Is a website blacklisted or flagged as unsafe?

Delisting is not the fix. A domain gets flagged because something was found on it: injected scripts serving malware, a phishing page uploaded into a writable folder, or a redirect added to the theme. Requesting a review before that is removed produces a re-flag, and repeated reviews on the same domain get slower to clear.

The order that works is find the cause, remove it, close the way in, then request the review. Common ways in are a plugin or CMS core with a known CVE, and a credential that leaked from somewhere else, which is why this page's siblings are worth reading before the review is submitted.

In a CheckWeb report, under the Reputation axis, a clean domain shows "Not on major blocklists" with the lists actually queried named in the evidence, so a pass is verifiable rather than a black box. A listed domain shows a red FAIL naming the lists that carry it. Google Safe Browsing is reported as its own line, "Flagged" with the threat types, or "Not flagged" when the lookup ran and returned nothing.

A clean result reflects the lists checked at that moment, which is why this is worth re-checking rather than confirming once.

• Find out what was flagged first. Google Search Console reports the sample URLs behind a Safe Browsing flag under Security Issues, which is the fastest way to see what the crawler actually saw.
• Remove the malicious content itself: injected script tags in theme files and the database, uploaded PHP files in writable folders such as uploads, and any redirect added to the site's entry points.
• Close the way in, or the site is re-infected and re-flagged within days. Update the CMS core, plugins, and themes to versions with no known CVEs, and rotate the hosting, database, and administrator credentials. (See the WordPress security check for the version side of this.)
• Then request the review: for Safe Browsing, through Search Console once the domain is verified there; for a DNS blocklist, through the removal form of the specific list naming the domain, which the report's evidence identifies.
• Verify and keep watching: re-scan to confirm the checks pass, and remember reviews take from hours to several days to propagate.

How long does delisting take?

For Safe Browsing, a review is usually processed within a day or two once the site is clean, and browsers stop warning shortly after. DNS blocklists vary from automatic expiry after a listing period to a manual removal form. In both cases the clock starts when the cause is gone, not when the request is sent.

Why is a site flagged when nothing looks wrong?

Because injected code is written to hide from the owner. It commonly serves the malicious payload only to visitors arriving from search engines, or only on mobile, and shows a normal page to anyone logged in or visiting directly. What the crawler saw is recorded in Search Console, and that is the view to trust.

Does a shared IP or a neighbour's site cause a listing?

It can for DNS blocklists, where some listings apply to an address range rather than one domain, which is a common surprise on shared hosting. Safe Browsing flags the site or URL, so a neighbour's compromise does not carry over on its own.

Does CheckWeb remove a listing?

No. CheckWeb reports the status, names the lists it queried, and can email an alert if a watched domain becomes listed, but the removal request goes to the list operator, and cleaning a compromised site is separate work. Anything claiming to delist a domain without removing the cause is selling a re-flag.

• WordPress security checkThe most common way a site gets flagged in the first place: an outdated core or plugin with a known CVE.
• Vulnerable JavaScript librariesThe other entry point worth closing before a review is requested, and one the passive scan can see immediately.