When Google shows a Deceptive Site Ahead warning to a site visitor, it means they think your website might be harmful due to malware, phishing, or other security risks. This alarming message can scare away your visitors and make your site look untrustworthy.

Dealing with this problem is frustrating and time-consuming. You shouldn’t have to worry about Google flagging your site as unsafe, especially when you’ve worked hard to build up your online presence. Something needs to be done before this warning causes lasting damage to your site’s reputation.

Scan your website to be 100% certain your site has malware. 

The good news is that cleaning up your WordPress site and getting rid of the “Deceptive Site Ahead” warning is doable with the proper steps. In the next sections, we’ll guide you through identifying and fixing the source of the problem, making your site safe and welcoming again.

TL;DR: It is critical to remove malware from your site. The first step is to use MalCare to scan your website, clean it, and then submit a review request from Search Console.

What is the Deceptive Site Ahead warning?

The Deceptive Site Ahead warning is quite simply Google telling its visitors that the website they are about to visit is unsafe. It says so explicitly in the message: “Attackers on the site you’re trying to visit might trick you into installing software or revealing things like your password, phone, or credit card number. chrome strongly recommends going back to safety.” 

Unless you are scanning your site for malware every day, it is likely this notice has come as a rather rude shock.

It appears when visitors click on a hacked website from Google search results. It can appear as a big red screen (and is sometimes known as the red screen of death), or as a ‘Dangerous’ warning in the address bar. 

All browsers use Google’s blacklist to protect their users. This means that regardless of which browser your visitor is on, they will see a warning.

⚠️ It is imperative you fix this issue on priority. Start with a malware scan, and proceed from there. 

Step 1. Scan your website for malware

The first thing you need to do is scan your website for malware. A deep scan will check all the files, folders, and database for malware, find all instances of deceptive content, and finally flag any vulnerabilities. Malware can be hidden anywhere on your site. It is critical to get all of it out, otherwise Google will reject your review request. 

There are 3 ways to scan your website, and we will talk a little bit about each method.

1. Deep scan your website [RECOMMENDED]

To check every file, folder and entry in the database of your WordPress website, you need to install a security plugin and run a scan. Deep scans will ferret out every line of malware and every changed variable that is suspicious. 

With one click, MalCare will thoroughly check your website for malware. Just install the plugin on your WordPress site, and it takes care of the rest. When you log in to your security dashboard, you’ll see the current status of your website.

One great thing about MalCare is its advanced scanning. It doesn’t just look for known issues like some plugins. MalCare’s smart scanner checks your whole website to find any malware and vulnerabilities, even new ones—as yet undiscovered by security researchers.

If you want to keep your WordPress site secure and safe from malware, using a reliable plugin like MalCare is highly recommended. Its thorough scanning and easy-to-use features make it a top choice for protecting your online presence.

2. Use an online scanner

If you don’t want to use a security plugin, you can try an online scanner like Sucuri Sitecheck. These kinds of scanners check the public parts of your website’s code.

This can be a good first step in finding problems. A front-end scanner will spot malware in your posts and pages.

However, this type of scan has limits. It can’t check deeper parts of your WordPress site, like the wp-config file or wp-includes folder. Malware doesn’t always stay in the public areas, so a front-end scan is only a partial solution, at best.

3. Scanning manually

Let’s preface this by saying: trying to manually scan or clean your website yourself is not a good idea. There are lots of reasons why this is not recommended.

Human error is an obvious problem. But even more, manually scanning a big website is a huge task. It’s easy for malware to slip through the cracks and go unnoticed.

The best way to find malware is to use a security plugin like MalCare. MalCare can thoroughly scan your whole site and give you a clear assessment of any infections.

Armed with that information, you can then take the right steps to clean up the malware. Trying to do it yourself is just not worth the risk.

Other diagnostics to check for malware

Although the Deceptive Site Ahead warning is enough indication of a malware, you can use the following methods to test for malware infections yourself.

