Are HTTP links in a plugin causing a deceptive site warning, and how should you investigate?

The presence of two HTTP links in a plugin’s scripts is not enough to conclude that they caused a “Deceptive site ahead” warning. Some participants in the supplied discussion suspected the plugin or its links, while others thought Google might have made an incorrect assessment. However, no test results or response from Google confirmed the cause. A better-supported approach is to first disable the plugin, clear the cache, and reload the affected page to see whether the warning changes, then seek clarification from Google about any unresolved warning.

HTTP links are leads to investigate, not a confirmed cause

The situation described in the question was that a website received a “Social engineering content” warning, an important page and its internal links were flagged as deceptive, and the WordPress layout plugin used on that page contained two HTTP links in its scripts. These observations occurring together still do not establish which one triggered the warning.

Rank Watch thought the two links “might” be the cause and strongly suspected the plugin or something related to it. But this was a forum participant’s speculation based on the description, not Google’s diagnosis of the page. The material does not identify the link destinations, the scripts’ actual behavior, or the specific basis for the warning, so “uses HTTP” cannot be equated with “constitutes deceptive content.”

First narrow the scope by disabling the plugin, then interpret the results

K Edward suggested disabling the plugin, clearing the cache, and reloading the page; Rank Watch proposed removing the plugin and trying again. Following the suggestion to disable it, you can start by documenting the differences before and after the test:

• Record the pages originally affected and the warning text, rather than describing the situation only as “a problem with the website.”
• Disable the suspected layout plugin, clear the cache, and reload the same page.
• Record separately whether the page loads normally and whether the original warning still appears.

If the page loads normally and the warning disappears after the plugin is disabled, that supports further investigation of the plugin and related components. However, the test changes the enabled state of the entire plugin, so the result alone cannot pinpoint the two HTTP links as the cause. If the warning remains, the available material is also insufficient to identify the actual source or declare the plugin entirely unrelated.

Seek clarification from Google, but do not assume a false positive

dave_hermansen considered the problem description too vague and suggested asking Google, which issued the warning. fastreplies also suggested that filters could produce incorrect results and argued that, if the links really were fine, Google should review them manually and provide guidance.

These comments support the need for a more specific explanation, but they do not prove that this case is a false positive, nor are they an official promise that manual review will be available. When seeking clarification, you can compile the exact warning text, affected pages, suspicious links, and results of the test with the plugin disabled. This shifts the question from “Did HTTP cause this?” to observations that can be checked, rather than choosing a cause for the warning in advance.