# When Google flags your domain as unsafe

> A hacked website is usually discovered by its visitors: their browser shows a red warning page instead of your site, or a search result says "This site may…

Source: https://infranest.io/docs/domain-reputation
Last updated: 2026-11-02

---

This article explains how InfraNest warns you if Google suspects your domain is being used for phishing or malware, and what to do about it. It's for anyone who manages domains in InfraNest.

## Overview

- InfraNest regularly asks Google Web Risk whether each of your domains is suspected of **phishing**, **malware**, or **unwanted software**.
- This way, you hear about a problem from InfraNest before a visitor sees a browser warning or a search result says the site may be hacked.
- This check covers phishing and malware only — it does not check mail blocklists, so it can't tell you if your mail is being treated as spam.

> [!NOTE]
> This check only runs if your InfraNest administrator has connected Google Web Risk. Until then, you won't see anything about it on the domain page.

## How often domains are checked

1. A new domain is checked within minutes of being added to InfraNest.
2. After that, on paid plans each domain is checked again about once a week.
3. On the Free plan, each domain is checked about once a month instead. Nothing is locked on Free — checks simply run less often.

## See a domain that's been flagged

<!-- screenshot: domain-reputation -->

<!-- docs-screenshots:start:domain-reputation -->

![When Google flags your domain as unsafe](/media/c8fac1b7-7ecd-495d-8d10-23a826f00931)

<!-- docs-screenshots:end:domain-reputation -->

If Google suspects a domain, you'll see the same warning in three places:

1. On **Home**, under **Needs your attention**.
2. On the **Domains overview**, under **Needs your attention**.
3. On the domain's own page, as the first item under **Needs your attention**.

Each card tells you what Google suspects, since when, and what to do next. It includes a link to Google's own explanation, and a **Request a review in Search Console** link.

Your alert destinations — email, Slack, Teams, Telegram, PagerDuty — are notified right away, including destinations set to critical-only alerts.

## Clean up and request a review

A listing almost always means something was added to your site that shouldn't be there.

1. Look for pages, scripts, or redirects that nobody on your team added. Common causes are an out-of-date plugin or theme, a stolen password, or a DNS record that was changed to point somewhere else.
2. Remove whatever was added, and close off how it got in: update the software, and change any passwords that may have been exposed.
3. Sign in to **Google Search Console**, open **Security issues** for your site, and choose **Request review**. The card's **Request a review in Search Console** link takes you straight there.

While a domain is listed, InfraNest checks again with Google every hour. As soon as the listing is lifted, you're notified on the same alert destinations and the card disappears.

## Automate your response

You can set up automations that react the moment a domain is listed or cleared, using two triggers:

- **Domain listed by Google as unsafe**
- **Domain no longer listed by Google**

For example, you could open an incident in PagerDuty or post to a Slack channel as soon as a domain is listed, and automatically close it again once the listing is lifted. Set this up from **Automations**.

## Tips

> [!TIP]
> Don't wait for a listing to check your site's security — keeping software and passwords up to date is the best way to avoid being flagged in the first place.

## Troubleshooting

- **I don't see any Google Web Risk information on a domain.** This check only works once your InfraNest administrator has connected Google Web Risk. Ask them to set it up in **Settings**.
- **A domain I believe is safe is listed.** Google notes that its lists may contain mistakes — some safe sites are listed in error, and some risky sites may not be listed at all. If you believe this is wrong, request a review in Google Search Console as described above.
- **A domain was listed before I added it to InfraNest.** InfraNest can only judge a domain based on the answer Google gives after the domain was added — earlier history isn't reflected.