Deceptive Site Ahead Warning: How to Remove It in 5 Steps

A customer messages you on WhatsApp: “I tried to open your website and Chrome blocked me with a red screen.” Or nobody messages you at all, and the quote requests that used to come through your contact form just stop. Both are “deceptive site” problems, and they’re different enough that you should deal with them separately. The first is technical: Google flags it with an automatic warning. The second is about perception: nobody flags it, and it quietly loses you customers. This guide covers both. You’ll get a step-by-step walkthrough for clearing the “Deceptive site ahead” warning in Search Console, and a practical look at how to make your site feel trustworthy to the people who land on it.

What counts as a deceptive site

“Deceptive site ahead” is the full-screen red warning Google Safe Browsing shows when it detects signs of phishing, malware or social engineering on a page. It blocks access in Chrome and in every browser that pulls from the same security database, Firefox and Safari included. Visitors get a big button to go back to safety and a small, half-hidden link to carry on at their own risk.

Many business owners get confused by this, so let’s clear it up straight away. The warning doesn’t necessarily mean you did anything wrong. Someone else may have compromised your site and injected phishing pages or malicious code without you knowing. Google flags the symptom. It has no way of telling the person who built the scam from the person whose site is hosting it.

There’s also a second meaning of “deceptive”, one that academic researchers have been studying for years and that has nothing to do with Safe Browsing. An interface is deceptive when it deliberately confuses people, makes it hard for them to express what they actually want, or nudges them into actions they never meant to take ¹. These are dark patterns: design choices that benefit whoever runs the site at the expense of whoever uses it ², exploiting cognitive biases to get people to buy or disclose more than they should ¹. A site can be completely clean as far as Google is concerned and still feel deceptive to a human being. More on that later.

Quick summary

• Who shows it: Chrome, Firefox, Safari and other browsers that use the Google Safe Browsing database.
• What the visitor sees: a full-screen red page that blocks access.
• What it doesn’t mean: that you’re to blame. Your site may simply have been hacked.

Why it appears: the 5 most common causes

The deceptive site warning kicks in when Safe Browsing finds something that puts visitors at risk. These five causes come up again and again with small businesses.

1. A hacked site with injected phishing pages. An attacker gets into your WordPress install and creates pages that mimic bank logins or payment portals, hosted on your domain. Google finds them and blocks the whole site.
2. Malware or compromised scripts from outdated plugins and themes. An old plugin with a known vulnerability becomes the way in for code that redirects visitors or installs malicious software.
3. Content or ads that imitate system elements. Banners or fake notifications that copy browser buttons or download prompts trick the user. That’s social engineering, and Safe Browsing penalises it.
4. A missing or expired SSL certificate and mixed content. A site without valid HTTPS, or one that loads HTTP resources inside HTTPS pages, triggers browser security warnings and needs fixing regardless.
5. Compromised third-party resources. An external script (a widget, a library, a third-party service) gets breached at the source and drags your site down with it.

The small-business version of this story is nearly always the same. An agency built the site five or six years ago and has since gone out of business. It runs on a WordPress install nobody has updated, with plugins frozen in 2019 and nobody reading the logs. As long as it works, nobody thinks about it. Then one Monday morning the site is red, and the owner discovers they don’t even have the login for their hosting account.

What the warning really costs a small business

While the red screen is up, your site is effectively closed to the public. People tend to stop at the warning and turn back, because the page is designed precisely to discourage them from clicking through. Someone who lands on a deceptive site from a search doesn’t push on. They go to the competitor listed below you.

The damage multiplies across every channel you’re paying for. Your Google Ads and Meta campaigns keep spending budget to send clicks to a locked door. Your newsletter sends contacts straight into the warning, and every one of them now associates your brand with something unsafe. Existing customers who were weighing up a purchase start to have doubts.

