Google says "Deceptive site ahead". Here's what that means.

What you're seeing

Instead of your website, visitors get a full red screen with "Deceptive site ahead" across it, a "Back to safety" button, and a small "Details" link most people never click. Some people see "This site may be hacked" or "The site ahead contains malware" instead — same system, slightly different wording depending on what Google found.

It shows up in Chrome, Firefox, Safari and Android, because they all use the same Google Safe Browsing list. That is why it feels like the whole internet turned on you at once. Two things usually make it more confusing:

• The site often loads perfectly for you, because you have visited it a hundred times and your browser has cached its way past the warning — or because the malware deliberately hides from logged-in users.
• Traffic does not taper off, it stops. Analytics goes flat within hours, and if you sell online, so do the orders.

If you have Google Search Console set up for the domain, there will be a message in there under Security & Manual Actions → Security Issues, and that message is the single most useful thing you have. It names the category of problem and lists sample URLs.

Why it happens

Google Safe Browsing crawls the web looking for pages that attack or mislead visitors. When it finds one on your domain, it flags the domain. For an ordinary business website that has done nothing wrong, the cause is nearly always one of these:

• Injected phishing pages. Someone has uploaded a fake bank or webmail login page into a folder on your hosting. Your site is being used as free hosting for someone else's scam, and Google flags the whole domain for it.
• Malicious code in your pages. A script added to your theme, plugins or database that pushes visitors towards malware downloads or scam sites.
• An injected redirect. Visitors arriving from search get bounced somewhere else, while direct visitors see the normal site.
• A forgotten install in a subfolder. An old WordPress, a staging copy in /dev/, a demo left in /old/. Nobody has updated it in six years and it is the way in.
• A third-party script that went bad. An ad network, a chat widget or a tracking script whose provider was compromised. Rare, but it does happen, and it flags you even though your own files are clean.

Almost none of this requires you to have been careless. The most common single cause is an out-of-date plugin with a publicly known vulnerability, found by an automated scanner that was never looking for you specifically.

Safe first steps you can try

None of these can make the situation worse, and all of them help whoever ends up doing the cleanup.

1. Take a full backup first — files and database. Even an infected backup is evidence. It tells you what was changed and when, and it is your undo button if a cleanup attempt goes sideways.
2. Read the Security Issues report in Search Console. It names the problem type and gives you sample URLs. Those URLs are where the payload is. If you have never set Search Console up, do it now — verification by DNS record takes a few minutes and you will need it to request the review anyway.
3. Look at the sample URLs. Open them in a private browsing window, not your normal one. If a page exists that you did not create, you have found the injected content.
4. Sort your files by modification date. In your host's file manager or over FTP, sort the site folder by "last modified", newest first. Files changed on a day you did not touch the site are the ones to look at.
5. Check the user list. In WordPress, Users → All Users. An administrator account you did not create is a clear answer. Note it down rather than deleting it immediately — how it got there matters.
6. Look in the folders you forgot about. Any subfolder with an old install in it. If you do not need it, it is one of the few things safe to delete outright.
7. Rotate credentials. Hosting control panel, FTP/SFTP, database, and every WordPress administrator. Do this even if you find nothing — it costs ten minutes and closes the most common route back in.

Only once you genuinely believe the site is clean do you go back to Search Console and use Request Review. Describe what you found and what you did — a review that explains itself is processed faster than a blank one.

What not to do