Check any site for malware, phishing and unwanted software using the Google Safe Browsing list. Instant result, no signup.
Getting flagged by Google Safe Browsing is the closest thing to instant business death on the modern web. It takes minutes to happen and weeks to recover from. This tool is the early-warning system.
## What Safe Browsing actually flags
Google Safe Browsing maintains constantly-updated lists of URLs that fall into four categories:
- **MALWARE**: pages hosting or distributing malware (drive-by downloads, exploit kits, malicious JS) - **SOCIAL_ENGINEERING**: phishing pages trying to steal credentials or trick users (fake login forms, fake payment pages) - **UNWANTED_SOFTWARE**: pages pushing software the user didn't consent to (toolbars, hijackers, deceptive installers) - **POTENTIALLY_HARMFUL_APPLICATION**: usually Android-app-specific, but URLs that distribute these get flagged
When Chrome, Safari, or Firefox sees a flagged URL, the browser interrupts navigation with a full-page red warning. The vast majority of users click "Back to safety." Conversion goes to zero. Organic traffic goes to zero. Email links break. Slack/Discord previews say "this link may be malicious." The site might as well be offline.
## How sites get flagged when they didn't do anything wrong
Most flagged sites aren't malicious — they're compromised. The compromise vectors, in order of 2025 frequency:
1. **Vulnerable WordPress plugin** — attacker injects JS that loads a malicious payload from a third-party CDN. The site's own code is clean; the injected `<script>` is what trips Safe Browsing. 2. **Compromised ad network** — a single bad creative in a long-tail ad chain serves malware once, gets reported, taints the publisher's domain. 3. **Compromised npm/composer dependency** — supply-chain attack injects exfiltration code into your build. 4. **Stolen admin credentials** — attacker logs in, uploads a backdoor PHP file, hosts a phishing kit at `yoursite.com/secure-login/`. 5. **Vulnerable form** — attacker hosts file uploads via your contact form, links to them from phishing campaigns. Safe Browsing flags your domain.
## Why this tool exists
Google Safe Browsing has a free real-time API. Almost no one uses it proactively because most people don't know it exists. This tool is a friendly wrapper: paste a URL, hit check, see the result instantly. Run it on your own sites weekly. Run it on competitor sites you cite. Run it on inbound links before you publish them.
## Recovery if you're already flagged
1. Identify and remove the malicious code (often a script tag injected into header/footer, or a base64-encoded payload in a PHP file). 2. Audit and rotate everything: admin passwords, API keys, SSH keys, database credentials. 3. Audit recent file modifications (`find . -mtime -7 -type f`). 4. Patch the original entry point (update WordPress, update the compromised plugin, close the file-upload hole). 5. Request review via Google Search Console > Security Issues. Reviews usually complete in 24-72 hours if the site is genuinely cleaned. 6. While you wait, put a WAF in front (Cloudflare WAF, Sucuri) to prevent re-infection.
## What this tool does NOT do
We check Google Safe Browsing only — we do not run deep file scanning, do not check Sucuri's blocklist, do not check Norton/McAfee blocklists. For a multi-source check, combine this with Sucuri SiteCheck and VirusTotal. We also do not scan for in-page malicious behaviour (we don't execute JS in a sandbox) — we only check whether the URL is already on the Safe Browsing blocklist.
A Google Safe Browsing flag is the fastest way to lose 100% of your organic traffic. Chrome, Safari, Firefox, and most enterprise filters all consume the same Safe Browsing feed — once you're flagged, every visitor sees a full-page red warning before the site even loads. Most sites get flagged from compromised plugins, injected scripts, or one bad ad on a long-tail page. Checking proactively catches it before Search Console emails you 48 hours after the damage is done.
We normalise the input to an HTTPS URL and submit it to the Google Safe Browsing v4 API (`threatMatches:find` endpoint) checking against four threat types (MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE, POTENTIALLY_HARMFUL_APPLICATION) on the ANY_PLATFORM target. Requests have an 8-second timeout. The API returns zero matches (=safe) or a list of threat objects (=flagged). We surface each threat with its type, the platform it applies to, and the matched URL. Independently, we run three local heuristic checks: HTTPS presence, `@`-in-hostname (a phishing red flag), and punycode (`xn--`) hostnames (a homograph-attack red flag). Heuristic flags are surfaced separately from Safe Browsing flags. If the Safe Browsing API key is not configured server-side, we still run heuristics and surface that the API key is missing — never silently skipping the check.
Enter the URL above. The scan checks the site against public blocklists and inspects the live page for injected scripts, suspicious redirects and known malware signatures, then explains what each finding means in plain terms.
Paste the address into the box above and run the check. It queries the Google Safe Browsing list — the same list Chrome, Safari and Firefox use — and returns malware, phishing and unwanted-software flags in a few seconds. No signup, no card, no limit on how often you check.
Three signals catch most hacks: a Safe Browsing flag (check it above), unexpected new files or recently modified PHP files on the server, and script tags loading from domains you do not recognise. If any of those are true, treat the site as compromised and rotate every credential.
Run the URL through the checker before visiting. A clean result means Google has not flagged the address for malware or phishing. Also look for HTTPS, a hostname with no stray "@" character, and no "xn--" punycode — all three are flagged here automatically.
Weekly is enough for a small brochure site. Scan daily if you run WordPress with third-party plugins, accept file uploads, or serve ads — those are the three most common infection routes. Continuous checks with alerting are what LemWatch monitoring adds on top.
We check Google Safe Browsing only — the most consequential blocklist (used by Chrome, Safari, Firefox). For multi-source malware checks, combine with Sucuri and VirusTotal. They're complementary, not redundant.
Most often the malicious code has been removed but Google hasn't re-crawled yet. Request a review in Search Console > Security Issues. Reviews usually complete in 24-72 hours.
Blocklist only — we ask Google "is this URL flagged?" and report the answer. We don't fetch your HTML or execute JS in a sandbox. For deep scanning, use Sucuri SiteCheck.
Usually a compromised page (a hacker uploaded a phishing kit somewhere on your domain — often /wp-content/uploads/ or /tmp/). Audit recent file changes across the site, not just the homepage.
Yes — Safe Browsing checks the URL string itself, not the page content. Authenticated pages can be checked just like public ones.
Enter the URL above. The scan checks the site against public blocklists and inspects the live page for injected scripts, suspicious redirects and known malware signatures, then explains what each finding means in plain terms.
Paste the address into the box above and run the check. It queries the Google Safe Browsing list — the same list Chrome, Safari and Firefox use — and returns malware, phishing and unwanted-software flags in a few seconds. No signup, no card, no limit on how often you check.
Three signals catch most hacks: a Safe Browsing flag (check it above), unexpected new files or recently modified PHP files on the server, and script tags loading from domains you do not recognise. If any of those are true, treat the site as compromised and rotate every credential.
Run the URL through the checker before visiting. A clean result means Google has not flagged the address for malware or phishing. Also look for HTTPS, a hostname with no stray "@" character, and no "xn--" punycode — all three are flagged here automatically.
Weekly is enough for a small brochure site. Scan daily if you run WordPress with third-party plugins, accept file uploads, or serve ads — those are the three most common infection routes. Continuous checks with alerting are what LemWatch monitoring adds on top.