How it works
Google continuously scans the web for malware, phishing and sites that spread unwanted software and keeps the hits on a list. Chrome, Firefox and Safari check the URLs you visit against it, usually via shortened hashes so the full address never goes to Google.
When a URL is on the list, the browser shows a full-page warning about a dangerous or deceptive site instead of the page, and Google Search can label the result too. The list matches host suffixes and path prefixes, so it can hit an entire host or just one subfolder.
Businesses can access the same data through the paid Web Risk API in Google Cloud. Site owners see a flag on their own site in the Security issues report in Google Search Console, which is also where they request a review after cleaning up.
Why it matters
A flag costs almost all visitors instantly, because hardly anyone clicks through a red warning page. Stores lose revenue, campaigns go nowhere and the brand takes a hit.
Nearly always, a hacked site is behind it: injected redirects, phishing pages in a subfolder or malware slipped in through an outdated plugin. Owners usually find out from customers, and it takes more time still until Google lifts the flag after a review.
How to prevent it
- Keep the CMS, themes, plugins and JavaScript libraries up to date, and remove anything unused.
- Add every client domain to Google Search Console so security alerts arrive by email.
- Protect admin logins with strong passwords and two-factor authentication, and limit write access on the server.
- After a flag, clean the site completely, including files, database and credentials, and only then request a review.
- Check upload directories and subfolders regularly for unfamiliar files, since phishing pages are often buried deep.
How DomainWarn detects it
The Google warning list check queries Google’s Web Risk API – the same list as Safe Browsing – daily for up to six URLs: the homepage, the website monitors with their redirect targets and a few URLs from the Website check. The site itself is not fetched, and query parameters never go to Google. Any classification as malware, phishing or social engineering, or unwanted software is critical and immediately opens the incident “Google warns about the website (malware/phishing)”, which closes once Google lifts the flag.
If the API does not respond, the run ends as “not checked” and never as a finding. As prevention, the CMS version, JavaScript libraries and Site integrity checks often report outdated software and injected content before Google steps in.
DomainWarn checks this for all your domains on a schedule and alerts you when something is missing or changes.