Deceptive content warning? Here's how to fix it, step by step

You click a link to your own website and, instead of your homepage, a bright red page appears: "Deceptive site ahead." Traffic drops overnight and Google Search Console flags your site. It is alarming, but it is fixable. Here is what to do.

What "deceptive content" actually means

The warning comes from Google Safe Browsing, the service Chrome and other browsers use to protect users from harmful or misleading sites. When Google's systems detect content designed to trick visitors into revealing personal information, installing malware or taking actions they did not intend, they flag the site and show the red warning to visitors.

This is not a manual penalty. It is an automated detection triggered by specific signals on your site, which means it can happen even if you never knowingly added anything harmful. Most visitors will not click past the warning, so every day it stays up costs you traffic and trust.

Why the warning appears

Your site does not have to be malicious to get flagged. The most common causes are:

• Malware injection: hidden scripts or iframes added to your site's code.
• Phishing content: fake login or payment pages set up to steal credentials.
• Compromised pages: harmful redirects added through outdated or abandoned plugins.
• Deceptive ads: third-party ad scripts serving misleading or malicious content.

How to fix it

Step 1. Confirm the warning in Google Search Console

Open Google Search Console and go to Security & Manual Actions, then Security Issues. The report shows exactly what Google detected, whether malware, phishing, harmful downloads or deceptive pages, and which URLs are affected. Take a screenshot before you change anything, so you have a record of the original problem and can check every item is resolved before asking for a review.

Step 2. Find the malware or injected code

Run a full malware scan. On WordPress, Wordfence and Sucuri SiteCheck are widely used; for any site, Google's Safe Browsing site status page gives a URL-level check. Then inspect the <head> and footer of your pages by hand for scripts you do not recognize, base64-encoded strings, or iframes pointing to unfamiliar domains.

Sort your files by last modified date in your hosting file manager. Anything changed around the time the warning appeared is a prime suspect.

Step 3. Remove the harmful content and close the hole

Delete or restore every infected file. On WordPress, reinstall core files from a clean source and update every plugin, theme and the CMS itself, since outdated software is the most common way in. Change the passwords for your database, CMS admin, hosting account and FTP, and revoke and reissue any API keys. On shared hosting, tell your host: other sites on the same server may be affected too.

Do not just restore a backup without finding out how the site was compromised. Restoring a vulnerable site means it can be hacked again the same way.

Step 4. Request a review from Google

Once the site is clean, go back to the Security Issues report and click Request Review. Explain clearly what you found, what you removed and what you changed to stop it happening again. Specific, factual requests are processed faster than vague ones. If the review is approved, the warning is removed; if not, the report shows what still needs fixing.

Step 5. Harden the site so it does not happen again

• Turn on two-factor authentication for every admin account.
• Put a web application firewall (WAF) in front of the site to block malicious requests.
• Schedule automatic malware scans and alerts for unexpected file changes.
• Add a Content Security Policy (CSP), which tells browsers which scripts may run on your pages and makes injected code far less effective.

Check your site's status in Google's Safe Browsing site status tool regularly. Catching a new flag within hours rather than days makes the difference between a short disruption and a serious loss of traffic.

The bottom line

A deceptive content warning is not a permanent mark against your site. Diagnose the exact issue in Search Console, remove every trace of the malicious code, fix the weakness that let it in, and send Google a clear, honest review request. Then treat security as a routine: regular updates, automated scanning, strong authentication and a firewall.

If your store is showing a Safe Browsing warning and you would like help finding the cause, get in touch.