A word of honesty about the numbers. There’s no reliable, universal figure for “how much traffic you lose” while a warning is active, and anyone quoting you a precise percentage is making it up. What the research does show clearly is the reputational side. Deceptive practices on websites trigger negative emotions and damage both the brand experience and brand equity in the eyes of the people who run into them ³. A “deceptive site” warning is the most brutal version of that suspicion: the browser itself is calling you a scammer in front of your customer. Google’s review isn’t instant once you request it, so every hour you spend working out what to do is another hour your site stays blocked.

How to remove the “Deceptive site” warning in 5 steps

This process relies on Google’s official tools. The order matters. First find out what was flagged, then lock the site down, and only at the end ask for a review.

1. Check the site’s status. Open Google Search Console, go to Security & Manual Actions, then Security Issues, where Google lists the affected pages or threat types. Cross-check this against Google’s public Safe Browsing site status tool. You now know whether you’re dealing with phishing, malware or social engineering, and on which URLs.

2. Take a full backup before you touch anything. Save the database and files exactly as they are, even if they’re infected. You need a copy of the current state to see what changed and to avoid losing legitimate content while you clean up.

3. Find and remove the compromised files. Update your CMS, theme and every plugin to the latest version. Delete the pages Google flagged and any file in the site folder you don’t recognise. Change every password, including hosting, FTP and database. Check the list of admin users and delete any you don’t know, since attackers often create them to get back in.

4. Fix HTTPS. Make sure your SSL certificate is valid and in date, and that all HTTP traffic is permanently redirected to HTTPS. Get rid of mixed content, meaning images or scripts loaded over HTTP inside secure pages.

5. Request a review in Search Console. The same Security Issues section has a button to request a review. Describe exactly what you did: list the files you removed, what you updated and which passwords you changed. Google queues the review, and it takes time. If it fails, something infected is still there, so go back to step 3 and look harder at hidden files and scheduled jobs on the server.

If you don’t have access to Search Console. Your first job is proving to Google that you own the site. Add the property in Search Console and verify it, either by uploading the HTML file Google gives you to the site’s root directory or by adding the TXT record to your domain’s DNS. Until you’re verified, you can’t see the security issues or request a review.

Here’s a prompt that speeds up step 5 when you need a clear review request and your head is elsewhere:

“You’re a web security specialist. My WordPress site has been flagged as ‘Deceptive site’ by Google Safe Browsing. Here’s what I’ve done: [paste the list]. Write a review request for Google Search Console, 8 lines maximum, that sets out in technical, verifiable terms what I did to remove the threat and prevent it happening again.”

The problem no warning will flag

You can be squeaky clean as far as Google is concerned and still lose customers because, to a human visitor, your site looks a bit dodgy. No browser will throw up a red screen for that. The judgement happens in the visitor’s head, in a few seconds, and you never see it.

How people form that judgement has been studied properly. When people assess the quality and authority of a website, they make two distinct kinds of judgement: a predictive one before they go in, and an evaluative one once they’re inside. Several categories of factors shape those judgements at the same time ⁴. For a small business, that means customers decide whether to trust you based on how the site is built, who you are, what you say about yourself and how you come across, long before they actually read your content.

There’s more, and it concerns the relationship between brand trust and website credibility. In an experiment with 424 participants, trust in the brand influenced purchase intention, while website credibility on its own had more modest effects on the same variables ⁵. That makes your website matter even more. If your brand isn’t well known, which is the case for most small businesses, your site is the first and often the only signal of credibility a customer has to go on. It has to carry that weight by itself.

What about dark patterns, the tricks that force the sale? They annoy people and hurt the brand. People see them as sneaky and dishonest, settle into a resigned attitude towards them, and blame the companies that use them ⁶. It gets worse. Deceptive practices erode brand experience and brand equity ³, even when in the short term they do push people to sign up or buy more ¹. The fake countdown timer, the “only 2 spots left” that isn’t true, the pop-up with a hidden close button: they get you a sale today and burn your reputation tomorrow. For a small business that lives on word of mouth and repeat customers, that’s a terrible trade.

