Chrome Deceptive site ahead warning

Chrome shows "Deceptive site ahead" when Google Safe Browsing thinks the site is misleading visitors, often with a fake page or an unwanted download. It is a full-screen warning before your site loads, not the smaller "This site may be hacked" line in search results. People can go back, and the warning stays until the cause is gone and Google reviews the site.

What you are seeing

A visitor types your address or follows a link, and Chrome shows a red page with that heading. The text says people might be tricked into installing software or revealing passwords. Your real homepage can still exist behind the warning. You might not see it yourself if you previously clicked through, if you use another browser, or if only one URL is flagged.

This is not the same message as This site may be hacked. That sentence sits in Google Search and usually tracks spam: pharmacy, gambling, or doorway pages in another language. Deceptive site ahead is stricter. Typical companions are a copied login page, a download you never offered, or a redirect to another domain. Sometimes the flagged URL is one PHP or HTML file in the uploads folder, while the brochure pages are fine.

Why it happens

Safe Browsing is labeling a URL that was usually added or altered after you last looked. A copied login, a fake payment form, a bad download, or a script that pushes people to another domain will do it.

The file is often outside the customizer. wp-content/uploads is a frequent place for a one-off PHP or HTML file, because the folder is writable and, on many hosts, executable. A changed .htaccess can send some visitors away before the template loads. An old password or an old plugin is enough. See how a WordPress site gets compromised. Deleting the page does not by itself clear Chrome. The review is in how to remove a Google hacked warning. Do not tell customers to click through.

How to check if you are affected

The read-only scanner below fetches public pages without logging in or changing the site. It will not clear Chrome. If only one deep URL is flagged, a homepage check can look calm.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

1. Look up the domain in Google's public Safe Browsing site status. Note any URLs it lists. That list is the short queue.
2. In a private window, open the homepage and any flagged path. Do not type passwords into a form while the warning is active.
3. Search site:yourdomain.com for login or download URLs you did not build. A second login page in a random folder is not wp-login.php.
4. View source on pages that should be simple. Look for forms posting to another domain, unexpected script sources, or an iframe you did not embed.
5. Over SFTP, sort wp-content/uploads by date. PHP, HTML, and unfamiliar archives do not belong beside the media library. See strange PHP files in uploads. Read the root .htaccess as well.
6. List administrator users and recently added plugins. A new admin plus this warning is one incident, not two hobbies.

If the host has already suspended the site, get the paths from Safe Browsing and from the host email before you delete broadly.

How to fix it yourself

1. Isolate the site, or remove public access to the flagged path, while Chrome is still warning people.
2. Back up files and the database. Label it as the pre-cleanup copy. Do not restore it as the fix. Change passwords before any older backup goes live.
3. Remove the fake login, unexpected form, redirect, or file Safe Browsing named. Look for a second copy.
4. Replace WordPress core from wordpress.org: wp-admin, wp-includes, and the root PHP files. Keep wp-config.php. Do not wipe wp-content in one move.
5. Remove unknown administrators after you check they are not a current developer or host login.
6. Replace themes and plugins from clean vendor copies. Remove plugins you do not remember installing.
7. Reset administrator, SFTP, hosting, and database passwords. Update DB_PASSWORD in wp-config.php. Replace salts from wordpress.org's salt endpoint. If a fake page collected passwords, tell those people to change them elsewhere too, including email.
8. Remove PHP from wp-content/uploads and disable PHP execution there. Apache reads .htaccess. Nginx needs the host.

Then request a review. Chrome keeps warning until Safe Browsing updates.

DIY is a bad idea with no backup, if the URL comes back, or if the host has suspended the account. Do not announce that the site is safe while the warning is still up.

When to get help

Get help if Safe Browsing names a URL you cannot find, if the warning returns after a reinstall, or if the site may have collected someone else's password on a fake form. Say what happened in plain language. Do not tell people to bypass the warning.

Emergency Cleanup is a flat $499. The 30-day reinfection guarantee means we clean the site again, or we refund the fee if we cannot clean it. Work is authorized only after you confirm you own the site. There is no timer. Email daniel@daniellasek.com or continue below.

Fix it now — $499 Talk to us by email

FAQ

Visitors see Deceptive site ahead, but I do not. What should I trust?

Trust the warning your visitors see. Some flags are tied to one URL, and a logged-in or cached view can skip it. Check Google Safe Browsing status for the domain and open the site logged out.

Does a Deceptive site ahead warning mean my computer is infected?

Not by itself. The warning is about the website. Keep your own computer updated if you are worried, and do the cleanup on the site files, accounts, and passwords.

How is Deceptive site ahead different from This site may be hacked?

The search line warns people in Google results and is often spam content. Deceptive site ahead stops the visit in Chrome and is often phishing, unwanted software, or a deceptive redirect. A site can have both.

Who removes the Chrome Deceptive site ahead warning?

Google does, after the cause is gone and they review the site. Deleting files does not clear the warning by itself. A review request does not stick if the same page is still being served.