You open your own website and Chrome stops you with a red screen: “Deceptive site ahead”, or “Dangerous site”. Or your host writes to say the site has been suspended. Either way, the people who try to visit you are being turned away right now. This post is what we would tell you on the phone in that first hour, if your site runs on WordPress.
What the red screen means
The warning comes from Google Safe Browsing, a list of unsafe sites that Chrome checks before it opens a page. Google puts a site on that list when it finds pages that try to trick visitors, such as a fake login form, or code that tries to install malware. “Deceptive site ahead” is the warning for the first kind; “Dangerous site” usually means the second. Search results can carry a warning too.
On a WordPress site, the cause is nearly always the same: someone got in and added code, files or pages of their own. They rarely touch what you see on the home page. They hide pages in odd folders, add a line to a plugin, or create an administrator account with a harmless name. That is why the site can look normal to you and still be flagged.
A host’s suspension usually has the same root. Hosts scan their servers, and when they find malicious code on one account they switch it off to protect their other customers.
The first hour: three things
1. Read what Google found. Open Google Search Console and go to Security issues. The report names the type of issue, the date Google first detected it, and a sample of the affected addresses. Take a screenshot. Google advises against opening the flagged pages in your own browser, so don’t. If your site is not in Search Console yet, adding it is the first job, because the review request later is filed from there.
2. Tell your host, and take the site offline. Your host can see the server’s logs, may already know which files were changed, and needs to know that their other customers may be at risk. Ask them to stop serving the site, or to point it to a plain holding page on another server. A maintenance-mode plugin is not enough: the hacked WordPress install is still running behind it.
3. Change every password, and look for new administrators. In WordPress, open Users and filter by Administrator. Write down any account you do not recognise, with its email and the date it was created, but leave it in place for now: it is evidence of how they got in. Then change the passwords for every WordPress administrator, your hosting panel, FTP or SFTP, and the database. Do it from a computer you trust; an infected laptop is one of the ways sites get hacked in the first place.
What not to do
Don’t restore last month’s backup and call it done. First, the backup may already hold the attacker’s code: you need one from before the break-in, and you rarely know when that was. Second, a restore puts back the same out-of-date plugin or weak password they used, so the same code tends to return within days.
And don’t ask Google for a review straight away. Google’s own help is plain about this: a review requested while the problem remains only keeps the site flagged for longer.
The cleanup, the cause, and the review
Getting the warning removed takes three pieces of work, in this order.
The cleanup. Compare WordPress itself, the theme and every plugin with clean copies, and remove whatever was added: code, files, database entries and user accounts. Check every address in Google’s report, and the rest of the site with it. Google’s sample is not a complete list.
The cause. Find how they got in. On WordPress it is most often an out-of-date plugin or theme, or a password used somewhere else. Update or replace what was vulnerable, reinstall clean copies rather than upgrading over infected ones, and set new passwords and new security keys in wp-config.php so that every old login is signed out. There may be more than one way in, so keep looking after you find the first.
The review. When every issue in the report is fixed, select Request Review in Search Console’s Security issues report. Say what you found, what you fixed and how you checked it. Google says phishing reviews take about a day, malware reviews a few days, and reviews of sites hacked with spam up to several weeks. If the site is clean, Google removes the warnings from browsers and search results within 72 hours.
If you want us to do it
We do all three for one fixed price: the cleanup, the way in closed, and the review request followed to Google’s decision. The steps, the timing and the price are on our page for a WordPress site that shows a red warning. If you are reading this with the red screen still up, the three steps above are the right place to start, whoever does the rest.
Gráfica built this survey as a WordPress plugin, and builds plugins like it for clients. Tell us what your site needs
