Back to Details

google-safe-browsing

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Google Safe Browsing: Prevent and Fix

Google Safe Browsing：预防与修复

One upstream blocklist (Google Safe Browsing) feeds Chrome, Brave, Safari, Firefox, and Edge. A flag there blocks the site in every browser at once. It is a classification of the public surface, not a hack — do not start by debugging code.
Google Safe Browsing是一个上游黑名单，为Chrome、Brave、Safari、Firefox和Edge提供数据支持。一旦被标记，网站会同时在所有浏览器中被拦截。这是对网站公开表面的分类判定，而非网站被黑客攻击——因此不要从调试代码开始排查。

Quick check: is a site flagged?

快速检查：网站是否被标记？

bash
undefined
bash
undefined

Replace the domain. Check apex AND www — they are scored separately.

替换域名。同时检查主域名和www子域名——二者的评分是分开的。

curl -s "https://transparencyreport.google.com/transparencyreport/api/v3/safebrowsing/status?site=example.com"

Response is `)]}'` followed by `[["sb.ssr", STATUS, bool, bool, bool, bool, bool, timestamp_ms, "site"]]`:

- `STATUS 1` + all `false` = clean.
- `STATUS 2` + any `true` = flagged. The browser interstitial text tells the category: "trick you into revealing passwords" = deceptive/social-engineering; "install dangerous programs" = malware.

Human-readable version: `https://transparencyreport.google.com/safe-browsing/search?url=example.com`
curl -s "https://transparencyreport.google.com/transparencyreport/api/v3/safebrowsing/status?site=example.com"

响应内容以`)]}'`开头，后续格式为`[["sb.ssr", STATUS, bool, bool, bool, bool, bool, timestamp_ms, "site"]]`：

- `STATUS 1` + 所有`false` = 网站安全。
- `STATUS 2` + 任意`true` = 网站被标记。浏览器的 interstitial 提示文本会说明类别：「诱骗你泄露密码」属于欺诈/社会工程类；「安装危险程序」属于恶意软件类。

可读版本链接：`https://transparencyreport.google.com/safe-browsing/search?url=example.com`

Prevention checklist (every new public web project)

预防清单（适用于所有新的公共Web项目）

  1. No third-party trademarks in the domain. 
    youtube-x.com
    , 
    paypal-tool.io
    = brand + login form = automated phishing flag, and a trademark complaint risk. Use subdomains of a domain you own (
    tool.yourname.com
    ).
  2. Crawlers must never land on a credential form. Root URL for anonymous visitors goes to a neutral landing page: no inputs, clear owner ("Operated by X"), explicit "Not affiliated with [brand]" if the product touches one. Login lives behind a link.
  3. Search Console on day one, every domain. Add a Domain property, drop the TXT record at the registrar. It is the only channel where Google warns you BEFORE users see red screens, and the only door to request a review after a flag.
  4. Public URL = public site. "Internal tool" means nothing to a classifier. Kill stray waitlist/signup forms on tools that are actually invite-only; young domain + email-collection forms looks like a harvesting kit.
  5. Verify like a stranger. 
    curl -sL https://the-domain/
    and check: lands on neutral content, no password field, no third-party brand in title/headings.
  1. 域名中不得包含第三方商标。
    youtube-x.com
    、
    paypal-tool.io
    这类域名+登录表单的组合会被自动标记为钓鱼网站，还存在商标投诉风险。请使用你自有域名的子域名（如
    tool.yourname.com
    ）。
  2. 爬虫绝不能直接访问到凭证表单。匿名访客访问的根URL应指向中立的着陆页：无输入框、明确标注所有者（「由X运营」），如果产品涉及某品牌，需明确标注「与[品牌]无关」。登录页面需通过链接跳转访问。
  3. 上线第一天就配置Search Console，每个域名都要做。添加域名属性，在域名注册商处添加TXT记录。这是唯一能让Google在用户看到红色警告前通知你的渠道，也是标记后申请审核的唯一途径。
  4. 公开URL等同于公开网站。「内部工具」对分类系统毫无意义。如果工具实际上是邀请制的，要删除多余的等待列表/注册表单；新域名+收集邮箱的表单看起来像信息收集工具。
  5. 以陌生人的视角验证网站。执行
    curl -sL https://the-domain/
    并检查：是否跳转到中立内容、是否无密码输入框、标题/标题栏中是否无第三方品牌。