Trust signals to add to your site right now

The good news is that the things that make a site feel trustworthy are concrete, and they’re in your control. Here’s the checklist I use when auditing a small-business website, split into legal requirements and credibility signals.

Legal requirements double as powerful trust signals, which is why they belong somewhere visible.

• Visible VAT number and company details. Put them in the footer alongside your registered company name, address and company registration number (in Italy, the Partita IVA and REA number). A footer with this information tells visitors there’s a real, traceable business behind the site.
• GDPR-compliant privacy and cookie notices. A properly set-up cookie banner and a complete privacy page show you take people’s data seriously.
• Real, verifiable contact details. A physical address, a phone number, an email on your own domain (not a free webmail account). A real map of your premises.

Then there are perceived credibility signals, the ones that shift a visitor’s judgement without them even noticing.

• HTTPS on every page, with the padlock always there.
• Consistent, polished design. Readable fonts, sharp images, no cut-off text, no forgotten “Lorem ipsum” placeholders.
• Genuine social proof. Verifiable reviews, logos of real clients used with permission, real case studies with real numbers.
• Who’s behind it. An “About us” page with real faces, names and roles. People trust people.
• No dark patterns. Clear pricing, readable cancellation terms, easy unsubscribe, no invented scarcity.

Design quality has a real effect. The web has no built-in quality control, so judging the quality and authority of what you find there is hard for most users ⁴. A site built with care signals reliability before anyone reads a word. If your current site sends the wrong message, it’s often because it’s a patchwork of decisions made by different people over different years, with nobody steering. A team that handles design and structure as one coherent job fixes the “looks a bit amateur” problem at the root.

How to run a trust audit with AI

AI takes a lot of the grind out of combing through your site page by page for anything that undermines trust. The judgement calls are still yours. The right order is to decide what you’re looking for first, then use AI as a tireless reviewer. Here’s a prompt you can paste into Claude or ChatGPT, feeding it the text or screenshots of your main pages.

“Act as a conversion and trust consultant for small businesses. I’m giving you the content of my site’s home page, services page and contact page. Assess each page against these trust signals: VAT number and company details, verifiable contact information, privacy notice, genuine social proof, pricing clarity, absence of dark patterns (fake scarcity, countdown timers, difficult unsubscribe), design consistency. For every missing or weak signal, tell me where the problem is and how to fix it in practice. Reply in a table with the columns Problem, Severity (1 to 3), How to fix it.”

A useful second pass is to have the AI hunt specifically for dark patterns, which whoever writes the site often doesn’t recognise as such because “they work”. The problem is well documented and widespread. An automated analysis of around 53,000 product pages across roughly 11,000 e-commerce sites found 1,818 instances of dark patterns, spanning 15 types and 7 categories, with 183 sites engaged in outright deceptive practices ². Knowing the recurring types helps you ask the AI the right question.

“List the most common dark patterns in e-commerce and landing pages (artificial scarcity and urgency, trick questions, obstructed unsubscribing, hidden information, loaded language). Then analyse this copy from my pages [paste] and flag every phrase or element that falls into one of those patterns, explaining why a customer might find it sneaky and what honest version you’d replace it with.”

The whole point is to strip out anything on your site that chips away at trust and keep only what builds it. The AI does the legwork of finding the problems. Deciding what to fix stays with you.

Fonti

Footnotes

1. Shining a Light on Dark Patterns. academic.oup.com ↩ ↩² ↩³

2. Dark Patterns at Scale. doi.org ↩ ↩²

3. Dark patterns, dimmed brands: the erosion of equity through deceptive design in e-commerce. doi.org ↩ ↩²

4. Judgment of information quality and cognitive authority in the Web. repository.arizona.edu ↩ ↩²

5. Effects of Website Credibility and Brand Trust on Responses to Online Behavioral Advertising. doi.org ↩

6. Dark Design Patterns: An End-User Perspective. doi.org ↩