Blacklist and Warning Removal

What the warnings mean

Google's Security Issues report groups problems into three kinds: hacked content added without permission, malware and unwanted software, and social engineering, which covers pages that trick visitors into sharing details or downloading something ^[1]. When Google finds one of these, affected pages can show a warning label in search results or a full warning page in the browser ^[1].

For a small business that usually means a sudden drop in enquiries, a customer ringing to say your site is "dangerous", or an advertising account being paused. The warning is a symptom. The cause is still on the site, or was until recently.

Our approach

1. Confirm the site is genuinely clean

Before anything goes to Google, the infection has to be gone everywhere, not just on the pages listed as samples. Google notes its list of sample URLs may be incomplete ^[1]. If the site has not been cleaned yet, this step is our malware removal service.

2. Work through every listed issue

We expand each issue in the report, follow its guidance, and check each sample address. Google is clear that fixing some pages will not earn a partial return to search results ^[1], so we keep going until every listed issue is resolved on every page.

3. Test the fixes the way Google sees them

Some infections only show themselves to search engines or to visitors arriving from a search result. We fetch key pages with different browser identities and referrers, the same approach Google's own guide suggests with tools such as cURL ^[2], to confirm nothing is hidden from a normal visit.

4. Send one clear request

The request describes the exact problem, the steps taken and the result ^[1]. Google says not to resubmit while a review is pending, and that requesting a review before the issue is fixed can lengthen review times or mark the site as a repeat offender ^[1], so we send one request and wait.

5. Watch the outcome

Once Google finds the site clean it removes the warnings; our guide to Google review requests sets out the timings it publishes. If the request is declined, the response usually points to what was missed, and we go back to step 1 for that part.

If a review is declined

A declined review is frustrating but useful, because it confirms something is still there. We read Google's response, check the Security Issues report again for new or remaining samples, and go back over the parts of the site most likely to hide a leftover: the uploads folder, scheduled tasks, rarely visited pages and any custom code. Only when the cause of the decline is found and fixed do we send another request.

How long it takes

The work on our side usually fits into the same visit as the cleanup. The wait is Google's. According to Google's guide, reviews for sites infected with malware require a few days to process, and reviews for sites hacked with spam can require up to several weeks ^[2]. The Search Console help page puts it more broadly: most reconsideration reviews can take several days or weeks ^[1].

We report the status as it changes and keep a note of the request date. If you run paid ads, ask your ad platform how it handles security reviews, because its process is separate.

Hosting company notices

Hosts sometimes suspend a site or disable a folder after an automated scan. Each host has its own process. Most ask for confirmation that the site was cleaned and how. Our written report is designed to answer that question in one document, which usually shortens the conversation.

What we need from you

Warning removal depends on access to the accounts where the warnings are reported, and some of those can only be set up by the site owner. Before work starts, we ask you to:

• confirm whether Google Search Console is already set up for the site, and if so, add us as a user rather than sharing your Google password;
• forward any notice from your host, your email provider or a security vendor, including the full text and any reference number;
• tell us about every domain and subdomain that points at the site, including old campaign domains that may still redirect there;
• let us know if the site has recently moved hosts or changed its address, since that can affect how warnings are reported.

If Search Console was never set up, we help you verify ownership through your domain or hosting account. The verification belongs to your business, and you can remove our access at any time once the work is done.

Please do not send passwords by email or through the contact form. We will suggest a safer way to share access, such as adding a separate user account for us that you can delete afterwards. Keeping access separate also makes it clear, in your own logs, which changes were made by us and when.

What you receive

• Confirmation that the Security Issues report is clear, or a note of what Google still lists.
• A copy of the review request text we sent.
• A short list of any other vendor or host notices checked and their status.
• Recommendations for monitoring, so a repeat problem is caught before Google catches it.

Read our guide to Search Console security issues and review requests if you would like to try the process yourself first.