# QR code blocked by Safe Browsing or SmartScreen

> A Safe Browsing or SmartScreen warning means the destination domain is flagged, not the QR code. Shared shortener domains inherit abuse from every other user, which is the usual trigger. Check the domain in Google's Transparency Report, request a review once cleaned, and move to a domain you own.

Source: https://useqr.app/docs/troubleshooting/qr-code-blocked-by-safe-browsing · Last reviewed 2026-08-21 · UseQR is free forever, no signup.

---

## What the warning actually is

The full-screen red "Deceptive site ahead" page comes from Google Safe Browsing, used by
Chrome, Safari, Firefox and Android's camera flow; Edge and Windows show the equivalent
Microsoft Defender SmartScreen warning. Both are **domain- and URL-reputation lists**. The
QR code decoded perfectly and handed over the URL you encoded, the browser then checked
that URL against a blocklist and refused to load it.

So the question is never "what is wrong with my code" but "why is this domain flagged".

## The shortener trap: you inherit other people's abuse

This is the fact that explains most cases. Reputation systems score the **domain**. A free
[shortener](/glossary/short-url) puts thousands of unrelated users behind one domain, and
phishers love free shorteners precisely because they hide destinations. When enough abusive
links accumulate, the scoring can spill over and legitimate links on the same shared domain
start triggering warnings for some users. You did nothing wrong; you co-signed a lease with
strangers.

The same mechanism applies to shared subdomains on free hosting: `yourname.sharedhost.tld`
carries the reputation of every other tenant of `sharedhost.tld`.

A printed QR code makes this much worse than a normal link, because you cannot edit paper.
A campaign that scans fine at proof time can start warning mid-campaign when the shared
domain's reputation shifts, the same failure shape as
[a shortener retiring your link](/docs/troubleshooting/qr-code-link-shortener-expired).

## Check the domain

Google publishes a public lookup: the **Safe Browsing site status** tool on
transparencyreport.google.com (under Safe Browsing → site status). Paste the destination
domain and it reports whether Google currently lists it as unsafe. Decode your printed code
with our [scanner](/scan) first so you check the URL that is actually encoded, including any
shortener domain in front of your real one: the flag is often on the intermediate hop, not
your site.

## Remediation, in order

1. **If your own site is flagged**: it is usually genuinely compromised: injected spam
   pages, a phishing kit in a forgotten upload directory. Clean it, then request a review
   in Google Search Console (Security Issues → Request Review). Reviews on a cleaned site
   typically clear in days.
2. **If a shortener you used is flagged**: you cannot remediate a domain you do not
   control. Repoint if the shortener allows editing; otherwise the printed code is a
   casualty. Reprint with a direct URL.
3. **If only some users see the warning**: reputation propagation is not uniform across
   browsers and list snapshots. Treat any reproducible warning as real and act.

## Prevention

- **Encode a direct HTTPS URL on a domain you own.** One tenant, one reputation, fully in
  your control. This also survives [corporate-network
  category filters](/docs/troubleshooting/qr-code-blocked-by-corporate-wifi), which often
  block shorteners wholesale.
- Static codes need no intermediary at all: UseQR encodes your
  [URL](/url-qr-code) as-is, client-side, with no redirect service that can
  accumulate someone else's abuse.
- Keep the destination boring and honest: no cloaking, no instant redirects through ad
  networks, no credential forms on unfamiliar domains. The heuristics that catch
  [quishing](/docs/security/quishing-explained) are looking for exactly those patterns.

## FAQ

### Why does my QR code show a deceptive site warning?
The destination domain (often a shared shortener in front of your real site) is on the Safe Browsing or SmartScreen blocklist. The code itself is fine. Decode it, identify which domain in the chain is flagged, and remediate or replace that domain.

### Can a QR code itself be flagged as malicious?
No. A static QR code is just encoded text with no reputation of its own. All blocking happens when the browser checks the decoded URL against reputation lists, so the fix is always on the URL and domain side.

### How do I check if a domain is flagged by Google?
Use the Safe Browsing site status lookup on Google's Transparency Report site (transparencyreport.google.com). It reports the domain's current listing. For your own site, Google Search Console's Security Issues panel shows the specific flagged URLs.

### How long does it take to clear a Safe Browsing flag?
After you clean the site and request a review through Search Console, cleared reviews typically take from a day to a few days. Domains you do not control (like a shared shortener) you cannot clear at all; reprint with your own domain.

## Try it

- https://useqr.app/url
- https://useqr.app/scan
- https://useqr.app/validate