“My WordPress site is blacklisted by Google!”
Does your WordPress site show a big red warning when someone visits your site?
Your site has been blacklisted by Google safe browsing. This usually happens because of the presence of malware. Domain blacklisted by google safe browsing is no picnic: your site traffic abruptly drops, potential customers are discouraged from visiting your site, and your reputation takes a hit.
The important thing to remember is that this is fixable. Do not panic, because we can walk you through this situation and help you fix the issue with our Google blacklist removal guide.
TL;DR: Remove site from Google Blacklist warning. The cause of the blacklist is the key to fixing your site, which is almost always malware. You can easily fix any malware infections with MalCare within minutes.
What is Google blacklist?
Google blacklist is another term for Google’s Safe Browsing initiative, wherein Google quarantines suspicious websites to make browsing safer for its users. Every day, around 10,000 websites are blacklisted and flagged. The Google blacklist warning shows up as a warning on your site’s search results or as a pop-up when you visit the site through Google. The warning message could be one of the following:
- The site ahead contains malware
- Deceptive site ahead
- Phishing attack ahead
- This site may harm your computer
- This site may be hacked
- This website has been reported as unsafe
- This page is trying to load scripts from unauthenticated sources
Apart from these warnings, Google blacklist can also show up as a ‘Dangerous’ label in the URL bar of your browser when visiting your site.
Finding out if your domain is blacklisted by Google Safe Browsing
While the big red warning on your site is an indication enough, there are additional ways to confirm if your website has been blacklisted by Google. The following are Google blacklist checks that can help you confirm if your site has been blacklisted by the search engine.
Notification from Google
When your site is blacklisted, Google sends you an email with the details of blacklisting. This will cover the notification that your site has been flagged, the reasons for the same and the details of the next steps that you can take.
Check the Google Transparency report
In case you haven’t received an email, you can check manually with Google Transparency Reports. All you have to do is visit Google Transparency Reports and put in your website URL. Google will instantly tell you if your website has been blacklisted or not.
Check Google Search Console
You can also check the Search Console’s ‘Security Issues’ tab to see if Google has listed any issues on your site. If you don’t have a Google Search Console account, this is a good time to create one. You will need the account to request a review of your site.
Why is your site blacklisted by Google Safe Browsing?
If your domain has been blacklisted by google safe browsing, chances are that your site is infected with malware. Usually, Google will send you an email informing you that your site has been blacklisted, and the reason. There are various reasons for Google blacklisting a website. Let us take a look at some of the common ones.
- Hacked site: If your site is hacked, Google doesn’t want their users to interact with your site and therefore, it blacklists any site with traces of malware on it.
- Spam pages: Hackers often infect your site and add spam pages to your site for illegal products and services so that they can piggyback on your site’s SEO.
- Blacklisted assets on site: If any of your plugins is loading assets such as images or videos from a blacklisted source, Google considers that deceptive content.
- Phishing attacks: Phishing attacks are social engineering attacks that trick visitors into giving up their personal or financial information. Some of the malware redirects your users to another web page which may be a phishing page, and Google will blacklist your website as a result.
- Blackhat SEO : Blackhat SEO techniques like cloaking, keyword stuffing or duplicate content are used to trick the algorithm and get rankings faster. However, this is against Google’s policies and googlebot can detect these methods. If a website uses these methods, Google will blacklist it.
How to fix WordPress website blocked by google safe browsing
Google blacklist has a widespread effect on your website. Firstly, your organic traffic will tank, and Google users will be strongly discouraged from visiting your site. In worst-case scenarios, Google will entirely delist your site. However, that’s not the extent of it. Several web hosts, browsers and other search engines also use Google’s blacklist for reference, and they might end up blacklisting you too.
1. Symptoms of malware infection on your site
If your site has been hacked, there will be some symptoms that may show up on your site apart from the Google blacklisting.