Step 2. Remove the malware that is causing the Deceptive Site Ahead warning

Alright, we are now in battle-mode. This is where things can get gnarly, depending on the route you take to remove malware from your website. There are 3 ways to get rid of malware from a website, and we are going to talk about them each, in order of most effective to least effective.

The most important thing is to clean your website fast. Every moment you leave the malware on your website, the losses are getting worse. In some cases, they are getting exponentially worse.

Option 1: Use a security plugin to remove malware from your website

We recommend you use MalCare to remove malware from your website. It is the best-in-class security plugin for your WordPress website because it will remove the hacks surgically from your website files and its database. At the end of a MalCare cleanup, you will have your website and data back completely intact.

To use MalCare, all you need to do is: 

1. Install MalCare on your website
2. Scan your website from the dashboard
3. Auto-clean when prompted to get rid of the malware

And that’s it. The cleanup takes a few minutes to complete, and your website is as good as new once again. If you used MalCare to scan your website, then all you need to do is upgrade to clean instantly. 

💡 MalCare’s malware removal tool can also remove backdoors, clear the cache, reset user passwords, and change WordPress security keys to prevent reinfection. 

Once MalCare is installed, it will scan your website daily for threats, and protect your website from bots and hackers. With MalCare you are gaining a powerful web application firewall as well, and a dashboard from which you can administrate your website easily. 

How to use MalCare if you don’t have access to your website?

When your website is hacked, it can often feel like every door is slamming shut in your face. Google has flagged your website with the deceptive site ahead, and you now may not have access to your website at all. This state of affairs can happen if the hacker has infected your website with a redirect hack, or a web host has suspended your account. Either way, you cannot access wp-admin to install a security plugin. 

All is not lost though. Get in touch with us or drop us an email at support [at] malcare [dot] com, and we will guide you through the next steps. We will walk you through the process of getting your website unsuspended too.

Option 2: Hire a WordPress security expert

If you choose not to install a security plugin, then please go the WordPress security expert route to clean malware and deceptive content from your website. While we cannot speak to the efficacy of other security experts, we expect them to be plugged into the WordPress website security domain and thus be able to provide a viable solution. 

Our experience has been that the really effective security experts are prohibitively expensive; justifiably so, as what they do is incredibly technical and difficult. We should know, because we have a team of them at MalCare. The only difference is that our experts’ services are available for free with our security plugin.

Option 3: Clean the website manually

We have cleaned thousands of websites for customers, and even then we don’t recommend manual cleaning. It is a fraught process with a tremendous amount of risk, with low chances of success—unless you are a bonafide WordPress security expert. (In which case, you wouldn’t need to read this article.)

If you are going to tackle the malware on your own steam, we will help you to the best of our ability. We cannot guarantee that you will be successful, because each hack can be very different, and there is no one-size fits all approach.

To begin this process, you need to know the following: 

• WordPress file structure and its working: Which files are important, how they work with each other, how themes and plugins are installed, how they work. 
• Programming: What do the scripts do? How do they interact with each other? What are they actually doing? Is the extra code you see custom code or malware? 
• Backend tools: Working familiarity with cPanel, SFTP, File Manager, phpMyAdmin, and all the other tools in your web host account.
  
  

If, at all, you are unfamiliar with any of the above, we suggest you stop right here and clean using MalCare. We have mentioned before that time is of the essence, and this is not the moment to gain proficiency in these tools in order to deal with a hack.

a. Get access to your website

If your web host has suspended your account, then this is the first step. Otherwise, skip to the next one. 

Contact web host support to get them to whitelist your IP for cleaning. They would have blocked your website after running scans, so ask for those results as well. The results will provide a starting point for cleaning up the malware. 

b. Take a backup of your website

This is a critical step in the cleanup: please take a backup of your website. Manual cleanups can go sideways very quickly, and a backup is the only thing that will save the day. Even a website with malware on it is better than no site whatsoever. 

