Google Safe Browsing Checker

Google Safe Browsing Checker: Is a URL on Google's List of Dangerous Sites?

Paste a web address and the tool asks Google Safe Browsing about it, the same service that lets Chrome show a red "Dangerous site" or "Deceptive site ahead" warning. In a moment you see whether Google lists the address as dangerous and, if it does, for which kind of threat. It is a quick check before you open or share a suspicious link, and a first step if your own site was flagged.

What is Google Safe Browsing

Google Safe Browsing is a service that keeps lists of web addresses that are known to be dangerous: pages that spread malware, pages that imitate other sites to steal passwords and card numbers (phishing), and pages that push unwanted software. Google builds the lists by scanning billions of pages and from reports, and offers them to browsers and other programs. This tool uses the official Safe Browsing API: the answer is Google's own, not an opinion of this site.

Where Safe Browsing is used in practice

• Google Chrome checks the pages you open and the files you download against the lists and shows a full-page warning for a listed address.
• Firefox and Safari use Safe Browsing lists for their phishing and malware warnings as well. Microsoft Edge has its own service, Microsoft Defender SmartScreen, which is not the same list.
• Android uses the service to find potentially harmful apps.
• Webmasters get a notice in Google Search Console, in the "Security issues" report, when Google finds malware, phishing or hacked content on their site.
• Other services (link shorteners, messengers, mail and ad systems, link checkers) call the same API to refuse or flag dangerous links.

When a site is listed, its visitors in these browsers see a warning instead of the page, and search traffic and advertising usually fall at once. That is why site owners check the status after a hack or a malicious advertisement.

What Google flags

• Malware: the page or site tries to install malicious software, or has been hacked to do so.
• Phishing or deceptive site (social engineering): a page that pretends to be another site or service to steal data, or tricks people into harmful actions.
• Unwanted software: a page that offers software that behaves in a deceptive or harmful way, for example one that changes browser settings.
• Potentially harmful application: an address that leads to a mobile app that may harm a device.

How to read the result

• "Google Safe Browsing does not list this URL as dangerous" means the address is not on the lists at this moment. It does not prove that the site is safe: a new phishing page or a fresh hack can stay unlisted for hours or days, and Google lists only what it has found.
• "Google Safe Browsing lists this URL as dangerous" comes with the type of threat. Do not open the address in a browser you care about. If it is your own site, see the next section.
• An error message means Google did not give an answer (no connection, a refusal, a busy service). It is not a verdict; try again in a minute.

If your own site is flagged

1. Open Google Search Console, the "Security issues" report: it names the problem and gives example addresses.
2. Find the cause: hacked or injected pages, malicious scripts or links added to the theme, a plugin or the database, a harmful advertisement, files that visitors can upload.
3. Remove it, update the CMS and plugins, change the passwords of the site, the hosting and the database, and close the hole that let the attacker in.
4. Press "Request review" in the same report. Google checks the site again and removes the warning when it is clean; this can take from several hours to a few days.

Google may list one page or the whole site. A site on shared hosting can also be listed because of another site on the same server, so ask the host if you cannot find anything.

Safe Browsing, the Transparency Report and VirusTotal

• This tool gives Google's verdict for the address you enter and the type of threat, nothing more.
• The Google Transparency Report (the "Safe Browsing site status" page of Google) shows more for a whole site: whether pages were found unsafe, what kind of problems, and when Google last looked.
• VirusTotal asks dozens of security vendors at once, and Google Safe Browsing is only one of them. The two often differ: a smaller vendor may flag an address that Google does not list, and the other way round. A clean result in one is not a clean result in the other.

Limitations

• The tool checks the address against Google's lists. It does not open the page or scan its content, and it does not look at the files behind a link.
• One address at a time, and only what Google has already found. For an important decision, use more than one source.
• The number of checks per visitor may be limited to keep the service free for everyone.