- A sudden drop in organic traffic
- Website performance going down
- Server resources being overused
- Web pages are defaced
- Visitors complaining about the website
- Unauthorized redirects
- Spam pages on the site
- Unintended popups
- Google search console warnings
This list is not exhaustive by any means and the symptoms can vary according to the infection. It is important to fix the Google blacklisting at the earliest, because the longer you wait, the more damage it will cause. But before you can do that, there are some prerequisites you need to know of.
Before you start
The first thing you need to do is understand why your site has been blacklisted. Google’s email will make it clear, but if you haven’t received an email, you can check Search Console for more details. If the issue is malware—which is most often the case—you need to fix this at the earliest. Hacks get worse with time and Google tracks the time taken to fix security issues. So you need to move fast.
Additionally, this is a critical situation, and you need to rely on expert services here. So it’s best if you do not try to clean up your site by yourself. A security plugin is the best way to go.
2. Scan your website for hacks
Before you can start cleaning up your site, you need to confirm the presence of malware on your site and its location. The best way to do that is to deep scan your website with a security plugin.
RECOMMENDED: Deep scan your website with MalCare
MalCare scans your site for free and tells you if it has been infected. MalCare’s advanced scanner can easily detect hidden malware so that you can clean up your site. In order to scan your site, follow these steps:
- Install MalCare on your WordPress site
- Wait for MalCare to complete the first sync
- MalCare will automatically scan your site for the first time
- Within minutes, you will know if your site is infected with malware.
You can also schedule daily scans with MalCare so that you are well informed about your site security. MalCare sends you real-time alerts if any suspicious activity is detected on your site.
Scan your site with an online scanner
Although using a security plugin is the best way to scan your site for malware, there are other ways to do the same. You can use an online scanner such as the Sucuri SiteCheck to scan your website. Online scanners can only scan the frontend of your site and the scan is nowhere near complete. But this can be used as the first line of diagnostics when looking for malware.
Scan your site manually
Another way to look for malware on your site is to scan your site manually. Manual scanning is absolutely not recommended because there is no direct way to detect malware unless you are a security expert and have a working understanding of the code. But if you still want to look for malware manually, it involves going through all your files and database and looking for junk code. WHile junk code is a very vague term, but there is no one way that malware presents itself and therefore, there are no examples that will help you look for it. We have included the overall process in the manual cleaning section in the later part of this article.
Other ways to check for malware on your website
While scanning your site is the only foolproof way to confirm a hack on your website, there are other ways that can help you detect if your site has malware. These should only be used as an indication of malware before you scan your site, but they are still useful for first level diagnostics.
- Visit your site from an incognito tab. Hackers often cloak sites from admin to make sure that the hack remains undetected for as long as possible. Visiting your site from an incognito tab will allow you to see your website as other visitors do. If you see any spam pages or pop-ups on your site, or if your site is redirecting to other web pages, it is a strong indicator of a hack.
- Look for Security Issues in Search Console. Google Search Console warnings in the Security issues tab are pretty much a confirmation of malware on your site. If you receive any warnings, you need to scan and clean your site immediately.
- Check the number of indexed pages on Google. When you conduct a site search on Google (for example, site:yoursite.com), the number of results show the number of pages on your site. If this number is a lot more than the actual number of pages on your site, it means that hackers have created spam pages on your site.
- Check Google Analytics. Unusual spikes on your website from a particular region could be an indication of malware. Alternatively, if your website traffic suddenly tanks or the bounce rate goes up abruptly, this could also be a result of a hack.
- Take a look at the activity log. Your website’s activity log is a place where each change on your site is recorded. If you see any new users being added or any escalations in user privileges, this could be a hack. Usually, WordPress sites don’t have an activity log and you will have to download a plugin for this. MalCare offers an activity log to its users along with its other security features.
3. Clean the malware that landed your website on Google Blacklist
Now that you have confirmed that your site has been hacked, the next step is to clean up your site. There are various ways to clean up your site but they’re not all equally effective.
Given that you need to clean up your site as fast as possible, and you presumably don’t want to spend a small fortune, a security plugin is the best option available. But we have listed three options here, so that you can pick the one you prefer.
