Website Blacklist Check: Every Vendor Lookup Tool in One Place

By Glenn Lyvers · Updated September 28, 2026 · 7 min read

To check whether your website is blacklisted, start with two scans that cover most of the field at once: my free blacklist checker and a URL scan on VirusTotal, which runs your address past roughly ninety engines. Then confirm the verdicts that matter most for your traffic — Google, the big antivirus brands and the corporate web filters — on each vendor’s own lookup page, because every one of them keeps a separate list and a separate removal queue.

This page lists the official lookup tool for each of the vendors people ask me about most, what the result actually tells you, and where to go once you know who is flagging you.

Know which kind of list you are checking

“Blacklisted” covers three different things, and mixing them up is how people spend a day on the wrong form.

• Web reputation lists rate a URL or domain for browsers, antivirus web shields and corporate firewalls. Google Safe Browsing, Norton Safe Web, McAfee, FortiGuard, Webroot BrightCloud and Trend Micro are all in this group. This is what produces the red screen or the “site blocked” page your visitors see.
• Email blocklists list the IP address that sends your mail, or a domain that appears inside email bodies. Spamhaus and SURBL are the ones that matter. A listing here stops your mail being delivered but does not put a warning in front of website visitors.
• Category lists are not verdicts at all. A web filter that files your site under “Newly Registered Domain” or “Suspicious” is making a guess about an unknown site, not reporting malware. Those need a recategorisation request, not a cleanup — I cover that case in new domains flagged as phishing.

Check the right thing at the right level, too. Reputation tools usually rate the exact URL, the hostname and the domain separately, so a single infected page can be flagged while your homepage looks clean. When a visitor sends you a screenshot, look up the precise URL in it, not just your domain.

Official lookup tools, vendor by vendor

Every link below goes to the vendor’s own tool. The last column is my walkthrough for getting that particular vendor to clear you.

Vendor	Where to check	Getting delisted
Google Safe Browsing	Transparency Report site status; Search Console > Security issues for your own site	Google Safe Browsing removal
Fortinet FortiGuard	FortiGuard web filter lookup	FortiGuard removal
Norton Safe Web	safeweb.norton.com	Norton Safe Web removal
McAfee WebAdvisor	McAfee site lookup	McAfee removal
Cisco Talos	Talos reputation center	Cisco Talos removal
Webroot / BrightCloud	BrightCloud URL/IP lookup	BrightCloud change request
Trend Micro	Site Safety Center	Trend Micro removal
Kaspersky	Kaspersky OpenTIP	Kaspersky removal
Palo Alto Networks	URL filtering test-a-site	Palo Alto removal
Symantec / Broadcom	Site Review	Symantec removal
Spamhaus (email, IP and domain)	check.spamhaus.org	Spamhaus delisting
SURBL (domains in email)	SURBL lookup	SURBL delisting

A few of these pages sit behind bot protection and occasionally throw a challenge or an error on the first load. Reload once in a normal browser before assuming the tool is down.

Vendors with no public lookup

Several of the engines that block real visitors have no page where you can type in a URL and see their verdict.

Avast and AVG don’t publish a URL lookup. You find out from a visitor’s screenshot showing URL:Mal or URL:Blacklist, or from the Avast and AVG rows in a VirusTotal URL scan. Microsoft SmartScreen has no lookup either — the verdict is only visible in Edge and Windows, and the only route is the SmartScreen report form. Bitdefender, ESET and Sophos are best checked through their VirusTotal rows and then disputed through the steps on my Bitdefender, ESET and Sophos pages.

That gap is the main reason I built the free checker and why I always pair it with VirusTotal: between them they catch most of the vendors you cannot query directly.