If your web host detects malware on your website, they could also delete it without warning. Of course, this depends on the web host in question, but it is really better to err on the side of caution. 

To take a backup, use BlogVault. There is a 7-day free trial to get you started, and once set up, it will take regular automated backups of your website. Even if your web host takes down your website, you will still have your web site backups, because BlogVault backups are stored on external servers. Plus, a backup plugin is always a much better bet than relying on manual backups and restores. 

c. Download WordPress core, plugins and themes again from the repository

We don’t know where malware could be hiding, so luckily there are some things you can replace entirely without a problem. Make a note of the versions that were installed on your website, and download those. Older or newer versions may have different code, and may cause compatibility issues on your website later.

Once downloaded and unzipped, compare the files and folders of the fresh installs with those on your website. This is a tedious process to do manually, so you can use an online diffchecker to highlight the differences. It will still be tedious, but somewhat faster. 

A word of caution here: custom code from your website is not malware. It is sometimes necessary for web designers to alter official code to create the right experience for the website. The differences may be due to this reason. 

As an aside, this file-matching technique is what most security plugins, except MalCare, use to discover malware. It can prove to be ineffective, especially in the case of custom code. 

In any case, make notes of all the differences, and set the files aside. At this point, don’t delete anything. 

d. Check for fake plugins

Since you have a list of plugins and themes easily at hand now, you can check if any of them are fake plugins. You will not find fake plugins in the WordPress repository to download, and the plugin folder will typically contain very few files, sometimes just the one file. Fake plugins also don’t follow the typical naming conventions for WordPress plugins. 

If you are using nulled software at all, you can rest assured that this is probably the reason your website got hacked in the first place. Nulled plugins and themes are attractive for their low prices, but come at a high cost. Hackers infuse the code with malware or backdoors at the very least, and wait for people to install them, thus rolling out a welcome mat for their nefarious activities. 

e. Reinstall WordPress core

Now that you have the fresh installs, it is time to start replacing files and folders. The reason we suggest doing it this way is because fresh installs will take care of the malware loaded in the file directory of your website. 

However, this method is not without its risks too. An install or restore can fail just as well, so please backup your website in case you haven’t already done so. 

Log into the cPanel of your web hosting account, and use the File Manager tool to access your website files. Replace the following folders entirely: 

/wp-admin
/wp-includes

Fortunately, these 2 folders contain core WordPress files only, and rarely change even between versions. Your content and configurations are stored elsewhere, so they will remain unaffected. In fact, these folders should not differ from their clean installation counterparts. 

Next, look for odd code in these critical files: 

index.php
wp-config.php
wp-settings.php
wp-load.php
.htaccess

We realise that ‘odd code’ is not an easy directive to follow, but malware can take many forms. We suggest looking for scripts that aren’t present in the clean installations, and scrutinising those carefully. Just because they aren’t there in the clean installs doesn’t make them malware, but it is a good place as any to start. 

Please be extremely careful if you choose to poke around in these files. One small change can bring down your website altogether. Retrieving after that is a tough task. 

Next, the /wp-uploads shouldn’t have any PHP files (files like wp-tmp.php) at all. Delete any that you find in that folder.

Unfortunately, we cannot give more specific advice at this juncture. As we said before, malware can look like absolutely anything. We’ve seen hacked image files and icon files, all of which look entirely innocuous at first glance. 

If you think an entire file is malware, quarantine the file instead of deleting it. That means, you change the file extension to something that isn’t executable: like php to pho for example. 

If you suspect some code is malicious, then try deleting it to see what happens. In case your website breaks, you can replace the file with the same one from your backup.

f. Clean plugin and theme folders

Next up for cleaning is the /wp-content folder with all the plugin and theme files. Repeat the same process you just did with the core WordPress files, comparing the code carefully to find changes and additions. 

Again, we want to caution you against deleting anything different summarily. If you have changed settings and configurations, you should expect to see some changes in the code. However, if you are comfortable with wiping out customization entirely, then the fastest way to clean up the malware hiding in these files is to replace the plugins and themes files entirely. 

