Is there a public list where I can check if our site has been flagged as hacked or unsafe?

A red screen in the browser means safe browsing protection protocols have been triggered directly. By entering your domain into search engines' public transparency and safe browsing status pages, you can see detailed info on whether the site is flagged as "dangerous" and the exact date malicious content was detected.

Happened to us last year. A plugin vulnerability was used to inject hidden gambling redirects onto our site. Our organic traffic dropped to almost zero within three days, and we lost around 4,000 dollars in direct sales. We cleaned up the code, requested a review in the console, and the warning was lifted 36 hours later.

Don't be fooled by the site occasionally loading on your own computer. Your browser might just be skipping the warning because it's using a cached certificate or existing cookies. Make sure to test it from different devices, on mobile data, and in an incognito window. You need to lock down your checkout flow until the cleanup is completely done.

Open an urgent support ticket with your hosting provider immediately and ask them to scan the server access logs for the last five days. Usually, it's a dummy file uploaded to the admin directory from a foreign IP address. You won't be able to get off any blocklists until you close whatever backdoor allowed the file to be uploaded.

Edit: asked below, I wrote the answer in the second message.

So sorry to hear this, easily one of the most stressful things that can happen to an e-commerce store owner. Don't panic and wipe the whole site to start over from scratch. The security report in the console usually points out the exact file or URL path flagged as suspicious start there.

note: I wrote this based on my own experience, it might not apply to everyone.

Are your customers only getting the security warning on desktop browsers or does it pop up on mobile too? Also does the warning appear right on the homepage or only when they go to the cart and hit the checkout button?

Having your domain's security reputation tarnished can cause lasting damage to your search engine rankings. After cleaning the server, we strongly advise conducting a full audit of your DNS records, domain email authentication protocols (SPF, DKIM), and SSL certificate.

there are free domain balcklist checker sites online you type in your domain and it scans like 80 security engines on one screen. check there first to see which antiviruses put you on red.

I can't fully agree with this. Most time waste accumulates in tasks waiting for approval.

This is my opinion I'm not claiming it's absolute truth.

I've been dealing with this for a long time. Just because everyone does it doesn't mean it's right.

Don't rely on a single measure; go layer by layer. That's all, sorry if I went on too long.

I disagree with you on this point. Taking notes for two weeks yields better results than a six-month estimate.

Hope this helps.

Don't miss this: If permission and scope aren't in writing, don't start that test.

Solutions that work at a small scale collapse when you grow; I learned this late. If I were you, I'd go this route.

We experienced almost the exact same thing last year. The biggest time-waster for us was not knowing who had the final say.

Hope this helps.

We got stuck at the same point for a while. If permission and scope aren't in writing, don't start that test.

I'm also curious if anyone does it differently.

My perspective changed after experiencing that. If permission and scope aren't in writing, don't start that test.

If you have questions, write them; I'll answer as best I can.

This is exactly what we experienced. The biggest time-waster for us was not knowing who had the final say.

If you post the result here, it will help others too.

Correct.

Looking at it as a process, the picture changes. An automated scan report is not the same as a penetration test.

Everyone rushing into hacked site list gets stuck at the same point. If you post the result here, it will help others too.