Option 1: Clean your site with a security plugin [RECOMMENDED]
Using a security plugin like MalCare will ensure that every trace of malware on your site has been detected and that it does not return. If you used MalCare to scan your site already, the cleanup process is very easy. If you haven’t, all you need to do is install MalCare and let it sync with your website.
Here are the steps you need to follow to clean up your site with MalCare:
- Go to your MalCare dashboard and click on ‘Scan Now.’
- MalCare will show you if your site has been infected.
- Click on ‘Clean Malware.’
- That’s it. MalCare will clean up your site within minutes without any hassles.
There are several reasons to opt for MalCare apart from its fast and effective cleanups. MalCare also secures your website with a powerful firewall which prevents most malware attacks before they affect your site. You can schedule scans, check the activity log, and monitor suspicious activity with MalCare so that you always remain on top of your WordPress site security.
Option 2: Hire a security expert
Another option to clean up your site is to hire a security expert. Given that these services differ according to providers, we cannot guarantee their efficacy. However, this is still a better option than to try and clean up your WordPress site manually.
Security experts have a lot of experience with website security, and they too use tools to clean up your site. However, these services are usually priced at a premium and charged per cleanup. If the hack reoccurs, the cost can pile up quickly.
Alternatively, you can opt for MalCare’s concierge service, which helps users who need emergency cleanups and guidance to fix the Google blacklist issue.
Option 3: Cleanup your site manually
We have said this before, but it bears reiterating: we do not recommend this course of action. Manual cleanups are not only ineffective, they can be downright dangerous. Unless you know exactly what you are doing, you could end up breaking your site.
Having said that, we believe in transparency of information, and thus have included the manual cleanup instructions in this article.
Prerequisites for cleaning your website manually
Before you start cleaning up your site, there are a few things that you should know of, such as:
- The WordPress database and files structure
- Basics of coding, developer tools, and programming logic
- Familiarity with cPanel and other web host dashboard tools
Steps to cleaning your website manually:
- Get access to your site: The first thing to do is to make sure that you have access to your website. If your web host has suspended it, reach out to them and ask them to whitelist your IP for a cleanup.
- Get a list of malware from your web host or Google Search Console: If your web host has detected malware on your site, they will have a record of the infected files. Ask them to share details with you so that you can use this list as a reference. Alternatively, you can get a report from Google Search Console. This list is not exhaustive, so make sure you don’t entirely rely on it.
- Backup your website: This step is very important. Right now, even if your site is hacked, you still have a website. If anything goes wrong in the cleanup process, you will have to build your site again from scratch. Take a complete backup of your site before you start.
- Download clean installs from the WordPress repository: You need to note down all the themes and plugins on your site with their exact versions and download them from the WordPress repository. Do the same for the WordPress core. Make sure to be particular about the version numbers.
- Reinstall WordPress core: Once you have all the necessary files, you need to reinstall the WordPress core. You will need to use an FTP client such as FIle Manager for this. The wp-admin and wp-includes files don’t carry any user content. Which means that you can entirely replace these files with fresh installs.
Next, you need to look for malware and suspicious code in the following files:
We realize that suspicious code is a vague term, and it does not clarify what to look for. But malware can come in all shapes and sizes. So the best you can do is compare these files with the fresh installs and see if any differences exist. You can use a tool like diffchecker for this purpose. Bear in mind that customizations can also show up as extra code and if you delete those, your site may lose those customizations.
After this, see if there are any PHP files in the wp-uploads folder. If you see any, go ahead and delete them because the uploads folder is not supposed to have PHP files at all.
- Remove nulled plugins and themes: If you have any nulled themes or plugins, they most certainly contain malware. Delete these right away. Hackers often add backdoors and malware into nulled extensions to gain access to your site. Trust us, the cost of saving a few dollars is only an upfront saving. Malware costs far more in the long run.
- Clean up themes and plugin files: Now you need to clean up the themes and plugins files. This part is slightly more complex because themes and plugins are often customized, so there will most likely be extra code in your files compared to the clean installs. You can use the list of files you got from Search Console to guide you here.