In our experience, admins are unwilling to lose any customization, and that’s a fair stance to take because of the work involved. 

While cleaning out malware, it is helpful to know how the code functions on the website. Malware scripts can be entirely harmless, until another file executes them. The second file will also look completely harmless as well. This lock-and-key mechanism of some malware also makes it difficult to spot. 

If your website has a lot of plugins and themes, active or otherwise, this step can take a team of searchers several days to go through. In the interest of time, check for malware in the following files of the active theme:

header.php
footer.php
functions.php 

In a previous section, we mentioned looking for vulnerabilities in your installed plugins. Start with those plugins, and work through the list. Don’t stop looking, even if you think you have found the malware halfway through your list. Malware can exist in all files simultaneously, so you have to check everything. 

g. Clean malware from database

Get a download of your website database, either from phpMyAdmin or from the backup you took. Check each of the tables for unexpected scripts. Start with posts and pages, as these are the most typically targeted and work from there. 

In the case of the redirect hack, the malware infects every single post and page. So if you find the malware script in one, you can use SQL queries to find the same script in the other posts and pages and clean it out. Our earlier caveat still applies though: don’t stop looking halfway through. 

You need to take special care if yours is an e-commerce website. Your database will contain critical user and order information, so please be 100% certain you are only deleting malware.

h. Remove all backdoors

Once you’ve gotten the infection out, it is time to close up the entry point. Those may be vulnerabilities in plugins and themes, which you need to address later by updating them. However, before that, you need to check for backdoors. 

Backdoors are the secret tunnels into your website, and if they remain that your website is sure to get infected again. Unfortunately, just like malware, a backdoor can be just about anywhere. 

Try looking for functions like these: 

eval
base64_decode
gzinflate
preg_replace
str_rot13 

This code doesn’t mean that they are backdoors, because there are legitimate uses for this code. But it could be, so it is worth checking out. Before deleting them though, analyse them thoroughly to ascertain what they do. 

i. Reupload your cleaned files

Once you’ve got a clean website, you have to restore it. First, you need to delete the existing files and database, and upload the cleaned counterparts instead. Log into cPanel and use the File Manager and phpMyAdmin to do this. Alternatively, you can use SFTP to manage the restoration process. 

j. Clear the cache

Empty WordPress cache, so that your visitors’ browsers load up the cleaned version of your website, not the old hacked version. 

k. Use a security scanner to confirm that the malware is definitely gone

This is basically a check to see everything has gone as planned, and that you have indeed cleaned out the malware successfully. Use the same scanner from the scanning section to confirm.

Step 3. Post-cleanup checklist

Malware removal plugins will get rid of malware and backdoors from your site. They cannot undo some of the damage that hackers do, like creating users or submitting fraudulent sitemaps. These are critical things that site owners have to do after a cleanup to restore their sites to normalcy. 

The worst part about malware is that it just keeps coming back. Whether through backdoors or exploiting the same vulnerabilities, it’s a constant battle.

That’s why we share this security checklist with our customers. It helps them prevent their WordPress sites from getting hacked again in the future.

Set up a security plugin

We can’t stress enough how important it is to install a good security plugin like MalCare. These plugins can scan, clean, and prevent hacks on your WordPress site. MalCare, in particular, is great at quickly diagnosing and cleaning up any malware issues. Plus, it protects your site from future attacks, thanks to its advanced firewall.

The best part about MalCare is that, unlike other security plugins, it won’t slow down your website. Your site will still run smoothly and efficiently, while being fully protected.

So if you want to keep your WordPress site safe, secure, and performing at its best, using a top-notch security plugin like MalCare is an absolute must.

Review sitemaps

This is somewhat specific to the class of malware that hijacks Google search results of a site, however it is well worth spending the extra time to do so. Much of the most prevalent malware, like Japanese keyword hacks, SEO spam, and pharma hack especially. Hackers add thousands of pages to your site to game Google, and use your SEO for their nefarious purposes. They also submit sitemaps with URLs of these pages, replacing your legitimate one altogether.