Diagnosis workflow (site already flagged)

诊断流程（网站已被标记）

  1. Run the Quick check on apex and www. Confirm flag + category.
  2. Fetch the site anonymously (
    curl -sL
    ), see exactly what Googlebot sees. Look for: brand names in domain/title/headings, immediate redirect to a credential form, public email-collection forms, young domain age (
    whois
    ).
  3. Git history is usually a red herring — the trigger is a re-crawl/reclassification or a user report, not a recent commit. Skim it only to rule out injected scripts or a compromised dependency.
  4. If user uploads or third-party content are hosted on the domain, check whether a specific uploaded file/page tripped the flag (Search Console lists sample URLs).
  1. 对主域名和www子域名执行快速检查，确认标记状态和类别。
  2. 匿名获取网站内容（
    curl -sL
    ），查看Googlebot看到的内容。检查点：域名/标题/标题栏中的品牌名称、是否直接跳转到凭证表单、是否有公开的邮箱收集表单、域名注册时长（
    whois
    查询）。
  3. Git历史通常是干扰项——触发标记的原因是重新爬取/重新分类或用户举报，而非最近的提交。仅在排查注入脚本或受compromise的依赖时才需要浏览Git历史。
  4. 如果域名上托管了用户上传内容或第三方内容，检查是否是某个特定的上传文件/页面触发了标记（Search Console会列出示例URL）。

Recovery

恢复步骤

  1. Fix the public surface first (checklist above) and deploy. Reviews against an unchanged phishy surface get denied and repeat offenses take longer.
  2. Verify the domain in Search Console (DNS TXT at the registrar, propagates in minutes).
  3. Search Console > Security Issues > Request Review. One or two factual sentences: what the site is, who uses it, what was changed.
  4. Typical turnaround 1-3 days. Validate: re-run the Quick check until it returns 
    STATUS 1
    , then confirm in a browser.
  5. If the domain itself contains someone else's trademark, treat the cleared flag as temporary — it stays re-flag-prone. The durable fix is moving to a neutral domain.
  1. 首先修复网站的公开表面（参照上述清单）并部署。针对未更改的可疑表面提交的审核会被拒绝，重复违规会延长审核时间。
  2. 在Search Console中验证域名（在域名注册商处添加DNS TXT记录，几分钟内即可生效）。
  3. 进入Search Console > 安全问题 > 申请审核。用1-2句事实性语句说明：网站用途、用户群体、已做的修改。
  4. 审核周期通常为1-3天。验证：重新执行快速检查，直到返回
    STATUS 1
    ，然后在浏览器中确认。
  5. 如果域名本身包含他人商标，即使标记被清除也只是暂时的——网站仍容易被再次标记。永久解决方案是更换为中立域名。

Worked example

实际案例

youtube-alpha.com
(2026-07): internal team tool, domain contained "youtube", anonymous visitors were redirected straight to a "YouTube Alpha"-branded email+password form, plus a public waitlist form. Flagged as deceptive site; blocked in Brave/Chrome. Fix: deleted waitlist page, added neutral 
/welcome
landing (ownership + non-affiliation notice), de-branded all logged-out pages, then Search Console review. Code was never the problem.
youtube-alpha.com
（2026年7月）：内部团队工具，域名包含"youtube"，匿名访客会直接跳转到带有「YouTube Alpha」品牌标识的邮箱+密码表单，还有一个公开的等待列表表单。被标记为欺诈网站，在Brave/Chrome中被拦截。修复措施：删除等待列表页面，添加中立的
/welcome
着陆页（标注所有者+非关联声明），移除所有未登录页面的品牌标识，然后通过Search Console提交审核。代码从未出现问题。