A blocklist listing means a phishing or malware list has flagged your domain, which usually happens after a site is hacked. Confirm the listing, change your hosting, website and email passwords, and ask your host to help find and remove the harmful content. Once the site is clean, request removal from each list that flagged it, and check Google Search Console for security issues.
If your CyberVigil report says your domain is on a blocklist, take it seriously, but you don't need to panic. Listings like this are usually fixable in a day or two, and the steps are the same whether the cause is a hacked plugin or a stolen password.
Work through this guide in order. Cleaning up before you request removal matters, because a listing that comes back is harder to clear the second time.
- Free check
- No signup
- No changes to your website
What does a blocklist listing mean?
A blocklist is a shared list of web addresses known to host phishing pages or malware. Browsers, email filters and security tools check addresses against these lists to protect their users.
Our scan checks your website's address, your main domain and its www version against two lists:
| List | What it tracks | When we count you as listed |
|---|---|---|
| Phishing.Database | An open, MIT-licensed community list of active phishing domains | Your address appears on the active list. We refresh our copy at most every six hours |
| URLhaus by abuse.ch | Links that distribute malware | At least one listed link on your address is still marked online. We check it when the service is enabled |
Your report names the lists we checked and which ones flagged you.
Was my website hacked?
Most likely. Domains end up on these lists when something on them is attacking other people, such as a fake bank login page hidden in a subfolder or a malicious download added to an old plugin's folder. The owner usually doesn't know.
Look for the signs in our guide to telling whether your website has been hacked: admin users you didn't create, files with recent dates you can't explain, pages you've never seen, or redirects to other sites. If you find any, assume the account or software that let them in is still open.
How do I secure my accounts first?
Lock the doors before you clean up, or the attacker can come straight back.
- Change the passwords for your hosting control panel, website admin, domain registrar and business email. Use a different password for each.
- Turn on two-step sign-in (MFA) everywhere it's offered.
- In your website admin, remove any user accounts you don't recognize.
- If you use FTP or SFTP, change those passwords too, and delete accounts you don't use.
Re-check your site after cleanup
Run a free scan to confirm the listing and see your website, certificate and email settings in one report.
- Free check
- No signup
- No changes to your website
How do I clean up my website?
If you're not comfortable working with website files, ask for help at this step. Your hosting company is the best first call, and many hosts run a malware scan for free.
Instructions for Any host
- 1Contact your hosting company's support, tell them your domain is on a phishing or malware blocklist, and ask them to scan your account.
- 2Ask whether they have a clean backup from before the problem started. Restoring it is often the fastest fix.
- 3After a restore, update everything straight away, since the backup still has the old weakness.
How do I request removal from each list?
Only request removal once the harmful content is gone. Lists re-test addresses, and a request for a site that's still serving phishing pages won't succeed.
Phishing.Database
Its maintainers ask people to report false positives by opening a new issue on the project's GitHub page, using the predefined templates. Include your domain, what you found, and what you removed. The project is run by volunteers, so the GitHub issue page is the fastest channel.
URLhaus
Each listed link has a status. Once the malicious file is removed and the link no longer serves malware, URLhaus can mark it offline, and our scan only counts links that are still online. For questions, abuse.ch provides a contact form through its partner Spamhaus.
Google Search Console
If your site is in Google Search Console, open the Security issues report. Once you've fixed every issue it lists, select Request a review and describe what you cleaned up. Google says a review can take from a few days to a few weeks. If your site isn't verified in Search Console yet, add it, since that's where Google reports problems it finds.
How do I check that it worked?
- Re-run your CyberVigil scan. Our copy of Phishing.Database refreshes at most every six hours, so a removal can take a little while to show.
- Check the Security issues report in Search Console for an updated status.
- Send a test email to a personal account to make sure your messages aren't going to spam.
What should you do next?
- Keep a recent backup of your site somewhere other than your hosting account, so the next restore is quick.
- Turn on automatic updates where your platform allows it.
- Work through our small business cybersecurity checklist to cover passwords, devices and backups.
- Re-run the free website security scan once a month.
Common questions
Does a blocklist listing mean my site was hacked?
Usually, yes. These lists track domains that are hosting phishing pages or malware right now. Someone may have added a fake login page or a malicious file without your knowledge. A false listing is possible but less common, so check your site before assuming it's a mistake.
What happens if I ignore it?
Security tools, browsers and email filters that use these lists may warn visitors away from your site or send your emails to spam. The harmful content also keeps hurting whoever it targets, so it's worth acting the same day.
How long does removal take?
It depends on the list. URLhaus tracks whether each listed link is still serving malware, so it can show the link as offline once the file is gone. Phishing.Database is run by volunteers, and false-positive reports go through GitHub issues. Google says a security review can take from a few days to a few weeks.
Can CyberVigil remove my site from a list?
No. Only each list's maintainers can remove a listing. We check the Phishing.Database active list and, when it's enabled, URLhaus, and our report names the lists we checked for your domain.
Should I move to a new domain instead?
Usually not. A clean site with a removal request is faster and keeps your customers' bookmarks, links and email addresses working. A new domain on the same hacked site would get listed again.
Sources
- Phishing.Database (Phishing.Database project on GitHub)
- URLhaus (abuse.ch)
- URLhaus FAQ (abuse.ch)
- Security issues report (Google Search Console Help)
- Hardening WordPress (WordPress Developer Resources)
Related guides and tools
Keep building a safer business
Security is an ongoing process, but it doesn't have to be complicated. Run a free scan, fix what matters most, and check back for more guides.