Since the Deceptive Site Ahead warning is a Google blacklist warning, malicious sitemaps are considered in your review request. So be sure to check this from your Search Console. 

Change passwords and review user accounts

One of the top reasons WordPress sites get reinfected is due to compromised or fraudulent user accounts. Thus, after dealing with a security issue, it’s crucial to change all your user and database passwords.

In addition to changing passwords, you’ll want to review your user accounts. Get rid of any accounts that shouldn’t be there. For the accounts that need to stay, make sure they only have the minimal privileges required.

In fact, we would go one step further and remove any account types that are not required. The barrier to entry for hacks is becoming lower and lower, as many vulnerabilities in the recent past have needed only user-level or subscriber-level access to hack sites. 

Install SSL on your site (if not already installed)

Having SSL on your website is essential. It uses encryption to protect all the communication to and from your site, ensuring it can’t be intercepted and read by anyone else.

For a while now, Google has been strongly advocating for websites to implement SSL. In fact, they will actively penalize site SEO if it doesn’t have SSL set up.

Keep everything updated 

Promptly updating your WordPress core, plugins, and themes as soon as new versions are released is critical. 

Updates often address critical security vulnerabilities in plugins and themes. As soon as a vulnerability is made public, hackers start frantically trying to exploit any websites that haven’t installed the necessary patch.

So the race is on: you need to make sure your WordPress site is updated before the bad actors can take advantage. Don’t give them that opportunity by letting your core, plugins, or themes fall behind on updates.

Sure, updates can be a hassle sometimes, and they can break sites as well. But the alternative—leaving your site exposed to known security risks—is simply not worth the risk. In order to stay on top of those updates and keep your site running well, you need to take backups and use staging.

As further insurance, MalCare’s firewall prevents many vulnerabilities from being exploited before updates can be applied. But nevertheless, we still recommend applying updates as soon as feasible. 

Track site activity

An activity log is essential for monitoring all changes on your site: including any unexpected activity like new user accounts that could signal unauthorized access. This early warning system helps you quickly identify and address suspicious behavior before it becomes a major problem. 

Choose good plugins and themes

When it comes to your WordPress site, you’ll want to be very selective about the plugins and themes you use. We highly recommend sticking to ones from reputable, well-known developers.

The reason for this is twofold. First, reputable developers will provide support if you ever need it. They also regularly update their products to patch any vulnerabilities. These updates are crucial for keeping your site secure.

Secondly, using nulled plugins or themes may seem like a way to save money upfront. But in the long run, it will end up costing you a lot more when your site inevitably gets hacked. Nulled products are not only unethical, but they’re also a major security risk, as they often come bundled with malware and backdoors.

Use SFTP instead of FTP

When it comes to accessing your WordPress site’s backend, SFTP is the way to go. It’s a secure version of FTP, keeping your information protected. Though some admins try to avoid FTP altogether, SFTP provides the necessary functionality with robust security to prevent potential breaches.

Remove unused WordPress installs

We’ve seen it happen time and time again: malware reappearing on freshly cleaned WordPress sites. The reason is often due to a second WordPress installation on the same cPanel account that has become infected. Once one site gets malware, it’s only a matter of time before it spreads to the other.

There are legitimate reasons you might have a second WordPress site, like a redesign, staging environment, or subdomain. However, if these secondary installs aren’t regularly updated and monitored, they can become vulnerable entry points for hackers. The malware can then migrate over to your main website.

The best way to prevent this vicious cycle is to simply remove any WordPress installs that you’re no longer actively using.

Choose a good host for your website

Choosing the right web host may seem like a small detail, but it can have a big impact. A reputable provider that takes security seriously will give you an extra layer of protection for your WordPress site.

