The text message says: “The website is down.”
You check. It loads fine. But your customer, and their customers, are staring at a full-screen red warning:
Potential Threat Detected. Advanced Security blocked access to this site. This site might compromise your device or contain high-risk content.
The site isn’t down. The site isn’t hacked. Something sneakier is going on: the domain’s reputation has been flagged, and part of the internet is quietly telling people your business is dangerous.
We ran this exact situation down for one of our clients last week. Here is what was actually happening, why it happens to perfectly legitimate small businesses, and how it gets fixed.
The warning isn’t coming from the website
Most people have never heard of the security layer sitting between their wifi and the internet.
Home routers and internet providers now ship with network-level protection, usually on by default:
- Cox Panoramic Wifi and its “Advanced Security”
- Xfinity xFi “Advanced Security”
- eero Secure on eero routers
- Plus the antivirus on the visitor’s computer: Kaspersky, ESET, Sophos, BitDefender, Webroot, and others warn or block right in the browser.
All of these read from threat-intelligence feeds: lists of domains classified as phishing or malware. If your domain lands on a few of those lists, every visitor behind one of those routers, or running one of those antivirus products, gets a scare page instead of your website.
Your site can be flawless today and still be on those lists. Here’s why.
How a legitimate business ends up on a threat list
Three common paths:
1. Your domain has a past. A domain that has been online for years may have run an old website that was hacked at some point, often without the owner ever knowing. Hacked sites get used to host scam pages, the domain gets flagged, and the flag outlives the cleanup by years. Threat feeds are slow to forgive.
2. One vendor’s mistake spreads. Smaller security products license their classifications from bigger feeds. One upstream false positive can echo across half a dozen “different” vendors that all resell the same data.
3. Automated filters misfire. New domains, forms that look like sign-in pages, or sharing an address with a bad neighbor can trip automated classifiers with no human review.
None of these require you to have done anything wrong.
What it looked like on a Surmado Site
One of our clients, a Phoenix real-estate agent, moved her website to Surmado Sites this summer. Her domain is a good one: sixteen years old, well known to her customers. Somewhere in those sixteen years, long before Surmado, the old website that lived on that domain appears to have been compromised. Security vendors’ records show roughly a hundred bad links historically tied to the domain. The infection was ancient history. The reputation damage wasn’t.
Last week the baggage surfaced: eleven security vendors were flagging the domain as “phishing,” and her internet provider’s router security was blocking the site for much of her city.
Here’s the part that matters. Because it’s a Surmado Site, this was our problem, not hers:
- We confirmed the site itself was healthy, loading cleanly from five countries.
- We traced the block to router-level security reading stale threat feeds.
- We audited everything we serve on the domain and verified it spotless. Google Safe Browsing agreed: clean.
- We filed corrections with every vendor still holding the old flag and asked each to reclassify the site as what it is: real estate.
Her to-do list through all of it: nothing.
Check your own site in 15 minutes
Step 1: Confirm the site is actually up (2 min). Load it on your phone with wifi off. Then run it through check-host.net, free, which loads your site from multiple countries. If the world sees your site and you see a warning, it’s a reputation block, not an outage.
Step 2: Look up your domain on VirusTotal (3 min). Search your domain at virustotal.com. It shows about 90 security vendors’ verdicts at once. Healthy is all green. A reputation problem looks like our client’s did: eleven vendors saying “Phishing” while the rest say clean.
Step 3: Check Google Safe Browsing (2 min). Search your URL at Google’s Transparency Report. If Google itself flags you, Chrome warns every visitor, and the fix runs through Google Search Console instead.
Step 4: See who’s blocking you locally (5 min). The warning page usually names the product (“Advanced Security,” “eero Secure”). That tells you which list matters most, and the router’s app has an “allow this site” option that unblocks it for your own network right away.
Getting delisted
Allowing the site in your own router fixes it for your network only. Every flagging vendor keeps its own list, so the real fix is filing a false-positive report with each one. Clearing the major feeds usually clears the smaller products that resell them.
The channels, current as of this writing:
| Vendor | Where to report |
|---|---|
| Webroot / BrightCloud | OpenText Threat Intelligence change request |
| Kaspersky | OpenTIP: look up your domain, submit to reanalyze |
| ESET | Email samples@eset.com with subject “False positive” |
| alphaMountain | Support ticket (their data feeds many downstream tools) |
| BitDefender | False-positive form on their support site |
| Sophos | Web address submission on their support portal |
In each report: say plainly what the business is, that the site collects no passwords or payment details, and, if the domain has a history, that the current site is a full rebuild. Ask for a re-review and the correct category.
Vendors typically answer within a week. Routers and internet providers pick up the refreshed lists after that. Budget one to three weeks for full recovery.
What this has to do with Surmado Sites
Every Surmado Site is built the way security reviewers wish all sites were built: no login page, no database, no add-ons for attackers to break into. The things that got old websites hacked, and old domains flagged, simply aren’t there.
And when the internet’s plumbing misbehaves anyway, like a sixteen-year-old flag surfacing out of nowhere, finding it and fixing it is part of the service. Your job is running your business. The red warning page is ours.