How can you find out if a website is really infected by malware according to Google?

Why does Google provide this diagnostic tool?

Google Safe Browsing protects more than 4 billion devices daily against malicious sites. The diagnostic tool is the public version of this database. Each analyzed URL receives a verdict reflecting the security status according to Google's crawlers.

For an SEO practitioner, this page becomes the official arbiter in case of suspicion. It does not replace a full antivirus scan, but it precisely indicates what Google sees and how it ranks your site. If Google considers your site infected, your positions in the SERPs will be negatively affected immediately.

What does an “infected” site really mean for Google?

Google detects several types of threats: downloadable malware, phishing scripts, malicious redirects, code injections. An infected site does not necessarily mean that your CMS is compromised at the server level. Sometimes, a single infected programmatic ad can trigger the alert.

The diagnostic distinguishes between hosted attack pages (your site distributes the malware) and intermediary attack pages (your site redirects to a malicious site). This distinction matters: a 301 redirect to a compromised domain can be enough to contaminate your diagnostic, even if your infrastructure is healthy.

What is the difference with Search Console?

Search Console notifies verified owners in case of a detected security issue. But the Safe Browsing diagnostic tool is public, accessible without authentication, and analyzes any URL. It allows you to check a competitor, a partner site, or a suspicious backlink source.

The granularity also differs. Search Console aggregates alerts at the domain level, while Safe Browsing inspects URL by URL. You can have a partially contaminated domain: 3 infected pages out of 10,000 can trigger a global warning in Chrome, but the diagnostic will precisely show which ones.

• Public access without requiring domain ownership
• Near real-time verdict reflecting the current state of the Safe Browsing database
• Details of identified attack pages with the timestamp of the last detection
• Differentiation between malicious hosting and intermediary relay
• Limited history: shows recent detections, not the complete history

Does this statement really reflect the extent of the problem?

Google presents the tool as a diagnostic solution, but it's essential to understand its real limitations. Safe Browsing primarily analyzes known and listed threats. A zero-day malware or a hidden backdoor can go undetected for weeks. A site marked as “safe” does not guarantee a complete absence of infection.

I have seen cases where Safe Browsing displayed a site as clean, while a manual audit revealed dormant SQL injections or backdoors in wp-admin. [To verify]: the actual crawl frequency of Safe Browsing varies depending on the domain authority. A small site may be scanned only every 15-30 days.

Does the tool detect all types of SEO contaminations?

Safe Browsing targets end-user threats: phishing, downloadable malware, social engineering. However, it largely ignores classic SEO hacks: cloaking, hidden satellite pages, Japanese keyword spam. These contaminations aim to manipulate SERPs without necessarily infecting visitors.

In practice, a site can be “Safe” according to this tool while hosting 500 hidden pages of pharma spam in user-agent cloaking. Google will address this issue through the Webspam teams, not Safe Browsing. Do not confuse user security with SEO cleanliness: these are two distinct filters.

Should you regularly monitor this tool even without a Search Console alert?

Absolutely. Search Console notifies with a delay of 24 to 72 hours after detection. In the meantime, Chrome already displays the red warning to visitors, your bounce rate skyrockets, and your conversions collapse. Manually checking Safe Browsing once a week allows you to anticipate issues.

For e-commerce or high-traffic sites, automate monitoring through the Safe Browsing API. A daily script that checks your strategic URLs costs nothing in development and can save you tens of thousands of euros in lost revenue. Reaction time matters more than the tool itself.

How can you integrate this diagnostic into your SEO routine?

Create a monthly verification schedule for your critical assets: main domain, active subdomains, campaign microsites. Include your main backlinking partners: if a referring site is blacklisted, your link becomes toxic by association. Google can devalue your link profile if too many sources are compromised.

For high-volume sites, use the Safe Browsing Lookup API (v4), which allows for 10,000 free requests per day. Integrate it into your monitoring: a webhook triggers a Slack alert if a URL becomes “unsafe.” The setup cost is less than 2 hours of development.

What should you do if the tool signals an infection?

Don’t panic, but act quickly. First, identify the infection vector: outdated WordPress plugin, nulled theme, compromised FTP credentials, SQL injection. Safe Browsing lists the detected infected pages, start from there. Analyze the recently modified files on your server.

Once cleaned, never assume it's over. Change all passwords (FTP, SSH, database, CMS admin, hosting). Check cron jobs, ghost users in your CMS, modified .htaccess files. Then request a review via Search Console AND the Safe Browsing form. The double request speeds up the reprocessing.

What mistakes should you avoid when managing a detected infection?

The classic mistake: superficially cleaning and immediately requesting a review. Google rescans, finds more malicious code that you've missed, and your review timeline stretches. Worse, a second premature request can be seen as negligence.

Another pitfall: restoring a backup without identifying when the infection started. You risk restoring an already compromised version. Go back through your backups until you find a clean version, even if it means losing recent content. The site's health takes precedence over a few articles.

• Check Safe Browsing for the main domain and all active subdomains monthly
• Monitor the source sites of your strategic backlinks quarterly
• Automate via API if your site generates more than 10K visits per day
• In case of an alert: isolate infected pages, scan the entire server, don't rely solely on Google's diagnostic
• Change ALL access credentials after cleaning, not just the CMS admin
• Request a review only after full manual verification of removal