"Deceptive Site Ahead" Warning on Your Website: How to Remove It

What the "Deceptive site ahead" warning means

Google's social engineering documentation says Chrome may show "Deceptive site ahead" when Google detects content that tricks people into doing something dangerous, such as entering a password or card number, calling a fake support line or installing software.

Google lists three kinds: phishing (pages that pretend to be a bank, government site or login screen), deceptive content (fake update pop-ups and ads that look like buttons) and insufficiently labelled third-party services (for example, a donation or payment page run by another company that does not say it is acting for you).

Common causes on small business websites

The first cause is by far the most frequent on shared hosting. Attackers do not need to touch your homepage; they hide a fake page deep in a folder and send links to it by email or SMS. Google spots it, and the warning applies to your whole domain or a path on it.

First hour: confirm what Google found

1. 1

   Open Search Console and check owners

   Sign in to Google Search Console, confirm you own the site, and look under Settings for owners or users you did not add. Attackers sometimes verify themselves. If you have never set it up, our guide to Google Search Console setup takes 15 minutes.

2. 2

   Open the Security Issues report

   It lists the issue type (such as deceptive pages or hacked content) and sample URLs. Google's Security Issues report help explains each type.

3. 3

   Visit samples from outside your network

   Google advises using a computer that is not on the network serving your site, because attackers can hide pages from the owner. Use mobile data and a private window.

4. 4

   Check the public status

   Google's Safe Browsing site status page shows what visitors are being told about your domain.

5. 5

   Preserve evidence

   Download the hosting access logs and a copy of the flagged files before you delete them. They show when the files appeared and from which IP address.

Clean up the site and close the hole

Removing the flagged pages takes minutes. Making sure they do not come back is the real work.

• Delete the phishing folders and any files modified around the same date. Look for recently changed PHP, HTML and .htaccess files, not just the URLs Google listed. Google's report notes that missing samples does not mean no other pages are affected.
• Change every password: hosting control panel, FTP/SFTP, database, CMS admin accounts and the email account linked to the hosting. Turn on MFA where offered.
• Remove unknown admin users in WordPress or your CMS, and unknown SSH keys or FTP accounts in hosting.
• Update or remove the CMS, plugins and themes. Delete anything you do not use.
• Check third-party scripts and ads. Google says ad networks rotate ads, so refresh pages several times on mobile and desktop.
• Restore from a clean backup if the site is badly infected, then update everything before going live.

If the files keep reappearing after deletion, there is a backdoor you have not found. At that point a full rebuild or a professional malware clean-up is cheaper than repeated reinfection. Our guide to what to do when your website is hacked covers the full incident process.

Request a review and how long removal takes

When every issue is fixed on every page, select Request Review in the Security Issues report. Google's help says a good request explains the exact issue, describes the steps you took and documents the outcome.

• Timeline: Google says a security review can take from a few days to a few weeks. You get an email when it starts and another when it ends.
• Do not resubmit while a review is pending. Google asks owners not to.
• Partial fixes fail. Fixing only some pages does not earn a partial lift, per Google's report help.
• If you think Google is wrong, its social engineering page links to a form to report an incorrect Safe Browsing classification.

Microsoft Edge uses its own SmartScreen service, which may keep a warning after Google clears you. Check your site in Edge too, and use Microsoft's reporting option if it still shows a warning.

Tell customers and check the PDPA

If people entered passwords or card details into a fake page on your domain, they are at risk even after the page is gone. Post a short notice, tell affected customers what to watch for, and tell your bank or payment provider if card details may have been captured.

If the attacker reached personal data you hold, such as a customer database on the same hosting, assess whether it is a notifiable data breach under the PDPA, using PDPC's guide on managing data breaches: likely to cause significant harm, or affecting 500 or more people. Notifiable breaches must be reported to PDPC within 3 calendar days of that assessment. This is general information, not legal advice.

Do it yourself or get help?

If Google flagged a single folder, you can find it, and your CMS is up to date, a careful owner can clean up and request a review in an afternoon.

If the warning returns or you are not sure how the attacker got in, our Quick Fix (S$119 for one hour) can triage the report and remove simple cases. Website Security Hardening (S$290) then locks the site down with updates, a firewall, login protection and off-site backups. A full malware clean-up of an infected site is quoted separately.