- Clean up your website database: Your WordPress files have been cleaned, now you need to clean up the database. You will need to use phpMyAdmin to access the database tables. The database tables contain all of your data, so if you have a large site, this is going to be a long undertaking. Hacked redirect malware, for instance, infects every single post and page.
Make sure you don’t delete anything that you’re not sure is malware. Because even a little bit of fiddling with the database can end up in you losing a ton of content.
- Remove all the backdoors: The issue with malware is that it keeps coming back even after cleanups. The reason for this is that when your site is hacked, hackers install backdoors to your site, which they can use to regain access. In order to ensure that your site doesn’t get reinfected, you need to remove all the backdoors from your site too. Some of the common backdoor keywords are:
You can look for these functions in order to find backdoors, but keep in mind that these functions also have legitimate uses in some plugins and themes.
- Restore cleaned files: Now that you have cleaned up all the files, it is time to restore all of them. This process is exactly like a manual restore. You need to delete the existing files on your site and then upload the cleaned ones.
- Clear the cache: Caches store a copy of your website in order to load your site faster. But if your site is infected, the cached copies will have malware too. Therefore, it is necessary to clear all the caches during cleanup.
- Scan your site to confirm: You’re done. You’ve managed this massive undertaking all by yourself, pat yourself on the back! Now before we move ahead, you need to confirm that the malware is completely gone. Scan your site with MalCare to confirm. If your site comes back clean, you can now request Google to review your site. However, if there are still traces of malware on your site, you need to redo the whole process. We recommend using a plugin for cleanup at this point, because it would be much safer and faster.
4. Fix bad SEO practices
Black hat SEO practices may seem like an easy way to get traffic, but they rarely work. In the short term, you may get a ton of traffic, but Google catches on sooner or later. Not only will Google penalize your site, but it may delist your site entirely. Some of the black hat SEO practices re considered deceptive, and thus can lead to your site getting blacklisted.
If you are using any of these methods, you need to get rid of them right away before you can request a review from Google.
- Cloaking: If your visitors and Google do not see the same version of your site, Google will blacklist your site. Make sure that the version of your site is uniform for all visitors, including Googlebot.
- Keyword stuffing: It is common knowledge that Google uses keywords to rank results. However, if you overuse keywords to make Google think your web page is more relevant, it can identify the stuffing and penalize your site.
- Scraping: If you use bots to scrape data off other web pages and then publish it, your content will not be unique and you will be blacklisted.
- Plagiarism: Using duplicate content or plagiarized content is a big no-no. Google wants to encourage unique and valuable content and it does not favor websites that use plagiarized content in any form.
- Paid links: Link building is necessary for your site, but make sure that you aren’t using paid links.
How Google search engine blacklists your website
Google wants to offer a safe and efficient search experience to its users. This involves ensuring that the websites appearing in search results are relevant and free of malware and phishing attacks. For this, Google’s bots frequently crawl websites to index them.
During this periodic crawling of sites, Google scans your site for malware. If it is harmful to visitors in any way, Google flags your website as unsafe, thereby blacklisting your website. Google also blacklists sites if they are found to be violating Google’s policies such as using black hat SEO techniques or hosting content that Google does not allow.
How to remove site from Google blacklist warning
Now that you have fixed the malware issues on your site, you can request Google to review your site so that you can get off the blacklist. But before you do that, it is essential to be 100% sure that the issues are fixed. If there is even a single trace of malware or bad SEO practices on your site, Google will reject the review application, and you might be flagged as a repeat offender.
Here are Google blacklist removal steps:
- Log in to your Google Search Console account
- Scroll down to the ‘Security Issues’ tab on the left and click on It
- Select the ‘Request a review’ button
- Explain what you did to remove the policy violation from your site
- Hit Submit
Remember that Google reviews all the requests manually and it is best to be patient with the response. It might take anywhere between a few days to a couple weeks for Google to get back to you. Do not send another request meanwhile. This will only add up to your review requests and will not speed up the process anyway.
What if your site doesn’t have any malware and the review request is rejected?
Sometimes, even after you have cleaned up your site, Google may still reject your review request. While this is not a regular occurrence, it is quite common. There are a few reasons that cause this.
