Safe Browsing to Protect Your Website and Visitors

Is a hacker trying to compromise your website right now? Probably. One study from the University of Maryland showed that there’s an attack every 39 seconds. Google launched Safe Browsing in 2007 to help protect users and website owners from these malicious attacks.

No one wants to navigate to a site that endangers their personal information or tries to install malicious code on their computer. That’s why maintaining a safe website is important to everyone — website owners, visitors, and even search engines.

In fact, Google initially planned to include safe browsing as a ranking signal in its page experience update. However, just as the update rollout was nearly complete (in August 2021), Google decided to remove safe browsing from the Page Experience report and not consider it as a ranking signal.

Regardless, it is still vital to your website to avoid hacks and other security risks. So in this article, I’ll discuss:

• What Safe Browsing Is
• Why Safe Browsing Matters
• How to Create a Safe Website
• FAQ: How can website owners prevent hacking and other security risks?

What Is Safe Browsing?

Safe Browsing is a service by Google that helps protect website owners and users from dangerous websites and downloads. According to Google, Safe Browsing helps protect more than 4 billion devices daily.

Google Transparency Report, Safe Browsing

Safe Browsing alerts users of dangerous content across all types of products. This includes Google Search, Google Chrome and other browsers, Gmail, Android, and Google Ads. The Security Issues report in Search Console alerts website owners of compromised websites.

Why Does Safe Browsing Matter?

Safe Browsing helps website owners keep their websites safe for users. And that means helping to preserve your traffic, reputation, and revenue.

Hacked websites often fly under the radar. Keeping up with website security is an important but often overlooked job.

According to the Sucuri 2019 Website Threat Research Report:

In 2019 alone, 60% of all CMS applications were found to be out of date at the point of infection, making outdated components and core CMS files the leading causes of today’s website hacks. Infections continue to come from outdated software plugins, modules, and extensions; abused access control credentials; poorly configured applications and servers; and a lack of knowledge around security best practices.

Reports generated by Safe Browsing help you know about these attacks. Safe Browsing can help you identify if your site has been affected by malware, unwanted software, or social engineering content.

Malware

Malware refers to software or mobile applications made to harm devices or users. From Google:

Malware is any software or mobile application specifically designed to harm a computer, a mobile device, the software it’s running, or its users. Malware exhibits malicious behavior that can include installing software without user consent and installing harmful software such as viruses. Webmasters sometimes don’t realize that their downloadable files are considered malware, so these binaries might be hosted inadvertently.

Examples of malware include viruses, trojans, and spyware, to name a few.

Unwanted Software

Unwanted software negatively affects the user. From Google:

Unwanted software is an executable file or mobile application that engages in behavior that is deceptive, unexpected, or that negatively affects the user’s browsing or computing experience. Examples include software that switches your homepage or other browser settings to ones you don’t want, or apps that leak private and personal information without proper disclosure.

Sometimes companies bundle potentially unwanted software with a wanted program. Google provides guidance on how to avoid being categorized as unwanted software, which I’ll touch on later.

Social Engineering Content

Social engineering involves tricking people into giving up sensitive information that bad actors use for fraud.

This can happen through phishing attacks or deceptive content, which Google defines as “sharing a password, calling tech support, downloading software, or the content containing an ad that falsely claims that device software is out-of-date, prompting users into installing unwanted software.”

Google discusses more dangerous content that can show up on a site:

Social engineering can also show up in content that is embedded in otherwise benign websites, usually in ads. Embedded social engineering content is a policy violation for the host page.

Sometimes embedded social engineering content will be visible to users on the host page, as shown in the examples below. In other cases, the host site does not contain any visible ads, but leads users to social engineering pages via pop-ups, pop-unders, or other types of redirection. In both cases, this type of embedded social engineering content will result in a policy violation for the host page.

Another category is what Google calls “insufficiently labeled third-party services”:

A third-party service is someone that operates a site or service on behalf of another entity. If you (third party) operate a site on behalf of another (first) party without making the relationship clear, that might be flagged as social engineering. For example, if you (first party) run a charity website that uses a donation management website (third party) to handle collections for your site, the donation site must clearly identify that it is a third-party platform acting on behalf of that charity site, or else it could be considered social engineering.

