done.

If you believe Safe Browsing classified a page in error, Google's guidance is to report it through the Safe Browsing incorrect phishing warning form.

Source: Search Console Help, Security issues report, checked 11 November 2026 · Google Search Central, Social engineering

How long does it take?

Google gives a range, not a promise: "A review can take from a few days to a few weeks to complete", according to the Security issues report help. For malware reviews, Google's Safe Browsing FAQ says a site is typically removed from the list within 24 hours if the new scan is clean. Google also rechecks listed sites on its own from time to time.

Source: Search Console Help, checked 11 November 2026 · Safe Browsing FAQ, checked 11 November 2026

What can I not control?

You cannot switch the warning off, speed up the review or pick which URLs Google lists. While the page is listed, most visitors stop at the warning: our note on red warnings and lost visitors has the numbers.

Some Chrome warnings do not come from the Safe Browsing list at all. The "Did you mean ...?" and "Fake site ahead" pages come from Chrome's lookalike-domain rules, which Chrome runs on the device by comparing the address with very popular sites and sites the user has visited. Chromium's documentation says review requests from flagged site operators are accepted for several months after a new lookalike check rolls out. And in a post of 20 October 2026, Google said that Chrome users with Enhanced Protection switched on can now also get a lower-confidence "suspicious site" warning, and that Chrome's Gemini-based scam detection, introduced on the device a year earlier against tech support scams, has transitioned to a server-side Gemini model, which analyses page text only when a site shows high-confidence scam signals. Google's announcement does not describe a review route for site owners for these warnings. Because they are decided while a visitor has the page open, a clean result in a list lookup does not rule them out.

Source: Google Chrome Help, checked 11 November 2026 · Chromium, lookalike warnings · Google, 20 October 2026

What does linkspect check?

Every linkspect check looks up the full URL and the domain in Google Web Risk, the commercial counterpart of Safe Browsing, and reports a hit next to the per-provider answers. It also checks Chrome's lookalike-domain rules. It does not run Chrome's own scam detection and does not show the warning page as a real browser shows it, not yet. Microsoft Edge and Cloudflare have their own warnings: see SmartScreen "reported as unsafe" and Cloudflare "Suspected phishing". How a check works · Get early access