- Malware in cache: If you cleaned up your site but forgot to clear the cache on your site, Google may still flag it as malware. Cache stores a copy of your site that is used to load the elements on your site quickly. If your site has malware, the cached copies will have it too. Often people clean up their website but will forget to clean the cache and this leaves traces of malware on your site. Clear up the cache, and scan your site again before you send another review request.
- Old links on your site: Check all the old links on your website. If some of these are still directing your users to spam pages, Google will flag your site as harmful. Assess all the links, and make sure they are functional and intended. Once you audit the links, scan your site to confirm that your site is malware-free before requesting a review.
If you are unclear on the reason for your review getting rejected, you can check the malware files flagged by Google in the ‘Security issues’ tab and get rid of the malware directly. However, the best way to ensure that your website is spotless is to scan and clean it with MalCare.
How to avoid being blacklisted by Google in the future
Now that you’re aware of the consequences of Google blacklist, you need to ensure that you do not end up on the blacklist again. Not only will it be a huge time-sink, but you might also be flagged as a repeat offender, and be unable to request reviews.
Malware isn’t entirely avoidable, but there are ways in which you can secure your site and make sure that any security incidents are dealt with quickly before they cause any damage.
- Install a security plugin for the overall protection of your site.
- Scan your website regularly—preferably, daily.
- Update your WordPress site regularly, including the core, plugins, and themes.
- Frequently update your passwords and salts.
- Do not use nulled themes or plugins.
- Follow legitimate SEO practices only.
- Install SSL on your site.
Most importantly, do not use any so-called shortcuts to get a jump on your website traffic. These methods may seem quick and easy, but they cause a lot of damage in the long run.
Why does Google flag hacked websites?
Google wants to ensure that its users have a safe search experience. In a way, they are responsible for their users visiting any sites that they list. So they want to make sure that all the ranked sites are safe, and free of malware.
The Google Safe Browsing initiative is the way Google manages this. Google crawls websites regularly and in case it detects any suspicious activity or malware on any site, the site is flagged. Google flags several types of hacks like the Pharma hack, Japanese keyword hack, redirect hack, and more. So there is no way in which you can avoid Google blacklist unless you prioritize your site security.
What is the impact of the Google blacklist on your website?
If your website is blacklisted by Google, it does more than just show your visitors a big red warning. The consequences of Google blacklist are multi-fold and far-reaching. Once your site has been blacklisted you will notice the following effects:
- Organic traffic tanking
- Website getting suspended by web host
- Customers losing trust
- Legal issues
- Data leaks and theft
- Overall hit to the brand reputation
- Reduced site performance
These are only some of the most prominent effects of Google blacklist. Not to mention the added impacts of the hack itself. Given that these consequences can be extremely damaging, it is best for you to avoid the blacklist entirely, or fix it at the earliest if you find yourself flagged.
Domain blacklisted by Google safe browsing can affect your business’ reputation, revenue, and digital presence considerably. If your site is blacklisted, it is best to fix the issue at the earliest.
We hope that this guide helped you understand how the search engine blacklist works and how you can remove site from Google blacklist message. If you have any more queries regarding the blacklist, feel free to reach out to us.
How do I get off Google blacklist?
Before you can get off warning message, you need to figure out the cause of Google blacklisting. Usually, it is the presence of malware on your site or bad SEO practices. follow these Google blacklist removal steps:
- Scan your site with MalCare
- Clean up malware with auto-clean
- Clear cache
- Submit a review request to Google on GSC
How do I remove my URL from the blacklist?
You cannot directly remove your URL from the blacklist. You will have to address the issue that has made Google flag your site and then send Google a request to review your website again.
What my site is blacklisted by Google safe browsing?
Google blacklists unsafe websites to make browsing safer for its users. If a site is hacked, redirects to spam sites, or uses black hat SEO techniques, Google will blacklist it as a safety measure.
Preeti is a WordPress enthusiast, and enjoys sharing their experience with fellow enthusiasts. On the MalCare blog, Preeti distils the wisdom gained from building plugins to solve security issues that admins face.