Chrome and other browsers will display warning notifications for a minimum of one month for websites that fail to fix problems that violate Google’s Safe Browsing standards.
Starting this week, websites that keep violating Google’s Safe Browsing standard will be slapped with a “Repeat Offender” tag.
Google’s Chrome browser and other popular browsers will display a notice to users who visit such sites warning them about the potential for their computers to become infected with unwanted software, malware, phishing and other security threats.
The warning will remain in place for a minimum of one month and will only be removed after that period if Google determines the site no longer poses a security threat to users. The owner of a website classified as a Repeat Offender will not have an opportunity to get Google to reconsider the labeling for one full month, even if all identified security issues have been addressed before then.
The new policy is designed to punish website owners whom Google considers to be frequent abusers of its Safe Browsing requirements.
Google introduced Safe Browsing about nine years ago as a way to protect users from malicious websites. It basically serves as an alerting mechanism when users arrive on a website that Google’s web crawlers determine is being used to serve up unwanted ads, software, spam and malware or is being used for phishing and other social engineering purposes.
Till last December, Safe Browsing alerts were available only to desktop users. But since then, Google has enabled it by default for versions of Chrome running on its Android operating system.
Google has used the Safe Browsing mechanism to also warn website owners and administrators about their sites being flagged for potential security issues. In many cases, the warnings have alerted administrators about potential security issues on their sites, which even they had not been aware of up to that point.
Google’s policy till this week has been to keep the browser warnings in place till the website owner remediates the issue. Once fixed, webmasters could ask Google to review the site once again and remove the browser warnings. Google also uses an automatic verification process under which it reviews flagged sites on its own and removes the alerts if it determines all violations have been addressed.
“However, over time, we’ve observed that a small number of websites will cease harming users for long enough to have the warnings removed, and will then revert to harmful activity,” said Brooke Heinichen, a member of Google’s Safe Browsing team in a blog post this week.
The tougher Safe Browsing policy that Google announced this week is a response to this loophole, Heinichen said.
For classification purposes, Repeat Offenders are websites that frequently keep switching between compliant and non-compliant behavior with the sole purpose of gaming the system according to Heinichen.
A website that is hacked and is being used for malicious purposes will not be classified as a repeat offender. That tag is reserved solely for sites that deliberately host harmful content. Heinichen did not say how Google will make that determination or what factors it will consider to determine if a site serving up malware is compromised or was set up solely for that purpose.