How to Keep Your Website Safe

One of the easiest things you can do is sign up for a Search Console account. This helps you monitor if your site has been hacked. (Note: It’s free to set up Google Search Console on your site.)

Google reports that the types of security notifications that you’ll be able to receive in Search Console increase “the likelihood of cleanup by over 50% and reduce infection lengths by at least 62%.”

Of course, you’ll want to ensure that you keep your site’s security measures up to date. Updating plugins and implementing HTTPS are two key to-dos.

Website owners want to be extra careful to follow Google’s definition of harmful content as well. For example, be sure to know its unwanted software policy. Google shares a lot more details on what’s acceptable here and includes advice on Chrome extensions and mobile apps.

There’s a video series from Google Webmasters that offers help for hacked websites. It covers everything from the basic overview to cleaning and maintaining the site and requesting a Google review.

If you discover that your site has been compromised, the process can be lengthy. Google reports that it can take up to 90 days for website owners to clean up their sites from an attack. The following chart shows how long (in days) it takes webmasters to do this after receiving notification of an attack, on average.

Google Transparency Report, Safe Browsing

The good news is that, according to Google Research (linked earlier), 80% of website owners successfully clean up symptoms on their first try.

If you have concerns related to website security, a technical SEO expert can help. Contact us today if you’d like to talk.

FAQ: How can website owners prevent hacking and other security risks?

The frequency of cyber attacks is rising; website owners must proactively protect their online assets and maintain user trust.

The foundation of strong website security lies in keeping all software and plugins current. Regular updates patch vulnerabilities that hackers may exploit. Implementing Secure Sockets Layer Certificates (SSL) creates encrypted communication between the browser and server, safeguarding sensitive information from being shared openly or breached insecurely.

Another crucial aspect is using strong and unique passwords for all accounts, coupled with multi-factor authentication (MFA). MFA adds a layer of security by requiring users to provide multiple verification forms before granting access. This significantly reduces the risk of unauthorized access to your website’s backend.

Incorporating a Web Application Firewall (WAF) acts as a barrier between your website and potential threats. A WAF filters out malicious traffic, preventing hackers from exploiting vulnerabilities and executing attacks like SQL injection or cross-site scripting. Regular security audits and vulnerability scans also help identify weak points that need immediate attention.

Educating yourself and your team about the latest security threats and trends is paramount. Staying informed allows you to address emerging risks proactively. Moreover, continuously monitoring your website’s security alerts you to any unusual activities, enabling you to take swift action if a breach is detected.

Lastly, partnering with reputable security service providers can provide you with expert assistance. They offer advanced threat detection, real-time monitoring, and rapid response solutions.

Cyber threats are always evolving, making a comprehensive website security plan imperative. By taking proactive security steps and staying informed with industry updates as necessary, website owners can reduce the risk of hackers and security breaches to keep users secure while also safeguarding reputation and business integrity.

Step-by-Step Procedure: Enhancing Website Security Against Hacking and Security Risks

1. Regularly update all software and plugins to patch vulnerabilities.
2. Implement an SSL certificate to ensure encrypted communication.
3. Utilize strong, unique passwords and enable multi-factor authentication (MFA).
4. Incorporate a Web Application Firewall (WAF) to filter out malicious traffic.
5. Conduct security audits and vulnerability scans to identify weak points.
6. Stay informed about the latest security threats and trends.
7. Monitor your website’s security alerts for any unusual activities.
8. Partner with reputable security service providers for expert assistance.

By diligently following these steps, website owners can create a strong defense against hacking and security risks, ensuring the safety of their platforms and user data.

Bruce Clay is founder and president of Bruce Clay Inc., a global digital marketing firm providing search engine optimization, pay-per-click, social media marketing, SEO-friendly web architecture, and SEO tools and education. Connect with him on LinkedIn or through the BruceClay.com website.

See Bruce's author page for links to connect on social media.