Google Safe Browsing site status check
See whether Google lists a site or a link for malware, phishing or unwanted software, or flags some of a site’s pages: the lists behind the red warning pages in Chrome, Firefox and Safari.
By using these tools you accept the Terms and the Privacy page.
How the Google Safe Browsing check works
The Google Safe Browsing check asks Google whether a site or a single link is on the lists browsers use to block dangerous pages. Use it before you open a link you don’t trust, or to find out why visitors to your own site see a red warning page instead of your content.
What each list covers
All four lists are checked in a single request, and each list the address is on gets its own finding.
- Malware: pages that install or lead to harmful software, on any platform.
- Phishing (social engineering): deceptive pages that trick visitors into giving up passwords, card numbers or other data, or into installing something.
- Unwanted software: programs that deceive people or change their device or browser without clear consent.
- Phishing, extended coverage: a list that casts a wider net than the main phishing list.
How your input is checked
Paste an email address and its domain is checked. A link to a home page, with nothing after the slash, counts as a domain: its home address goes to Web Risk, and Google’s site status is read for the host and, for a subdomain such as www, for the parent site, because Google rates the parent. A link with a path or a query is checked as that exact link, plus its site’s status. The #fragment is removed first, because browsers never send it and it’s never part of a listing. Only http and https links up to 2,048 characters are accepted. Links with a username or password, and internal or reserved addresses, are refused.
The address lookup and the site-status reads start at the same time and share one 10-second limit, so a check never hangs; after 3 seconds the page counts the seconds while it waits.
The check looks up the address you give and doesn’t follow it. A short link may not be listed even when the page it leads to is, so run it through the redirect trace first and check where it ends.
Reading the result
There are six outcomes. Listed by Google (red) means the address is on the malware, phishing or unwanted-software list. Site unsafe (red) means Google’s site status rates the whole site unsafe. Some pages unsafe (amber) means the address itself isn’t listed, but Google’s site status says the site has flagged pages: browsers warn only on those, and Google doesn’t name them publicly. Extended list (amber) means the address is only on the extended-coverage phishing list, so treat it with care rather than as confirmed. Partly checked (blue) means the lists answered no, but a site status couldn’t be read, so flagged pages can’t be ruled out; it is never counted as clean. Not listed (green) means all four lists answered no and the site status flags nothing.
When the address is listed, a finding shows how long Google’s answer is valid, in UTC; checks after that time ask Google again. Details show the exact address that was looked up, the four lists, which of them matched, and Google’s site status with a link to Google’s own page. The line under the verdict says “Asked Google” for a new lookup and “Answer Google gave” when a kept answer was reused, with the time. Copy report gives a plain-text summary with the address checked, the lists it’s on, how long a listing holds and when Google was asked, ready to paste into a ticket.
After a cleanup, and what to check next
Kept answers are reused before Google is asked again, and “Check again” doesn’t skip them. So after Google removes your site from a list, this page can keep showing the listing until the kept answer expires, at most a day later. New lookups also stop at a daily limit; answers already kept are still shown, and a lookup Google didn’t answer doesn’t count toward it.
Google’s lists are one view among several. The VirusTotal check shows what about 90 security vendors say about the domain, and the blacklist check looks it up on DNS blocklists.
Updated · Maintained by Liviu Tanase
Questions
What does this check?
It asks Google two things. First, whether the address is on its Safe Browsing lists for malware, social engineering (phishing), unwanted software, and an extended-coverage phishing list; browsers that use Google Safe Browsing show a full-page warning for addresses on the main lists. Second, Google’s site status for the site, the same answer Google’s Transparency Report shows, which also counts single pages Google flagged. The check never opens the site or the link.
Domain or full link: what’s the difference?
A domain is checked as the site’s home address (http://example.com/) plus Google’s site status for the whole site, so a site where only some pages are flagged shows as “Some pages unsafe”. Google doesn’t say publicly which pages those are. To check a specific page (for example a link from an email), paste the full link.
How fresh is the result?
A clean list answer is reused for 30 minutes, and a listing is kept until the expiry time Google sends with it. Google’s site status is reused for an hour, and Google itself updates it about once a day. New dangerous pages can take hours to be listed, so a clean result isn’t a guarantee.
Why does Chrome warn about my site when this check says it isn’t listed?
Google can list a single page or folder, and browsers warn only there. A domain check looks up the home address, so such a listing shows only through Google’s site status, as “Some pages unsafe”. Paste the exact link that shows the warning to check that page. If the link redirects, the redirect checker shows every hop and checks each domain on the way. New listings can take hours to appear, and a clean answer is reused for 30 minutes.
What does “Partly checked” mean?
The address isn’t on Google’s lists, but Google’s site status, the only Google answer that also counts single flagged pages, couldn’t be read: it didn’t answer within the check’s 10 seconds, zerobounce.ai’s daily limit for reading it was reached, or Google sent an answer this check doesn’t know. It is never counted as clean. Open Google’s page from Details, or check again: a status that didn’t answer is asked again next time, and an error page from Google is kept for 2 minutes.
My site is listed. How do I get it removed?
Find and remove what Google flagged (the Security issues report in Google Search Console names it), fix how it got there, then choose Request Review in that report. Google says reviews take from a few days to a few weeks. See Google’s Security issues help.
Why Web Risk and not the Safe Browsing API?
Google’s free Safe Browsing API is for non-commercial use only; Google Cloud Web Risk is the version for businesses and uses the same lists. This site uses Web Risk for the address. Neither API answers for a whole site, so the site status comes from Google’s Transparency Report.
Who sees the address I check?
The domain or link is sent from our server to Google, and the site’s host name to Google’s Transparency Report. Your IP address isn’t sent and the API key stays on our server. Answers are kept for a short time. Cloudflare’s request logs record the request, as the privacy page explains.