Invest in reliable backups

While we normally advise against using backups to recover from hacks for many reasons, there are some occasions when it just cannot be helped. If your site has been targeted by ransomware, or the hacker has erased all traces of your content, there is no other alternative. A backup is your hail mary at this point. 

Address hacks transparently 

If your WordPress site gets hacked, consider publicly acknowledging the issue, your fix, and prevention plan. We’ve found that honesty can help rebuild trust and even improve brand value.

Step 4. Request a review from Google

At this point, the Deceptive Site Ahead warning will still be there, even though the malware has been removed. This is because Google hasn’t scanned your newly cleaned website yet. They eventually will, but there is no way to tell how long that will take, so you need to take steps to get the warning removed. 

⚠️ Before you submit a review request with Google, you need to be 100% certain that your website has no traces of malware present anywhere on it. If your website is still infected, Google will reject your request to fix the deceptive site ahead warning message from your WordPress site. Get rejected by Google too many times and Google will flag you as a ‘Repeat Offender’ and you won’t be able to request a review for 30 days.

Requesting a review is a simple process, and each of the requests is manually reviewed by their team.

• Log into Google Search Console
• Find the Security Issues tab, and scroll down to the bottom
• Click on the ‘Request a review’ button
• Fill in the form with all the relevant information of the steps taken to resolve the security issues
• Submit request
  

The review request takes a few days to be resolved, and unfortunately, throughout that time, the Chrome Deceptive Site Ahead warning will stay put. This can’t be helped nor speeded up. It is bad practice to send too many review requests to Google as well, and that strategy will backfire if they block you as a repeat offender. 

The key here is to be patient, and await the request results. 

What if your site is clean and the review request still fails? 

We have often had people email us with this issue, saying that their clean website is being flagged for deceptive content. This is usually caused by a few situations:

• If the admin used another plugin to clean their website, or tried to do it manually, some malware was left behind. So the clean up was a failure, and Google detected it as such. 
• If the clean up was a success, there may be small remnants like bad links that are causing the alerts.
• Check sitemaps on Search Console.

Google Safe Browsing rarely shows false positives, but if they do it is because their tools are scanning cached versions of the website. Clear the website cache, and scan once more to be absolutely sure the malware is definitely gone. Then you can request another review.

Step 5. Prevent the Deceptive Site Ahead warning from reappearing

Protect your website from malware, and your website should never have another case of the deceptive site ahead message. It may sound simple, but protecting your website amidst an ever-evolving threat landscape, without help, is no joke. 

Here are steps you can take to prevent reinfection, and protect your website, data and visitors from harm:

• Install a security plugin like MalCare, an all-in-one solution that scans, cleans and protects your website
• Implement strong password policies, like requiring regular changes
• Review user accounts regularly, and only grant minimum privileges required
• Choose good plugins and themes from reputed developers; definitely no nulled software
• Install SSL to encrypt communication back and from your website
• Update everything regularly, especially updates that patch security vulnerabilities
• Invest in backups for insurance
• Implement WordPress hardening measures that work in a few quick clicks.
  
  

Website security is an ongoing process, because malware keeps changing. A good security plugin is a non-negotiable part of a good security strategy and will stand you in good stead in the long run.

Why does Google flag dangerous sites?

Google Safe Browsing is a feature that Google provides their search users, so that they can have a safe browsing experience (as the name suggests). Therefore Google wants to keep their users away from deceptive content, spam content, malicious code, and dangerous sites. 

An example of dangerous browsing experience is when hackers can insert deceptive content into a website to trick visitors into sharing sensitive information, like passwords or credit card details. This is known as phishing, and is a type of social engineering attack. 

Google Safe Browsing also protects users from visiting sites with harmful downloads. A hacker can also use your website to infect many user devices, if they download that content.

Hackers and malware are a dangerous menace, and plenty of people and businesses have sustained losses because of their nefarious activities. Google, and many other responsible companies, want to protect users on the Internet, and Safe Browsing is a way to do that.