Reading a VirusTotal URL result without panicking

VirusTotal is the fastest single view, and also the easiest to misread. A few rules I work by:

• One or two hits from smaller engines, everyone else clean, is often a stale or heuristic verdict. It still deserves a look, but it is rarely the thing costing you traffic.
• Several hits including Google Safe Browsing, Kaspersky, Fortinet or BitDefender means something real was seen. Assume compromise until you prove otherwise.
• Labels like “Suspicious” or “high confidence” are about the engine’s certainty, not the malware family. I explain the common ones in VirusTotal detection labels and the Gridinsoft variants in Gridinsoft verdicts.
• The result is cached. Press the rescan button after you clean, or you are reading last week’s verdict.

If you only have a screenshot

Block pages usually name the vendor, even when the visitor doesn’t. A page offering “to have the rating of this web page re-evaluated” is a FortiGuard block from a Fortinet firewall — use the FortiGuard removal steps. A full-screen red “Deceptive site ahead” or “Dangerous site” is Google Safe Browsing, covered in what each Chrome warning means. A grey search-result note saying “This site may be hacked” is a Google search label, which is a different thing again — see removing Google’s hacked label.

You found a listing. Now what?

Resist the urge to file every dispute form in the next ten minutes. Reviewers fetch your page and look at what it serves; a request against a site that is still infected is refused, and repeat refusals make the next one slower. The order that works:

1. Confirm whether the site is actually clean. Run my free site scan, then check from a phone and from a Google result, since a lot of malware hides from logged-in owners. How to tell if a site is hacked has the full owner checklist.
2. If it isn’t clean, fix the cause — including whatever let the attacker in — before any vendor hears from you. Why sites get reinfected covers what usually survives a quick cleanup.
3. Purge your cache and CDN, so reviewers see the clean origin rather than a stored copy of the infected page.
4. Then submit to every vendor that lists you, once each, and keep the reference numbers. The vendor removal directory has the official route for over a hundred engines.

How often to check

After a cleanup, check daily for the first two weeks. Vendors clear on their own schedules, and a listing that reappears after being cleared is a reinfection signal, not a vendor mistake. After that, weekly is plenty for most small business sites — or let someone else do it: every Full Service and Yearly Maintenance plan I run includes daily malware and blacklist scans, so you hear about a listing from me rather than from a customer.

Common questions

How do I check if my website is blacklisted for free?

Run the address through a multi-engine checker such as VirusTotal's URL scan or my free blacklist checker, then confirm on Google's Transparency Report site status page. Those three cover most of what blocks real visitors. For a specific vendor such as FortiGuard, Norton or McAfee, use that vendor's own lookup page, because each keeps its own list.

How do I do a FortiGuard or Fortinet blacklist check?

Use the FortiGuard web filter lookup at fortiguard.com/webfilter and enter the exact URL. It returns the category Fortinet firewalls use to block or allow the site. If the category is wrong, or the block page offered to have the rating re-evaluated, submit a rating change through FortiGuard once the site is confirmed clean.

How do I check if Norton has blacklisted my site?

Look the domain up on safeweb.norton.com. It shows Norton's safety rating and, when the site is rated unsafe, the threats it recorded. If the site is clean now, sign in and request a re-evaluation from the same page; the rating does not update by itself quickly.

Is being on an email blacklist the same as a website blacklist?

No. Email blocklists like Spamhaus list a sending IP address or a domain seen in email bodies, and they affect whether your mail is delivered. Website blacklists like Google Safe Browsing or McAfee affect whether visitors can load your pages. A hacked site can land on both, but each has its own lookup and removal process.

Why does VirusTotal still show my site as malicious after I cleaned it?

VirusTotal shows the last scan it ran, and each engine behind it has its own update cycle. Press rescan after cleaning. If an engine still flags the site, it is either working from a stale list or still seeing something on the site; the only way to change its verdict is through that vendor's own review route.

Can a single page get my whole domain blacklisted?

Yes. Most vendors rate the URL, the hostname and the domain separately, and a phishing page or malicious script in one folder can be enough to push the whole domain's reputation down. That is why checking only the homepage can give a false all-clear.