Safe Browsing Check

Check if a domain or URL is listed on Google's Safe Browsing list as potentially dangerous for users.

Evidence ASSESSED

Checked against: Google Safe Browsing v4 threatMatches

RED TEAM 0 findings BLUE TEAM control did not hold

About Safe Browsing

Google Safe Browsing is a service provided by Google that provides lists of URLs for web resources that contain malware or phishing content.

Malware: Sites that contain malicious code that can be installed on your computer.
Phishing: Sites that trick users into revealing personal information like passwords or credit card numbers.
Unwanted Software: Sites that trick users into installing software that can be deceptive or perform unexpected actions.

Our Safe Browsing Check tests whether a URL or domain appears on threat intelligence lists used by browsers to warn users away from dangerous sites. A listing means visitors see a full-page interstitial warning instead of your content.

What is Safe Browsing?

Safe Browsing is the family of threat intelligence services that browsers consult before loading a page. Google Safe Browsing is the largest, and it powers the warnings shown in Chrome, Firefox, Safari and Android.

When a site is listed, the browser does not simply load it with a subtle indicator. It shows a full-page red interstitial that the user must explicitly click through, and most do not. Effectively, a listing removes your traffic.

Sites are listed for several reasons: hosting malware, serving phishing content, distributing unwanted software, or acting as an intermediary in an attack chain. Crucially, a compromised legitimate site is listed exactly like a deliberately malicious one — the classification is based on what the site is currently serving, not on the owner intent.

Threat intelligence consulted by browsers before loading a page
Powers warnings in Chrome, Firefox, Safari and Android
A listing produces a full-page warning, not a subtle indicator
Compromised legitimate sites are listed the same as malicious ones
Covers malware, phishing, unwanted software and attack intermediaries

Why Safe Browsing Status Matters

A Safe Browsing listing is the most abrupt traffic loss a website can experience. Billions of devices consult these lists, so the effect is immediate and near-total across every major browser at once.

The commercial consequences extend beyond the warning itself. Search results may show a warning label, advertising accounts can be suspended, email containing links to the site gets filtered, and partners who check reputation may suspend integrations. Recovery requires cleaning the site and requesting review, which takes time even once the underlying problem is fixed.

Traffic stops almost immediately across every major browser
Search results may display an additional warning label
Advertising accounts are frequently suspended on listing
Email containing links to the site is filtered more aggressively
Recovery requires both cleanup and a review request

How This Safe Browsing Check Works

The tool checks the supplied URL or domain against threat intelligence data.

Validates the URL input against format and SSRF safety checks
Queries threat intelligence sources for the domain and URL
Checks for malware, phishing and unwanted software classifications
Reports whether any listing was found and of what type
Provides the remediation path if a listing exists

How to Use the Safe Browsing Check

Enter a URL or domain in the input field
Run the check against threat intelligence data
Review whether any listing was found
If listed, identify the classification, which indicates what to look for
Clean the underlying issue before requesting a review

Understanding Your Safe Browsing Results

The classification tells you what was detected and therefore what to fix:

Field / Value	Meaning
`Clean`	No listing found. The site loads normally in browsers. Worth re-checking periodically, since a compromise can cause a listing at any time.
`Malware`	The site is serving or linking to malicious software. On a legitimate site this almost always means a compromise — injected scripts, a malicious plugin, or a backdoored file.
`Social engineering`	Phishing content designed to trick users into revealing credentials or personal data. On a legitimate site, usually an attacker-uploaded page in a directory nobody monitors.
`Unwanted software`	Downloads that mislead users about what they do, bundle additional software, or are hard to remove. Sometimes a listing results from an advertising network rather than the site itself.
`Compromised site`	A legitimate site currently serving malicious content. The most common category for established domains, and it is treated identically to deliberately malicious sites.
`Partial listing`	Specific URLs are listed rather than the whole domain. The rest of the site loads normally, which makes the problem easy to miss.

Common Problems & How to Fix Them

The site is serving malicious content, almost certainly through a compromise rather than anything intentional.

Work through it in order: take a full backup for evidence, identify and remove the injected code, update every component including the CMS core, themes and plugins, rotate all credentials including database and FTP, and check for backdoors and scheduled tasks left behind. Only then request a review through Google Search Console.

Requesting review before the site is genuinely clean results in another listing, and repeated relisting slows subsequent reviews.

Attackers routinely upload phishing kits into obscure directories of legitimate sites, where they go unnoticed for weeks.

Search the filesystem for recently modified files and directories you do not recognise. Check upload directories in particular, and ensure they cannot execute scripts. Fix the entry point — usually an outdated plugin or a weak credential — or the pages will reappear.

Third-party ad networks sometimes serve malicious creatives, and the hosting site is listed for content it never uploaded.

Identify which network served the offending creative from your ad platform reports, remove or suspend it, and consider tightening your Content-Security-Policy to constrain what embedded content can do. Document the change when requesting review.

Reviews fail when the malicious content is still present somewhere, or when the attacker retains access and restores it.

Re-scan thoroughly, including every subdomain and any parked domains sharing the hosting. Confirm no backdoor remains — a common pattern is a clean-looking site with a hidden re-infection mechanism in a cron job or a database trigger.

Browsers cache Safe Browsing data locally, so warnings can persist for a period after delisting.

Allow time for the update to propagate. Verify the current status through Search Console rather than by testing in your own browser, which may be showing a cached verdict.

Best Practices

Monitor Safe Browsing status continuously rather than discovering a listing from lost traffic
Register the site in Google Search Console, which notifies you directly on listing
Keep the CMS, themes and plugins updated, since outdated components are the usual entry point
Restrict upload directories so they cannot execute scripts
Clean thoroughly before requesting review, since failed reviews slow later ones
Rotate every credential after a compromise, not just the one you believe was used
Deploy a Content-Security-Policy to limit what injected or third-party content can do

Security Recommendations

Treat a listing as evidence of compromise until proven otherwise, since legitimate sites are listed for what they are currently serving
Find and close the entry point rather than only removing the visible malicious content, or it will return
Check every subdomain and parked domain on the same hosting, as attackers move laterally between them
Look for persistence mechanisms — backdoors, scheduled tasks, database triggers — not just modified files
Rotate all credentials including database, FTP, SSH and administrative accounts after any compromise
Preserve a copy of the compromised state for investigation before cleaning, since you will want to know how they got in

Frequently Asked Questions

A threat intelligence service that browsers consult before loading pages. It powers the full-page warnings shown in Chrome, Firefox, Safari and Android for sites serving malware, phishing or unwanted software.

Almost always because it has been compromised and is serving malicious content without your knowledge. Safe Browsing classifies on what a site is currently serving, not on the owner intent, so a hacked site is treated identically to a malicious one.

Clean the site completely, close the entry point, then request a review through Google Search Console. Reviews typically take from a few hours to a few days. Requesting review before the site is genuinely clean causes another listing.

Close to all of it. Visitors see a full-page red interstitial they must explicitly click through, and the overwhelming majority do not. Advertising accounts are also frequently suspended while a listing is active.

Yes. Specific URLs can be listed while the rest of the site loads normally. This is easy to miss, since your own testing of the homepage shows no problem at all.

Browsers cache the data locally, so warnings can persist for a period after the listing is removed. Verify the actual status through Search Console rather than by testing in a browser that may hold a cached verdict.

Keep software updated, restrict upload directories from executing scripts, use strong credentials with multi-factor authentication, deploy a Content-Security-Policy, and monitor for unexpected file changes. Most listings follow a compromise that exploited an unpatched component.