What causes the Google Chrome Deceptive Site Ahead to appear on a website? 

Malware-infected websites are used to spread viruses, keyloggers, and trojans to other devices. They can also be used to facilitate other hacks and malicious attacks. Ultimately, they are used to steal critical data, like login credentials and financial information. 

These are some of the typical infections we have seen that trigger the deceptive site ahead warning: 

• Phishing is a social engineering attack, which means the hacker has set up a seemingly official webpage to hoodwink a user into willingly giving up their information like their credit card numbers, phone number and email. This is the biggest reason a website is flagged as deceptive, even though Google Safe Browsing has a warning dedicated to flagging phishing websites. 
• Embedded social engineering content can promote malicious links and illicit business. They can also redirect your web users to a malicious website. Quite often, this embedded content is hidden from administrators, so only visitors see them. 
• WordPress XSS attacks can exploit vulnerabilities in your website, plugins and themes to insert malicious JavaScript into your frontend or backend code.  
• SQL injection attacks can be used to infiltrate, modify, and destroy a website’s database. It can also be used to send a copy of the entire database to the hacker.
• Incorrect installation of your SSL certificate can sometimes cause the warning to be shown, because your website now effectively has content showing up from 2 separate websites: the HTTPS one and the HTTP one. This is more commonly known as the mixed content warning, as Google treats HTTP and HTTPS websites as separate entities.
  
  

In addition to malware infections, Google will also flag your website if you have “insufficiently labeled third-party services”. What this means is that if you are operating a website on behalf of some other entity but you have not indicated that clearly on your website, your content can be considered deceptive. 

What is the impact of the Deceptive Site Ahead warning on your website?

In short, the impact of deceptive website warning is bad. Even if you don’t see the effects immediately, hacks worsen over time. Hackers are out to use your website for their financial gain, and thus can fill your website with deceptive content, links to spammy websites or even use your website to infect devices and other websites. 

Typically, the impact of a hack will manifest in the following ways. This list is not exhaustive, but indicative of the kind of damage that a malware can wreak: 

• SEO rankings will plummet
• Loss of brand trust and reputation 
• Loss of revenue for businesses
• Loss of work and effort put into building the website
• Clean up costs
• Legal issues because of compromised user data
  
  

Malware is bad for every stakeholder in your business, right from your business and visitors, to your web host and Google. The only person who benefits is the hacker; someone who has put in zero effort to get your website to where it is, and yet is able to unfairly profit off the backs of your effort. 

Conclusion

If you have reached this point of the article, thank you for reading! We have put together this resource in order to help you navigate this scary time, and hope you found the information helpful. 

If you have a single takeaway from this article, please let it be that a security plugin with an integrated firewall has to be on all your WordPress websites. Trust us, it will save you a great deal of grief and frustration. 

Have thoughts you would like to share? Drop us an email! We’d love to hear from you!

FAQs

Why is my website showing ‘Dangerous’ in the address bar?

Your WordPress website has been hacked, and therefore Google Safe Browsing has flagged your website as dangerous. In order to get rid of deceptive site ahead warning, you need to remove the malware, and request a review from Google. This article has the steps to help you do just that. 

How to fix the Google chrome deceptive site ahead?

There are 3 steps to fix the Google chrome deceptive site ahead: 

1. Scan your website for malware
2. Remove the malware using a security plugin
3. Request a review from Google
   
   

How does Google know that your website has been hacked? 

Google crawls your website regularly to index your website and its pages. As a part of that exercise, it scans your pages for malware. If malware or suspicious activity is found on your website, it gets listed on the blacklist. 

Google uses scanners and other tools to check for malware on your website. For instance, if your website contains links to spam websites or the site is deceptive, Google will recognize this is deceptive content and flag it accordingly. 

What to do when your website has been flagged with the google deceptive site ahead? 

Remove the malware as fast as possible. We know it is hard to hear that your website has been hacked, and often admins panic. But we assure you that your site is recoverable.