My site shows a red warning.
Chrome shows a red “Deceptive site ahead” or “Dangerous site” screen in front of your WordPress site, or your host has suspended it. Your visitors are being turned away. This page says what the warning means, what to do in the next hour, and how we clean the site and ask Google to remove the warning.
Google has flagged your site as unsafe.
The red screen comes from Google Safe Browsing, the list Chrome checks before it opens a page. “Deceptive site ahead” means Google found pages that try to trick visitors, such as a fake login form. “Dangerous site” usually means it found malware. On a WordPress site, either one almost always means someone got in and added code or pages of their own. Search results can carry a warning too.
Google lists what it found in Search Console, under Security issues: the type of issue, the date it was first detected, and some of the affected addresses. Your host may have found the same code and suspended the site to protect its other customers.
Three things to do now.
- Read the Security issues report in Search Console. Note the issue type and the sample addresses, and take a screenshot. Do not open the flagged pages in your browser; Google itself advises against it. If the site is not in Search Console yet, we can add it with you.
- Tell your host, and have the site taken offline. Ask them to stop serving it, or to point it to a plain holding page on another server. A WordPress maintenance-mode plugin is not enough: the hacked install keeps running behind it.
- Change every password, and look for new administrators. In WordPress, open Users and filter by Administrator. Write down any account you do not recognise, but do not delete it yet: it shows how they got in. Then change the passwords for every WordPress administrator, the hosting panel, FTP or SFTP, and the database.
Do not just restore an old backup and stop there. If the way in stays open, the same code usually comes back, and a review requested while the problem remains keeps the warning up for longer.
We clean it, close the way in, and ask Google for a review.
- Cleanup. We compare WordPress, your theme and every plugin with clean copies, and remove the code, files, database entries and user accounts that were added. We check every address Google listed, and the rest of the site with them.
- The cause, closed. We find how they got in, most often an out-of-date plugin or a reused password. We update or replace what was vulnerable, reinstall clean copies, and set new passwords and security keys.
- The review request, filed. When every listed issue is fixed, we request a review in Search Console. The request says what was found, what we fixed and how we checked it. Then we follow it to Google's decision.
Cleaned within 48 hours. Then Google's review.
We answer within four business hours, Monday to Friday, 8:00 to 18:00 Honduras time (UTC−6). Once we have access to the site, the hosting and Search Console, the cleanup is done and the review requested within 48 hours.
The review itself is Google's, and so is its timing. Google says phishing reviews take about a day, malware reviews a few days, and reviews of sites hacked with spam up to several weeks. If Google finds the site clean, it removes the warnings from browsers and search results within 72 hours.
One fixed price for the cleanup: US$750.
For one WordPress site on one domain: the cleanup, the cause closed, and the review request followed to Google's decision. If we find thousands of added spam pages or more than one site on the same account, we tell you before going further. Half is paid at the start.