How does Google exactly detect if a site may/is hacked? What exactly triggers the warnings?

I've seen plenty of companies offer services that help to remove these warnings on websites and get your site removed from this 'blacklist', but how does Google identify if a site may have been compromised or if it hosts malware in the first place?

I was thinking that Google may run some sort of scan on the website, but what would Google be scanning for?

  • I suspect google don't officially publish what they do. But I can assume it looks for types of known scripts and other code that is commonly inserted into infected sites. They probably look for other forms of defacement which may suggest a site has been compromised. Such as certain text and actions ( such as JavaScript attempting to call something). But this is all speculation but seems feasible.
    Commented Jul 11, 2017 at 18:17
  • Same question quora.com/How-can-Google-tell-if-a-site-may-be-hacked
    – Gudradain
    Commented Jul 11, 2017 at 20:01
  • I'd imagine a common source of these warnings are not the site itself, but the third-party ads served on the website. If one of these ads contains a malicious payload then it could trigger an automatic defense even if your backend has never been touched.
    – David
    Commented Jul 11, 2017 at 22:14

3 Answers 3


I was about to answer this question, as I was doing a bit of research I stumbled upon this excellent answer from Quora by Steve Gill, Co-Founder and ex-Chief Scientist of a Premier Cyber Intelligence Organization. Then realised this answers it better than I could.

I have worked with Google privately on some of their technology and was one of the few people they called for help when they themselves were hacked by China who stole their source code.

Google China hackers stole source code - researcher

Google have quite a few tools in their arsenal, and more have likely been added since.

To name a few:

  • They acquired and now fully host Virustotal, one of the biggest AV engine aggregators in the world that can simultaneously scan files
    with 40–50 antivirus engines looking for signs of malware.
  • They have a network of independent proxies that will load a webpage and run it inside of a custom sandbox. Any unexpected system level
    modifications detected inside that sandbox help automatically report
    unwanted malicious behavior.
  • They perform malware detection on the sites they crawl natively and run them through simple algorithmic checks looking for well known
    malicious third party scripts and embedded code.
  • They partner with third party data providers that feed them potential malicious seed data.

It is Google’s job to present data that is of highest quality for the browsing and searching experience. Helping prevent attacks against its users is keenly part of that tenant.

Quite a few tools also help the web administrator deal with such problems proactively such as reporting on malicious content by AS (BGP Autonomous System Level Reporting), or directly to the administrator through tools such as the Webmaster Tools.

  • 1
    Never knew they acquired VirusTotal, but then again, it is Google we are talking about... Commented Jul 23, 2017 at 18:44

In addition to the above answers, Google does run a service that allows users to report phishing pages, which is located here, known as "Report a Phishing Page". Any legitimate reports of phishing pages through this form will get those submitted pages (or websites entirely) blocked by the Safe Browsing system as a "Deceptive Site".


Exactly? Noone knows except Google of course. What we can estimate with relative certainty is this:

They have crawlers, a huge amount of them. Crawlers while scanning web pages, can also perform checks for possible malware.

They have Virus total at their disposal, biggest virus/malware/malicious content database currently, that is being updated very frequently.

As people mentioned in the comments above, ad content on the website. If it contains malicious content, it is marked as potentially dangerous.

And generally, in the process, they basically flag any website that has some form suspicion or has been altered by a 3rd party.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .