Google Safe Browsing

Google Safe Browsing is the list Chrome, Firefox, Safari and Edge all consult before rendering a page. A URL on it is not shown at all: the visitor gets a full-page red interstitial saying the site may harm their computer or is deceptive, with the "back to safety" button as the prominent option. Search results for the domain are annotated as well. Between those browsers this is close to everybody who was going to visit, so a listing is the largest single finding this audit can make about a domain that is otherwise resolving perfectly.

The lists are lists of **URLs**, not of domains, and that is the thing most often misread. A compromised CMS serving malware from one upload directory is listed at that directory; the home page is genuinely, truthfully clean, and a check of the home page alone will say so. This scan submits the apex and, where the zone publishes one, www — so a pass here means those URLs are not listed, and says nothing about the rest of the site. Google Search Console is the only place the full set of affected URLs for a domain is visible, and it requires a verified property.

A listing is almost never something the operator did. The usual causes are an outdated plugin or theme on a content management system, credentials reused from somewhere that was breached, a subdomain pointed at a service somebody else has since claimed, or an advertising network that served one bad creative. The domain is the thing named, and the compromise very often lives one layer down in an application.

The categories mean different things. MALWARE is software that infects the visitor; SOCIAL_ENGINEERING is phishing — a page impersonating somebody else to collect credentials or payment details, which is also what a hijacked subdomain hosting a fake sign-in page will be flagged as; UNWANTED_SOFTWARE is downloads that change browser or system settings without consent; POTENTIALLY_HARMFUL_APPLICATION is an Android application that misbehaves on the device.

A result here is a reading at the moment of the scan and not a standing verdict. Listings appear within minutes of Google's crawlers finding something, and lift within hours of a successful review, so a report from yesterday can be wrong in either direction today.

When this check reports as unmeasured rather than passing, that is our end rather than yours: the lookup ran and did not come back with an answer we could read. The API answers with an empty result for a clean URL, so a failed lookup and a clean one are indistinguishable unless the failure is reported separately — which is why it is, rather than being rolled into a pass. If the check is missing from a report entirely, no lookup was attempted at all, and that is a statement about how the site running this scan is configured, not about the domain.

Find what was flagged before doing anything else. Search Console's Security Issues report lists the affected URLs and a sample of what Google saw at each. Without a verified property you are guessing, and guessing means requesting a review of a site that still has the problem on it.

Remove the content and close the way in. Cleaning the files without patching what let them be written comes back, usually within days — and a second listing on the same domain is slower to clear than the first. Update the application and its plugins, rotate every credential that could have written to the document root (hosting panel, FTP/SFTP, database, CMS administrator accounts), and check for scheduled tasks and modified core files left behind.

Check your subdomains, not just the apex. A CNAME pointing at a service that was cancelled can be claimed by somebody else and used to host a phishing page under your name, and the listing attaches to your domain. Remove DNS records for anything you no longer run.

Then request a review in Search Console. It is the only channel that lifts a listing, reviews typically complete within a day or two for malware and can take longer for social engineering, and requesting one while the content is still live restarts the clock without clearing anything.

Afterwards, subscribe to Search Console email alerts for the property. They arrive when Google first flags something, which is the difference between finding out from Google and finding out from a customer.