You click on your own website link and instead of your homepage, a bright red warning page appears: "Deceptive site ahead." Your traffic drops overnight. Google Search Console flags your site. If this has happened to you, you're not alone, and the good news is it's fixable. Here's exactly what to do.
What "deceptive content" actually means
A deceptive content warning, officially called a Safe Browsing warning, is issued by Google's Safe Browsing service, which protects over 5 billion devices worldwide by scanning websites for harmful or misleading content. When Google's systems detect content designed to trick users into revealing personal information, installing malware, or taking actions they didn't intend, it flags your site and displays the red warning screen to visitors.
This is not the same as a manual penalty. It's an automated detection triggered by specific signals on your site, which means it can happen even if you didn't knowingly add any harmful content.
Impact by the numbers
According to Google's Transparency Report, Safe Browsing warnings reduce traffic to flagged sites by an average of 95% within 24 hours of the warning appearing. Acting quickly is critical. Every day the warning is live, trust erodes further.
Why the warning appears
Your site doesn't have to be intentionally malicious to get flagged. These are the most common triggers:
- Malware injection. Hackers inject hidden scripts or iframes into your site's code.
- Phishing content. Fraudulent password or login pages designed to steal user credentials.
- Compromised pages. Harmful redirects injected by out-of-date or abandoned plugins.
- Deceptive ads. Third-party ad scripts serving misleading or malicious content.
How Safe Browsing works
Google's Safe Browsing scans page content, scripts, links, and user signals using a combination of automated crawling and machine-learning classifiers. According to Google's security research, over 3 million URLs are flagged per day globally, the vast majority due to third-party code injected without the site owner's knowledge.
How to fix it: step by step
Step 1. Confirm the warning in Google Search Console
Always start here.
Log in to Google Search Console (search.google.com/search-console) and check the Security Issues report under the "Security & Manual Actions" section. This shows you exactly what Google detected, whether it's malware, phishing content, harmful downloads, or deceptive pages, and which specific URLs are affected.
Screenshot the Security Issues report before making any changes. Before submitting for review, this helps you verify all issues have been handled and creates a record of the original problem.
Step 2. Check your site for malware or injected code
Determine what's causing the flag.
Use a reliable security scanner to do a comprehensive malware scan. For WordPress sites, Wordfence and Sucuri SiteCheck are widely used options. For any site, Google's own Safe Browsing diagnostic page provides a URL-level check.
Also manually inspect your site's <head> section and footer for unfamiliar scripts, base64-encoded strings, or iframes pointing to external domains you don't recognise.
Pay particular attention to recently modified files. Use your hosting panel's file manager and sort files by "last modified" date. Anything changed around the time the warning appeared is a prime suspect.
Step 3. Remove the harmful content and patch vulnerabilities
Clean thoroughly, not quickly.
Delete or restore any infected files. If you run WordPress, restore core files from a clean backup or reinstall them. Update all plugins, themes, and the CMS itself. Outdated software is the leading cause of website compromises, accounting for over 56% of hacked WordPress sites according to WPScan data.
Change the passwords for the database, CMS admin, hosting account, and FTP. Revoke and regenerate API keys. If you use a shared hosting environment, alert your host. Other sites on the same server may be compromised too.
Do not simply restore a backup without first understanding how the site was compromised. Restoring to an already-vulnerable state means you'll be hacked again within days.
Step 4. Request a security review from Google
The final step to lift the warning.
Once you've cleaned your site and confirmed the malicious content is gone, return to Google Search Console. In the Security Issues report, click "Request Review." Write a clear, specific explanation of what you found, what you removed, and what steps you've taken to prevent recurrence. Be factual and detailed. Vague requests take longer to process.
Google typically responds within 1 to 3 days for most sites. If your review is approved, the Safe Browsing warning is removed. If it's denied, the report will show what still needs resolving.
While waiting for review, temporarily add a banner to your site (if it's still accessible to some users) explaining that the issue is being resolved. That maintains brand trust throughout the assessment period.
Step 5. Harden your site so it doesn't happen again
Long-term security is where the real work is.
Focus on prevention once the alert has been removed:
- Every admin account should have two-factor authentication (2FA) enabled.
- Install a Web Application Firewall (WAF) to stop malicious requests before they reach your server.
- Set up automated weekly malware scanning and configure real-time alerts for file changes.
- Review your Content Security Policy (CSP) headers. These tell browsers which scripts and resources are allowed to run on your pages, dramatically reducing the risk of successful code injection attacks.
Check your site's Safe Browsing status monthly using Google's Transparency Report tool. Catching a new flag within hours rather than days can make the difference between a minor disruption and a major traffic loss.
Conclusion
A deceptive content warning feels alarming, and for good reason. The impact on traffic and trust is immediate and significant. But it isn't a permanent mark against your site. Google's Safe Browsing system is designed to protect users, not permanently penalise site owners who respond responsibly.
The key is a disciplined, thorough process: diagnose the exact issue in Search Console, clean every trace of malicious code, patch the vulnerabilities that let it in, and submit a clear, honest review request. Sites that follow this process completely, rather than rushing through it, get the warning lifted and stay clean.
Going forward, treat security as an ongoing routine rather than a one-time fix. Regular updates, automated scanning, strong authentication, and a properly configured firewall are what separate sites that get hacked repeatedly from those that don't. Your visitors trust you with their time and data. That trust is worth protecting proactively.
If your site is currently showing a Safe Browsing warning and you'd like an experienced pair of eyes on it, drop us a line. We've cleaned up dozens of compromised Shopify and WordPress installations and can usually diagnose the root cause within a few hours.