🚨 GitHub Pages: Site Flagged? Here’s What to Know

[mecodeatlas]

It can be alarming to publish your project with GitHub Pages and suddenly see a big red warning in Chrome, Brave, or another browser saying “Deceptive site ahead” or “Dangerous site”.

The good news: in almost all cases, there’s nothing actually malicious in your repository . Instead, these warnings come from browser security filters like Google Safe Browsing or Brave Safe Browsing, which sometimes misclassify safe static sites.

This guide explains why this happens, how to check your setup, and what steps you can take to resolve the problem.

🕵️ Why are Pages sites flagged?

GitHub Pages serves only static content (HTML, CSS, JS) directly from your repository. It doesn’t inject anything unsafe. But browser filters can raise warnings when:

• Your project looks like a popular site (e.g., a clone of Netflix or a login page), which can be mistaken for phishing.

• External scripts, trackers, or CDNs you’ve included are on a blocklist.

• A single flagged subdomain affects all sites for that GitHub account, since Pages uses path-based routing.

• The site is under review because of a false positive from Google or Brave Safe Browsing.

In other words, these warnings don’t come from GitHub infrastructure itself. They are classifications made by external security systems, and while frustrating, they are part of how browsers try to protect users from phishing risks.

🔍 How to check your site

Before taking action, do a quick review to confirm there’s nothing in your repo that could reasonably trigger the warning:

• Double-check your content: confirm there are no downloads, redirects, credential forms, or malicious-looking scripts.

• Look for external resources: remove or replace CDN/third-party links that could be blacklisted.

• Confirm HTTPS is enabled: in your repo settings under Pages → Enforce HTTPS.

• Try another browser or clear cache: sometimes warnings are cached locally.

If everything checks out and your site is just static HTML/CSS/JS, it’s almost certainly a false positive.

🛠️ How to fix or work around it

If your site is safe but flagged anyway, here are steps that often help:

• Request a Safe Browsing review
  Open your site in the browser and look for the “Report incorrect warning” link in the red warning dialog. You can also use the Google Safe Browsing Transparency Report to see why the site is flagged and submit a review request.

• Rename the repo or Pages URL
  Safe Browsing sometimes flags certain slugs or keywords. Publishing under a slightly different path can bypass the block while you wait for review.

• Verify HTTPS enforcement
  In Repo Settings → Pages → Enforce HTTPS, make sure the toggle is on. Sites without HTTPS are more likely to be flagged.

• Check for false-positive scripts
  If you’re using ads, analytics, or CDN scripts, remove them temporarily to see if the warning disappears.

• Escalate through GitHub Support
  If nothing works, open a support ticket and include:

  • Your repo link
  • The Pages URL
  • A screenshot of the warning
  • Confirmation that you’ve verified no unsafe content is present

The support team won’t be able to remove the flag directly, but they can confirm whether your Pages configuration is correct, rule out other potential issues, and point you toward the right next steps with external services.

⏳ What to expect after review

When you request a Safe Browsing review, it usually takes a few days for the block to be re-checked. If it’s confirmed as a false positive, the warning is lifted automatically once the blocklist is updated. Many users have reported that their Pages sites returned to normal after review, with no changes needed on their end.

📚 Extra resources

• Google Transparency Report – Safe Browsing
• Report a Detection Problem to Google
• Google Search Central: Social engineering (phishing and deceptive sites)
• GitHub Docs: Managing a GitHub Pages site
  

💡 Final note

If your GitHub Pages site gets flagged, remember: it doesn’t mean your repo is compromised. These warnings are usually false positives from external browser services. By reviewing your content, ensuring HTTPS, and submitting a Safe Browsing review, you can usually resolve the issue quickly.

And if you’ve faced this problem before, share your experience in the comments — it might help the next developer who runs into the same scary red screen.

❓ Quick FAQ - Dangerous Site Warnings on GitHub Pages

Q: Can GitHub remove the “dangerous site” warning for me?
A: No. These warnings come from external services like Google Safe Browsing. Only they can clear the flag after a review.

Q: Why are all my Pages sites flagged if only one has an issue?
A: Pages uses path-based routing. If one path is flagged, the warning can extend to all sites under the same github.io domain.

Q: How do I request a review?
A: Either click the “Report incorrect warning” button in the red dialog, or manually submit the URL in the Google Transparency Report.

Q: How long does a review take?
A: Typically a few days. Once re-checked, the warning disappears automatically after blocklists update.

Q: What if I’m just building a practice project (like a Netflix clone)?
A: These are often flagged as phishing. To avoid problems, rename your repo, clearly label it as educational, or use a private repo/custom domain instead of the default github.io.

Q: Can HTTPS settings cause warnings?
A: Yes. If HTTPS isn’t enforced, browsers may treat your site as unsafe. Enable it under Settings → Pages → Enforce HTTPS.

Q: What should I do if the warning persists after review?
A: Audit your content for flagged scripts or resources. If nothing suspicious is found, contact GitHub Support with details so the case can be escalated.

[lucashawthorne]

Yesterday, all of my websites were flagged as Dangerous and I was able to get them unflagged this morning. However, just prior to them being flagged, and even now after they're unflagged, I'm encountering this error on every single one of my websites:

You can see this for yourself if you head to my portfolio, for example. There's nothing wrong with my code or deployment as I've personally seen as well as other people.

I don't know if my websites being flagged as dangerous broke them or something, because I've been having this issue even slightly before the Dangerous flag came up, but for weeks my websites were working fine. Can anyone help me find a fix?