Google Web Risk
lists of unsafe pages.
Looks up a checked link, and where it leads, on Google's lists of phishing, malware and unwanted-software pages. It is the strongest signal of the link check when a page is already known.
01What it does
When a person checks a link, or a message or e-mail with links, the server asks the Web Risk Lookup API whether Google lists the address as sent and the address it leads to. The answers:
| Google's list | Finding |
|---|---|
| Social engineering (phishing, deception) | Danger |
| Malware | Danger |
| Unwanted software | Danger |
| Only the extended-coverage list, which Google rates less certain | Caution, "Possibly deceptive site" |
Every finding says the list may be wrong and links to Google's explanation of its type. An address that is not listed says nothing either way: a new fraud page is often not listed yet. Answers are cached until the expiry time Google gives, at most 24 hours, under a hash of the address, never the address itself. The API key is sent in a request header, not in the address.
02Terms you need to know
- Commercial use: Web Risk is Google's paid, commercial service for this. Its free sibling for links is for non-commercial use only, which is why Veritap does not use it (Google's usage limits).
- Attribution: every warning based on Web Risk shows Advisory provided by Google, linked to Google's advisory. Veritap adds it automatically on such findings only, in the app and on shared verdict pages. Do not remove it when you change the app.
- Notice that it is not perfect: Google's Service Specific Terms (section "Web Risk", cloud.google.com/terms/service-terms) ask for a conspicuous notice that the reliability and accuracy cannot be promised: some risky sites may not be identified, and some harmless sites may be identified in error. The linked advisory says this, and every Web Risk finding says the list may be wrong. Repeat it in your own terms and privacy policy.
- Wording: Google's user-warning guidelines ask never to call a flagged page definitely unsafe. The finding texts use "may", "suspected" and "possibly"; keep that when you edit them.
- Fresh answers: a warning may only rest on an answer that has not passed its expiry time. The cache follows this.
03Get a key
- Open the Google Cloud console and create a project (or pick one), with billing set up.
- Enable the Web Risk API under APIs and services, Library.
- Create an API key under APIs and services, Credentials. Restrict the key to the Web Risk API.
04Switch it on
- Console, Link reputation (Web Risk): turn on Use Web Risk and paste the API key.
- Press Test connection. It looks up the test page Google documents for this purpose, once.
05Cost
Billed to your Google Cloud account. As read on 12 November 2026 on Google's Web Risk pricing page: no charge up to 100,000 lookups a month, then $0.50 per 1,000. One checked link uses one or two lookups (the address and where it leads). Check the pricing page before you launch.