Daniel Lasek · Last reviewed 2026-11-01
"Is my site blacklisted?" usually means one of two different things, and they have different fixes. The checker above answers both, separately.
- The website is flagged for malware or phishing. Browsers show a red full-page warning, and Google may add "This site may be hacked" under your search result. This comes from Google Safe Browsing data.
- The domain or its server is on an email spam list. Your mail bounces or lands in junk. This comes from DNS block lists (DNSBLs) that mail servers query for every message.
What the checker looks up
Browser warnings (malware, phishing). Google Web Risk is Google's commercial API for Safe Browsing data, the same data behind Chrome's warnings. URLhaus, run by abuse.ch, lists URLs that hand out malware. Both need an API key, and URLhaus's free tier is for not-for-profit use. When a key is not configured on our server, the row says Not checked and links to Google's Transparency Report, where you can check any site by hand for free.
Domain spam lists. Spamhaus DBL is the domain list most mail filters use. Spamhaus's free mirrors are for non-commercial use and refuse queries from shared DNS servers like ours. We query DBL only through Spamhaus's paid Data Query Service. Without that key the row says Not checked.
Server IP spam lists. We find the servers that receive mail for the domain (its MX records) and the server the website runs on, then look up each public IPv4 address on SpamCop, Barracuda BRBL and PSBL. All three are free to query. Spamhaus ZEN is added when the Data Query Service key is configured. We include the web server because a hacked WordPress site usually sends its spam from there, through a mailer script or a hijacked contact form.
Every row links to that list's own lookup and removal page.
How to read the result
- Listed: the list has an entry right now. The detail column says what kind (for example "Phishing domain" or "reported as spam by SpamCop users").
- Not listed: the list answered and had no entry.
- Not checked: we did not ask, usually because a key is missing. This is not a pass.
- Error: the list did not give a usable answer. Spamhaus answers
127.255.255.254when a query comes through a public resolver, and127.255.255.255when there are too many queries. Those codes mean "refused", not "listed", and the checker treats them that way. - Policy list (Spamhaus PBL only): the IP is in a range that should not send mail directly, such as a home connection. It is not a spam listing.
A clean result is not a malware audit. Lists only know what someone reported or crawled. Hidden spam pages, cloaked redirects and fresh hacks are often on no list at all.
What to do if your site is blacklisted
Clean first, ask for removal second. A removal request while the malware or spam script is still there gets refused, and some lists keep you listed longer.
- Find and remove the cause: the infected files, the phishing page, the mailer script or the abused form. The free hacked site scan shows public symptoms. How to clean a hacked WordPress site has the full order.
- Close the way in: update WordPress, plugins and themes, delete admin users you do not recognise, and change hosting, FTP and database passwords.
- Request removal from each list:
- Google (browser warning): in Google Search Console, open Security issues, confirm the fix and click Request review. The steps are in How to remove a Google hacked warning.
- URLhaus: make the listed URL return 404 or 410. URLhaus re-checks listed URLs and marks them offline itself.
- Spamhaus DBL / ZEN: look the domain or IP up at check.spamhaus.org and follow the removal link for the specific list.
- SpamCop: nothing to submit. The listing expires about 24 hours after reports stop.
- Barracuda BRBL: submit the free removal request form with the IP and a note on what you fixed.
- PSBL: anyone can remove an IP instantly on the PSBL removal page.
If your mail is sent by a provider such as Google Workspace or Microsoft 365 and their IP is listed, contact them. Only they can fix their servers.
If you would rather hand it over, our Emergency Cleanup is $499 for a typical site. It covers removing the infection, closing the hole, a written report, and walking you through the Google review. Bigger jobs get a written estimate first. Google and the list operators still decide when a listing drops.
Lists we do not query, and why
Some well-known sources forbid use on a commercial site, even in a free tool. The Google Safe Browsing API is non-commercial only (Google points businesses to Web Risk). The VirusTotal public API must not be used in commercial products. The OpenPhish community feed allows no commercial use. URIBL and SURBL need a paid feed for services like this one. PhishTank is not issuing new API keys. The result page links to each one's own free lookup page instead.
Questions
Is my site blacklisted if visitors see a red \"Dangerous site\" or \"Deceptive site ahead\" page?
Yes. That page comes from Google Safe Browsing data, which Chrome, Firefox and Safari all use. Clean the site, then request a review in Google Search Console under Security issues. The warning drops only after Google re-checks the site.
What is the difference between a Google blacklist and a spam blacklist?
A Google (Safe Browsing) listing is about the website: it makes browsers and search results warn visitors about malware or phishing. A spam blacklist (DNSBL) is about email: it makes other mail servers reject or junk mail from your domain or server IP. A site can be on one and not the other, so the checker shows them separately.
Why does the checker say \"not checked\" for some lists?
Some lists need a paid or registered key, and some forbid use on a commercial site. When a key is not configured, or a list refuses the query, the checker says so instead of showing a clean result. Each row links to that list's own free lookup page so you can check by hand.
Why is my web server IP listed when I never send email from it?
On a hacked WordPress site, a mailer script or a hijacked contact form often sends spam straight from the web server. On shared hosting, another site on the same IP may be the sender. Either way, email your site sends itself (contact forms, WooCommerce receipts, password resets) is affected. Find what is sending, stop it, then request removal.
Does \"not listed\" mean my site is clean?
No. It means those lists had no entry on the day of the check. Many hacks, such as hidden spam pages or redirects shown only to phones, are on no list at all. If visitors report something odd, run the free hacked site scan.
How long does blacklist removal take?
SpamCop drops a listing about 24 hours after reports stop. PSBL removal is instant on its form. Barracuda usually reviews within a day or two. Google reviews for malware typically take a few days after you request one in Search Console. None of them remove a listing while the problem is still there.