Reference
Site security checks
Updated September 2026
Every new preview link is checked against Google’s threat lists before visitors use it, and a QA report can check your domain and new server as well. This protects your visitors, and it tells you about a compromised site or server before you switch DNS.
Security badges on your links
The link list shows the latest result next to each link:
| Badge | What it means | What to do |
|---|---|---|
| Security: clean | Google Web Risk does not list the domain, and the optional page scan found nothing. | Nothing. Lists cover known threats only, so keep your CMS and plugins up to date. |
| Security: scanning… | The page scan of the preview is still running (usually under a minute). | Wait and refresh the list. |
| Security: not checked | The check could not run this time. | Nothing: the link works. |
| Security: suspicious (Cloudflare scan: …) | A page scan saw signs of phishing, for example a login page styled like another brand. The preview keeps working. | If you did not expect that, look for injected pages on the new server before switching DNS. |
| Blocked: flagged by Google Web Risk | Google lists the domain as phishing or malware, so the preview was disabled. | Clean the site, request a review in Google Search Console → Security issues, then contact support. |
| On hold: security review | A page scan rated the page your server returns as malicious. The preview is offline until DNSPeek reviews it. | Check the new server for malware or injected pages. If the page is legitimate, contact support. |
A blocked or held link cannot be switched back on from the dashboard; support lifts the block once the site is clean. Scan screenshots of flagged pages are never shown in the dashboard or on shared reports.
Security section of the QA report
On plans with security scans, every QA report has a Security section. It checks the home page, up to 10 crawled pages and the new server’s IP address against Google Web Risk and adds the latest page scan of the preview. The section explains in plain words what to fix, for example “your new server may serve malware or phishing: find and remove the injected content before switching DNS”.
- A listed domain or page is about the domain name, whichever server serves it.
- A listed server IP or a malicious page scan is about the new server: ask your host, or pick another server, before switching DNS.
- Shared reports never show the new server’s IP address.
- DNS blocklists such as Spamhaus are not checked: their free services do not allow commercial use.