Most flags begin as a preventable hack, or a forgotten site quietly rotting on old software. These habits take about an hour a month - and they protect your ratings far better than any dispute ever will.
Every guide in this series exists because a warning appeared. This one exists so it does not appear again. Blacklist reviewers and scanners re-check sites over time; a site that was cleaned but left wide open gets reinfected, re-flagged, and this time the reviews are slower because the history is worse. Prevention is unglamorous - updates, passwords, monitoring - and it is the entire difference between a one-time scare and a yearly ritual.
Outdated software is how most small sites get hacked - automatically, by bots, within days of a vulnerability becoming public. Put CMS core, plugins and themes on a schedule, enable automatic updates where it is safe, and delete plugins and themes you no longer use instead of merely deactivating them. Disabled code sitting on the server can still be exploited; deleted code cannot.
Use a unique password for hosting, CMS admin, FTP and database - never one password shared across all of them, and never one login shared by the whole staff. Turn on two-factor authentication for admin accounts wherever it is offered, and remove old accounts the day a staff member or developer leaves. A striking share of flagged sites were entered through a password that was guessed, reused or simply never changed.
A web application firewall - a security plugin such as the Wordfence or Sucuri class on WordPress, or your host's firewall service - filters out the common automated attacks before they reach your site. It will not stop a determined human attacker, but the attacks that infect most small websites are not determined humans; they are scripts, and scripts are exactly what a WAF is good at turning away.
Turn on file integrity monitoring if your security tool offers it - an alert the day a file changes unexpectedly is the difference between a one-hour fix and a month of warnings. Pair it with a monthly manual check of your Safe Web report and a Sucuri SiteCheck scan, and keep Google Search Console's security alerts enabled. Flags caught in the first days are small problems; flags caught by customers are not.
Backups stored on the same server get encrypted, deleted or infected along with the site. Keep copies off the server - with your host's off-site option or a separate storage account - and test a restore occasionally so you know the copies actually work. A clean restore turns a hack from a week of cleanup and warnings into a bad day, and gives every re-review a simple, true story: infected on this date, restored clean, passwords changed.
Watch the video for the visitor's view of a Symantec block - it is the best reminder of what your prevention routine is protecting your customers from.
▶️ Watch Full VideoThe attacks are automated and do not check your size. Small, unmaintained sites are the favourite targets precisely because nobody is watching them.
HTTPS protects data between your site and its visitors, and it matters for trust - but it does not stop a site being hacked. You need HTTPS and the habits on this page.
Updates plus two-factor authentication, treated as one habit. The large majority of flagged small-business sites fail on one of those two basics.