7

I have received a malicious content warning in search console (google webmaster tool). However, it has not listed any URL or detection date in the warning so I have no clue what's wrong with the site. It's a wordpress site hosted on a VPS.

enter image description here

Until then, browsers such as Google Chrome will display a warning when users visit or download certain files from your site.

The site is opening fine in the browsers (in chrome as well with no warnings). It's a informational website so there is not much to download for the users (except for some pdf documents which is also not triggering any warning in chrome). The site is also appearing fine in google search results.

I have no pointers on where to look for the problem. Can this be false positive? My host has been making some network changes during last 2-3 days. Can it be something they picked up during this time?

How should I go about it?

Update: 1. "Show details" link (from your screenshot above) showed the following popup with link to google documentation on malware

enter image description here

  1. I tried my website with safe browsing diagnostic tool and the results are - enter image description here
  2. Regarding hacking, my wordpress is updated to the latest version and I have tested all my file timestamps and there is no change in last 1 month.
Improve this question
7
  • WP is the most hacked software today and throughout history. Make sure that you were not hacked before freaking out. If you were hacked, then what to do becomes clearer.
    – closetnoc
    Commented Feb 5, 2016 at 14:23
  • One of my sites got the same warning at around the same time as you. Currently looking into possible causes, will let you know if we find anything!
    – Silvervox325
    Commented Feb 5, 2016 at 17:57
  • What does the "Show details" link (from your screenshot) contain?
    – Stephen Ostermiller ♦
    Commented Feb 5, 2016 at 18:35
  • I have updated the question with the screenshot of the "Show details" link.
    – Aakash
    Commented Feb 5, 2016 at 19:23
  • 2
    Are you serving adverts on your site? Which ad networks? This can be an intermittent cause of malware warnings.
    – MrWhite
    Commented Feb 5, 2016 at 22:09

4 Answers 4

Reset to default
2

After almost 4 weeks of that warning sitting on my webmaster console, I finally raised a "review request" stating -

The malicious content report doesn't contain any specific link affected by malicious content and I believe, after thorough checking of my website and my server, that my website is safe and secure for the users.

Next day, I received the review successful email from Google stating -

Google has received and processed your security review request. Google systems indicate that https://name-of-my-website.example no longer contains links to harmful sites or downloads. The warnings visible to users are being removed from your site. This may take a few hours to happen.

Looks like it was indeed a false alarm and I believe it is most likely triggered because of advertising links as suggested by w3dk.

Improve this answer
1

It's looking more and more like this is just a false alarm on Google's part. There was an article published about this today: http://searchengineland.com/hacked-content-rise-take-seo-precautions-protect-site-240855

Improve this answer
3
  • 1
    I don't see anything about it being a false alarm in the article you linked. Instead it says "this is one of the worst site hacks I have ever seen — definitely something you do not want to happen on your site!"
    – Stephen Ostermiller ♦
    Commented Feb 5, 2016 at 19:24
  • Thanks for the link. I have updated my output from google's safe browsing tool.
    – Aakash
    Commented Feb 5, 2016 at 19:27
  • @StephenOstermiller There were two examples in the article. The first just looked like a false alarm. The second is what you are referring to. As well, Google does take reports from other sources that may or may not be doing such a great job. It is a bit tricky since references to 3rd party resources enter into the mix. It may not even be the resource that is bad, but the domain that the resource resides on may have an issue that throws the whole domain into question. So an obscure issue on a domain that hosts a resource may trigger an event for your domain quicker than corn through a goose.
    – closetnoc
    Commented Feb 5, 2016 at 20:01
0

That warning can be triggered from linked images, PDF, a linked JavaScript and sometimes a linked CSS. That can be also be triggered from ads on your website from shady sources.

Also check your webpages for hidden iframes, Google does not like that pretty much and if Google warns you about it, the source of the iframe was reported before for malpractice

Improve this answer
2
  • What do you mean by "the source of the iframe was reported before for malpractice" - I understand why the warning can be triggered but how do I find out what thing has triggered this warning on my website? I don't have any malicious content on the website (unless it's hacked) and google is not reporting any affected URL.
    – Aakash
    Commented Feb 5, 2016 at 8:27
  • Example: domain blahblah.com was reported as a scam site via webmaster tools then the blocked it. Suddenly, one of your scripts or one of your plugins include an iframe going to blahblah.com, Google will find it and will tag your website. That Iframe may load a rotating links from different sites causing you to view the site without Google warning on Chrome
    – Vhortex
    Commented Feb 5, 2016 at 8:54
0

I suggest using the Wordfence plugin, https://wordpress.org/plugins/wordfence/

It will monitor your file system for changes to the original files.

Read more at https://www.wordfence.com/

I use the free version to monitor my Wordpress installs and it works great.

You should also change your FTP password.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.