My site shows a security warning

Browsers, search engines, and security services can flag your site with a warning ("Deceptive site," "Site may harm your computer," "Not Secure"). What it means depends on which warning, and the fix varies.

"Not Secure" in the address bar

Most common, least scary. Means your site is loading over HTTP instead of HTTPS.

Fix:

• Make sure you've got an SSL certificate (we auto-issue Let's Encrypt for every domain).
• Force HTTPS on your site. See Forcing HTTPS.
• Resolve any "mixed content" — pages loading some resources over HTTP. See the same article.

This is a configuration issue, not a security incident.

"Deceptive site ahead" / "Site may harm your computer" (Google Safe Browsing)

More serious. Google's Safe Browsing service has flagged your site as malicious — typically because:

• Malware was detected on your site (injected scripts, malicious downloads).
• Phishing was detected — your site impersonates another (usually because it's been hacked).
• Unwanted software — your site offers downloads classified as malicious.

Fix:

1. Scan and clean your site immediately. See Scanning your website for malware.
2. Restore from a known-clean backup if the infection is recent.
3. Update everything — WordPress core, plugins, themes; or whatever CMS you're using.
4. Change all passwords.
5. Once cleaned, request review at Google Search Console → Security Issues → Request a review.

Google typically takes 24–72 hours to re-crawl and remove the warning after you submit the review request.

"This site is not secure" (extended)

Sometimes browsers show a longer warning page, especially for HTTPS sites with certificate problems:

• Certificate expired — the SSL cert needs renewal. We auto-renew Let's Encrypt; if it failed, see SSL certificates.
• Certificate doesn't match domain — the cert is for a different domain. Often happens if you've recently changed domains or added a domain not yet covered by SSL. Wait for AutoSSL to re-issue, or trigger it manually in cPanel.
• Self-signed certificate — your hosting is using a self-signed cert instead of one from a trusted CA. Shouldn't happen with our setup; if it does, open a ticket.

Yellow warning triangle / "Mixed content"

Page is HTTPS but contains some resources loaded over HTTP. Browsers show:

• A yellow padlock or warning triangle.
• Blocked content (images, scripts) silently filtered.
• Console warnings ("Mixed Content: The page at https://... loaded ... over HTTP").

Fix: audit your site for http:// URLs and update to https://. Common offenders:

• Hardcoded image URLs in posts.
• Theme files with absolute HTTP URLs.
• External scripts loaded from http://.
• Embedded YouTube / social media using outdated embed codes.

For WordPress, the Better Search Replace plugin can bulk-update http://yourdomain.com to https://yourdomain.com across the database.

Browser-specific warnings

Chrome

Most aggressive. Shows full red "Deceptive site" page for Safe Browsing flags.

Firefox

Similar to Chrome. Uses Google's Safe Browsing data plus its own.

Safari

Has its own Fraudulent Website Warning.

Edge

Uses Microsoft's SmartScreen filter.

If you're flagged in one but not others, it's likely the search-database hasn't synced yet. Fix in one (typically Google Safe Browsing) and the others usually clear within days.

"Email from this site to spam" (different problem)

Your emails are going to spam, but the site itself isn't flagged. Different issue, different fix. See Email deliverability.

Search Console warnings

Google Search Console alerts you to security issues with your site:

• Manual actions — Google staff have flagged something for review.
• Security issues — automated detection of malware/phishing/etc.
• Hacked content — Google identified compromised pages.

Each comes with specific guidance. Follow the linked instructions; submit for re-review when fixed.

"This site has been reported as suspicious" — phishing classification

If your site has been classified as a phishing destination (impersonating a bank, payment processor, etc.), Google and browsers will block it aggressively.

This usually means:

• Your site has been hacked and turned into a phishing landing page.
• Or you've copied content (logos, design) too closely to a known brand and triggered automated filters.

Fix:

1. Identify the phishing content on your site.
2. Remove it (often hidden in /wp-content/uploads/ directories with names like login-bank.php).
3. Run a comprehensive malware scan; clean any backdoors.
4. Submit a review request via Google Search Console.

If you're certain you didn't intentionally host phishing content, the site has been hacked — comprehensive cleanup is required before review will help.

When the fix isn't visible

Sometimes you fix the underlying issue but the warning persists:

• Browser caching — clear your browser cache and try again.
• Search engine caching — submit a re-review request; can take days.
• CDN caching — flush your Cloudflare cache.
• DNS caching — wait it out.

If you've fixed everything and the warning persists for more than a week:

• Verify the fix held (re-scan).
• Resubmit the re-review request.
• Open a ticket with our team — we can sometimes help expedite reviews for legitimate sites.

Power-user note

For ongoing security posture monitoring, services like Sucuri (paid) and SiteLock (paid) actively monitor your site from outside, alerting on suspicious changes. Combined with WordPress-side Wordfence or similar, you get layered detection.

Most sites don't need this level of monitoring — basic update hygiene + strong passwords + 2FA prevents the majority of compromises.