Domain Flagged for Malware — What to Do First

Updated May 2026 · Threat Intelligence · 6 min read

When Google Web Risk or AlienVault OTX flags your domain, browsers begin showing red interstitial warnings to your visitors and your traffic collapses within hours. Treat this as a P0 incident.

What being “flagged” actually means

Google Web Risk powers the Safe Browsing warnings shown by Chrome, Firefox, and Safari. AlienVault OTX is a community threat-intelligence feed used by enterprise security tools and email providers. A flag from either means at least one trusted source has reported your domain as hosting malware, phishing, or unwanted software.

Flags aren’t arbitrary — something on your domain (or that was recently on it) triggered detection. The job is to find what, clean it up, and request review.

Investigate immediately

1. Open Google’s Transparency Report and search your domain. The detail page lists the threat type and last-seen URLs.
2. In Google Search Console, check Security & Manual Actions → Security issues. Each issue links to example URLs and indicators.
3. Audit your webroot for files modified recently. Look for obfuscated PHP/JS, unfamiliar files in /uploads/, .htaccess redirects you didn’t set.
4. Check user-generated-content endpoints (file uploads, comments) for stored XSS or hosted phishing pages.
5. Scan for compromised admin accounts — rotate all admin credentials and force re-login.

Clean up and request review

1. Remove or quarantine every malicious file identified. Restore from a clean backup if needed.
2. Patch the entry vector — outdated CMS, vulnerable plugin, exposed admin endpoint, weak password.
3. In Google Search Console → Security issues, click “Request review” and describe what you fixed. Reviews typically clear within 24–72 hours.
4. For OTX, contact OTX support with cleanup evidence; pulses age out automatically too.
5. Re-scan with GuardHound to confirm — the finding clears once both providers report safe.

Prevent recurrence

• Keep CMS core, themes, and plugins updated. Most flags trace to unpatched WordPress / Joomla / Magento.
• Use MFA on every admin account.
• Run a WAF (Cloudflare, Sucuri) in front of any public CMS.
• Subscribe to GuardHound monitoring so you hear about future flags within an hour, not from a customer support ticket.