The fix, in one snippet
Report a correction at safebrowsing.google.com; do not open it meanwhile.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
When a Safe Browsing API key is configured on the Scan.now server, the checker queries the Lookup API with the URL and its canonical variants for the threat types SOCIAL_ENGINEERING, MALWARE, UNWANTED_SOFTWARE and POTENTIALLY_HARMFUL_APPLICATION, and reports which matched. Only the URL you submitted is sent, from our server, not from your browser. When no key is configured the check is reported as "not run", never as a pass. Limits: Safe Browsing lags new campaigns, often by hours, so an absent listing means nothing; your own browser performs its own hashed-prefix check against the same or a similar list and may warn even when this check could not run.
Why it matters
A listing means Google's crawlers, classifiers or user reports have confirmed that the page delivers phishing or malware. Chrome, Firefox and Safari all show a full-page warning for listed URLs, and Edge uses Microsoft Defender SmartScreen with its own list. A link still circulating while listed indicates an active campaign. Site owners are affected too: a compromised site that gets listed loses visitors and search ranking until it is cleaned and reviewed.
How to fix it
Do not visit the page. If you already entered credentials, change them from a trusted device and enable two-factor authentication. Make sure your browser's own protection is on: Chrome: Settings > Privacy and security > Security > Standard or Enhanced protection. Firefox: Settings > Privacy & Security > "Block dangerous and deceptive content". Safari: Settings > Security > "Warn when visiting a fraudulent website". Edge: Settings > Privacy, search, and services > Microsoft Defender SmartScreen. If the listed site is yours, find and remove the compromise (uploaded files, outdated plugins, injected redirects), then request a review under Security Issues in Google Search Console. Guides: how to spot phishing, what to do after a compromise and, for site owners, scanning a WordPress site.
Where this fits
Google Safe Browsing blocklist is check 1 of 13 that the phishing url checker runs under url and phishing indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
What fixing this still leaves open
Google Safe Browsing blocklist closes one route in. Immediately below it: Brand name used in a subdomain or path, where a well-known brand name appears in the subdomain or path of a URL whose registered domain is something else, for example paypal.com.secure-login.example; Credentials or @ embedded in the URL, where the URL contains a user:password@ section before the host, a legacy syntax that phishers use to make an address begin with a trusted name; Internationalised (punycode) domain, where the domain contains internationalised (non-ASCII) characters encoded as punycode (xn--), which can make a lookalike address display as a trusted brand.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Google Safe Browsing blocklist (critical severity)
Scanner check id: url-safe-browsingThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
8 min read · Updated Sep 13, 2026
How to Spot Phishing: URLs, Lookalike Domains, Urgency and the Checks That Work
Phishing succeeds by looking legitimate at a glance. This guide teaches the checks that hold up: Reading a URL from the right end,...
Read the guide
8 min read · Updated Sep 14, 2026
Your Data Was in a Breach: What to Do in the First Hour, Day and Week
Breach notifications are routine now, and the response is not obvious. This guide gives a prioritised checklist: Which passwords to...
Read the guide
9 min read · Updated Sep 15, 2026
Scanning a WordPress Site for Vulnerabilities: What Attackers Look For First
WordPress runs a large share of the web and is attacked accordingly. What an external scan reveals about a WordPress site, from version...
Read the guide