Glossary Term

Google Safe Browsing

glossary google safe browsing featured

Google Safe Browsing is a Google security service that maintains lists of unsafe web addresses and warns users before they visit them. It flags sites involved in phishing, malware and unwanted software. Browsers, apps and developers check URLs against these lists through the Google Safe Browsing API.

Why Google Safe Browsing Matters

Safe Browsing is the warning screen most people see before a dangerous page loads. Google states that it helps protect over five billion devices every day. Chrome, Firefox and Safari all use it to show the red “Dangerous site” interstitial.

For site owners and marketers, the stakes run the other way. If your domain lands on the list, every visitor using those browsers sees a full-page warning instead of your landing page. Paid clicks, email traffic and QR scans all stop at the warning. Google Search can also show a warning next to the result.

Google launched Safe Browsing in 2005 to fight phishing. Malware warnings followed in 2006, and unwanted software protection was added in 2014.

What Safe Browsing Flags

Safe Browsing sorts unsafe URLs into threat types. The API names them directly:

  • SOCIAL_ENGINEERING: phishing and deceptive pages that trick people into entering passwords, payment details or personal data.
  • MALWARE: pages that host or install software designed to harm a device or its user.
  • UNWANTED_SOFTWARE: downloads that look helpful but change browser settings or behave deceptively.
  • POTENTIALLY_HARMFUL_APPLICATION: apps flagged as risky, mainly on Android.

A site does not need to be built by attackers to be flagged. Hacked sites with injected code or malicious redirects are flagged too. An open redirect on a trusted domain is a common way phishing links end up associated with a legitimate site.

How Google Safe Browsing Works

Safe Browsing checks the URL before the page loads, without sending every address you visit to Google.

  1. Google crawls the web and collects reports, then adds confirmed unsafe URLs to its lists.
  2. The lists are stored as SHA-256 hashes of each URL, not as plain text.
  3. The browser hashes the URL you are about to visit and compares a short prefix against a local copy.
  4. On a prefix match, the browser asks Google for the full hashes sharing that prefix. The API sends only a 4-byte prefix.
  5. If a full hash matches, the browser shows the warning.

Chrome offers two levels. Standard protection uses these lists, and Google announced in March 2024 that it now checks them in real time. Enhanced protection adds deeper download scans and protection against newly created attacks, in exchange for sharing more security data with Google.

Google Safe Browsing API

The Google Safe Browsing API lets developers check URLs in their own apps. It is free, but Google restricts it to non-commercial use. Commercial products must use Web Risk, the paid Google Cloud version of the same data.

The v4 API has two models. The Lookup API sends full URLs to Google and returns matches. The Update API downloads hashed lists and checks locally, which is faster and more private. Google has deprecated v4, and new builds should use v5, where the hashes.search method replaces v4 full-hash lookups.

A v4 Lookup API request looks like this:

POST https://safebrowsing.googleapis.com/v4/threatMatches:find?key=API_KEY

{
  "client": {"clientId": "yourcompany", "clientVersion": "1.0.0"},
  "threatInfo": {
    "threatTypes": ["MALWARE", "SOCIAL_ENGINEERING", "UNWANTED_SOFTWARE"],
    "platformTypes": ["ANY_PLATFORM"],
    "threatEntryTypes": ["URL"],
    "threatEntries": [{"url": "http://example.com/login"}]
  }
}

An empty response means no match. A match returns the threat type and a cacheDuration, the time the URL should be treated as unsafe.

How to Run a URL Safety Check

For a one-off website safety check, use Google’s Site status tool in the Transparency Report:

  1. Go to https://transparencyreport.google.com/safe-browsing/search.
  2. Paste the full URL or domain.
  3. Read the result. It reports whether unsafe content was found on the site or the specific URL.

A clean result only means Google has not flagged the URL. New phishing pages often go live hours before any list catches them. For a link that asks for a login or payment, combine a URL safety check with manual checks: hover to read the real domain, expand short links, and look for misspellings. The link safety guide covers the full checklist.

How to Remove a Safe Browsing Warning

If your own site is flagged, Google Search Console shows the cause in the Security Issues report.

  1. Open the Security Issues report and read each listed issue.
  2. Fix the problem on every page. Google does not lift warnings for a partial fix.
  3. Select “Request Review” and describe what you found and what you changed.

Google states that a review “can take from a few days to a few weeks.” Sites that repeatedly switch between harmful and clean behavior get Repeat Offender status, which blocks new review requests for 30 days. Hacked sites are not treated as repeat offenders.

Frequently Asked Questions

What is Google Safe Browsing?

Google Safe Browsing is a free Google service that identifies unsafe websites and warns users before they open them. It covers phishing, malware and unwanted software. Chrome, Firefox and Safari use its lists, and developers can query them through the Safe Browsing API.

Is Google Safe Browsing free to use?

Yes, for personal and non-commercial use. The Safe Browsing API has no cost, but Google limits it to non-commercial projects. Businesses that check URLs inside a commercial product must use the paid Web Risk API on Google Cloud.

Should I turn on Enhanced Safe Browsing in Chrome?

Turn it on if you handle sensitive accounts or are a frequent phishing target. Enhanced protection checks sites and downloads more aggressively and catches some attacks the standard lists miss. The trade-off is that Chrome sends more browsing and download data to Google for security analysis.

How long does it take to get off the Safe Browsing list?

After you fix the issue and request a review in Search Console, Google says reviews take from a few days to a few weeks. Fixing every affected page before requesting a review avoids a rejected request. Repeat offenders must wait 30 days before requesting another review.

Can a site be flagged by mistake?

Yes, false positives happen, usually when a file host or shared domain carries someone else’s malicious content. Site owners can request a review through Search Console. Anyone can report an incorrect phishing warning through Google’s report form at https://www.google.com/safebrowsing/report_error/.

Before you click a shortened link, reveal where it goes with the free URL shortener preview, then run the destination through a URL safety check.

Back to Glossary