Google Blogger locks hundreds of blogs in malware false positive

Google has locked hundreds of Blogger websites after a false positive claimed they violated its "Malware and Similar Malicious Content" policy, with some sites actually deleted from the platform.

The issue began on August 4, and it appears to affect many legitimate blogs that do not host malware or have malicious scripts.

As seen by BleepingComputer, hundreds of web admins have reached out to Google on the company's official forum for help in restoring access to their blogs.

The forum post now has more than 300 "I have the same question" votes and over 100 replies from publishers.

"Today's huge number of reports regarding blogs flagged/locked for the same reason suggests misclassification by automated systems," a Blogger Product Expert wrote. "False positives do occur from time to time, but not on this scale."

If you're affected, you will see a large red padlock in your Blogger dashboard with a clear warning: "Note: this blog has been locked."

"This blog was removed for violating Blogger's Community Guidelines. If you wish to request a review of the blog, click 'Request Review' below," reads the Blogger warning.

Google's automated message also warned publishers that their blogs can be permanently deleted within the next three months if no appeal is submitted.

While a blog is locked, its owner cannot access the dashboard tabs used to manage posts, settings, themes, or other parts of the site.

"The removal happens automatically after updating the homepage or making changes to the blog template," one publisher reported.

The situation has become even more frustrating for some users, who say that their blogs were restored and then later deleted again.

Not all Blogger users are affected, and some of those who submitted an appeal are already seeing their blogs come back online.

It's also unclear how many sites are hosted on Blogger, as Google has never disclosed the numbers. However, some third-party trackers suggest that close to 200,000 sites are hosted on the platform.

We've reached out to Google for a statement, and we'll update this story when we hear back.

This is a developing story.

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper