Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Manipulasi psikologis (phishing dan situs yang menipu)
Manipulasi psikologis adalah konten yang menipu pengunjung agar melakukan hal berbahaya, seperti
mengungkapkan informasi rahasia atau mendownload software. Jika Google mendeteksi bahwa situs Anda
berisi konten manipulasi psikologis, browser Chrome dapat menampilkan peringatan "Situs yang akan dibuka berisi penipuan"
saat pengunjung melihat situs. Anda dapat memeriksa apakah ada halaman di situs yang diduga
berisi serangan manipulasi psikologis dengan membuka laporan Masalah Keamanan di Search Console.
Serangan manipulasi psikologis terjadi saat pengguna web tertipu untuk melakukan tindakan
berbahaya online.
Ada berbagai jenis serangan manipulasi psikologis:
Phishing:
Situs menipu pengguna agar memberikan informasi pribadi mereka (misalnya sandi,
nomor telepon, atau nomor jaminan sosial). Dalam hal ini, konten berpura-pura berfungsi, atau terlihat dan
bernuansa, seperti entitas tepercaya — misalnya browser, sistem operasi, bank, atau pemerintah.
Konten penipuan: Konten ini mencoba menipu Anda agar melakukan
tindakan yang biasanya hanya dilakukan untuk entitas tepercaya — misalnya membagikan sandi, menghubungi dukungan
teknis, atau mendownload software. Selain itu, konten ini juga dapat berisi iklan yang menyampaikan pernyataan palsu bahwa software
perangkat sudah usang, sehingga meminta pengguna menginstal software yang tidak diinginkan.
Layanan pihak ketiga yang tidak diberi label dengan jelas:Layanan pihak ketiga
adalah pihak yang mengoperasikan situs atau layanan atas nama entitas lain. Jika Anda (pihak ketiga)
mengoperasikan situs atas nama pihak lain (pihak pertama) tanpa memberitahukan hubungan tersebut dengan jelas,
tindakan Anda dapat ditandai sebagai manipulasi psikologis. Misalnya, jika Anda (pihak pertama) menjalankan situs
amal yang menggunakan situs pengelolaan donasi (pihak ketiga) untuk menangani pengumpulan dana di
situs Anda, situs donasi tersebut harus secara jelas menyatakan diri sebagai platform pihak ketiga yang bertindak atas
nama situs amal Anda. Jika tidak, situs tersebut bisa dianggap sebagai manipulasi psikologis.
Google Safe
Browsing melindungi pengguna web dengan memperingatkan mereka sebelum membuka halaman yang terlibat dalam
manipulasi psikologis secara terus-menerus.
Halaman dianggap sebagai manipulasi psikologis jika:
Berpura-pura berfungsi, atau terlihat dan bernuansa seperti entitas tepercaya, misalnya perangkat atau browser Anda sendiri,
atau situs itu sendiri, atau
Mencoba menipu Anda agar melakukan tindakan yang biasanya hanya dilakukan untuk entitas tepercaya, misalnya membagikan
sandi, menghubungi dukungan teknis, atau mendownload software.
Manipulasi psikologis di konten tersemat
Manipulasi psikologis juga dapat muncul di konten tersemat di situs yang tidak berbahaya,
biasanya di iklan. Konten manipulasi psikologis tersemat merupakan pelanggaran kebijakan oleh halaman host.
Terkadang konten manipulasi psikologis tersemat akan terlihat oleh pengguna di halaman host, seperti
yang ditunjukkan pada contoh. Pada kasus lain, situs host tidak terang-terangan
menampilkan iklan, tetapi mengarahkan pengguna ke halaman manipulasi sosial melalui pop-up, pop-under,
atau jenis pengalihan lainnya. Dalam kedua kasus tersebut, jenis konten manipulasi psikologis tersemat semacam ini
akan berujung pelanggaran kebijakan oleh halaman host.
Tetapi saya tidak terlibat dalam manipulasi psikologis!
Konten manipulasi psikologis yang menipu dapat disertakan melalui resource tersemat di halaman, seperti
gambar, komponen pihak ketiga lainnya, atau iklan. Konten penipuan tersebut dapat menipu pengunjung situs
agar mendownload software yang
tidak diinginkan.
Selain itu, peretas dapat mengontrol situs yang tidak berbahaya dan menggunakannya untuk
menghosting atau mendistribusikan konten manipulasi psikologis. Peretas dapat mengubah konten situs tersebut
atau menambahkan halaman baru ke situs tersebut, biasanya dengan tujuan menipu pengunjung agar
mengungkapkan informasi pribadi seperti nomor kartu kredit. Anda dapat mengetahui apakah situs Anda telah
teridentifikasi sebagai situs yang menghosting atau mendistribusikan konten manipulasi psikologis dengan memeriksa
laporan Masalah Keamanan di Search Console.
Berikut contoh halaman yang terlibat dalam tindakan manipulasi psikologis:
Pop-up penipuan bermaksud menipu pengguna agar menginstal malware.Pop-up penipuan yang menyatakan ingin membantu pengguna mengupdate browser-nyaHalaman login Google palsu
Contoh iklan penipuan
Berikut beberapa contoh konten penipuan dalam iklan tersemat. Iklan ini sekilas tampak seperti bagian
antarmuka halaman, bukan iklan.
Pop-up penipuan yang menyatakan bahwa software pengguna sudah usang.Pop-up penipuan yang menyatakan diri berasal dari developer FLVIklan yang menyamar sebagai tombol tindakan halaman.
Memperbaiki masalah
Jika situs Anda dilaporkan karena berisi manipulasi psikologis (konten penipuan), pastikan dahulu
halaman Anda tidak terlibat dalam semua tindakan tersebut, lalu ikuti langkah-langkah berikut:
Periksa
laporan Masalah Keamanan
untuk melihat apakah situs Anda dianggap berisi konten penipuan (istilah
pelaporan untuk manipulasi psikologis). Jika laporan berisi contoh URL yang ditandai, buka
beberapa URL yang tercantum dalam laporan, tetapi gunakan komputer di luar jaringan
yang menayangkan situs Anda (peretas cerdik dapat menonaktifkan serangannya jika mengetahui
pengunjung situs adalah pemilik situs).
Jika laporan tidak berisi contoh URL dan Anda yakin bahwa situs Anda tidak berisi
manipulasi psikologis (konten penipuan),
minta peninjauan keamanan
di laporan Masalah Keamanan.
Hapus konten penipuan. Pastikan tidak ada halaman situs yang berisi
konten penipuan. Jika Anda yakin fitur Safe Browsing telah salah mengklasifikasikan halaman web,
laporkan kesalahan tersebut.
Periksa resource pihak ketiga yang disertakan di situs Anda. Pastikan iklan, gambar, atau
resource pihak ketiga tersemat lainnya di halaman situs Anda bukan konten penipuan.
Perlu diperhatikan bahwa jaringan iklan dapat merotasi iklan yang ditampilkan di halaman situs Anda. Oleh karena itu, Anda
mungkin perlu memuat ulang halaman beberapa kali sebelum dapat melihat kemunculan iklan
manipulasi psikologis apa pun.
Beberapa iklan dapat muncul secara berbeda di perangkat seluler dan komputer desktop. Anda dapat menggunakan
Alat
Inspeksi URL untuk melihat situs Anda dalam tampilan seluler dan desktop.
Ikuti panduan layanan pihak ketiga untuk layanan pihak ketiga apa pun,
seperti layanan pembayaran, yang digunakan di situs Anda.
Minta peninjauan. Setelah menghapus semua konten manipulasi psikologis dari situs, Anda dapat
meminta peninjauan keamanan
di laporan Masalah Keamanan. Proses peninjauan dapat berlangsung beberapa hari.
Panduan layanan pihak ketiga
Jika Anda menyertakan layanan pihak ketiga di situs Anda, sebaiknya Anda memenuhi persyaratan berikut
agar situs tidak dianggap sebagai manipulasi psikologis:
Di setiap halaman, situs pihak ketiga sebaiknya mencantumkan brand-nya dengan jelas sehingga
pengguna memahami siapa pihak yang menjalankan situs itu. Misalnya, dengan mencantumkan
brand pihak ketiga di bagian atas halaman.
Pada setiap halaman yang memuat brand pihak pertama, nyatakan dengan jelas hubungan antara
pihak pertama dan pihak ketiga, serta sediakan link untuk mendapatkan informasi selengkapnya. Misalnya, pernyataan
seperti ini:
Layanan ini dihosting oleh Example.com atas nama Example.charities.com. Informasi
selengkapnya.
Sebagai panduan kegunaan yang baik, pastikan pengguna yang melihat halaman tersebut secara terpisah selalu memahami situs
mana yang sedang mereka kunjungi dan hubungan antara pihak pertama dan pihak ketiga.
Jika Anda adalah pengguna Search Console dan mengalami masalah keamanan yang terus berlanjut atau tidak dapat diperbaiki di situs, Anda dapat memberi tahu kami.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Informasi yang saya butuhkan tidak ada","missingTheInformationINeed","thumb-down"],["Terlalu rumit/langkahnya terlalu banyak","tooComplicatedTooManySteps","thumb-down"],["Sudah usang","outOfDate","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Masalah kode / contoh","samplesCodeIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-04 UTC."],[[["\u003cp\u003eSocial engineering attacks trick users into revealing personal information or performing dangerous actions, often by impersonating trusted entities.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Safe Browsing protects users by displaying warnings for websites identified as engaging in social engineering practices.\u003c/p\u003e\n"],["\u003cp\u003eWebsite owners can use Search Console's Security Issues report to identify and resolve social engineering issues on their sites.\u003c/p\u003e\n"],["\u003cp\u003eEmbedding third-party content, like ads, can introduce social engineering risks if the content is deceptive or leads to malicious pages.\u003c/p\u003e\n"],["\u003cp\u003eWebsites using third-party services should clearly disclose the relationship to avoid being mistakenly flagged as social engineering.\u003c/p\u003e\n"]]],["Social engineering tricks users into dangerous actions, like revealing personal data or downloading harmful software. This can occur through phishing, deceptive content, or unclear third-party services. Websites with such content may trigger browser warnings. Site owners should check the Security Issues report in Search Console for violations. Actions include removing deceptive content, ensuring third-party resources are not deceptive, and requesting a security review. Clear labeling of third-party involvement is crucial to avoid being flagged.\n"],null,["# Social Engineering (Phishing and Deceptive Sites) | Google Search Central\n\nSocial engineering (phishing and deceptive sites)\n=================================================\n\nSocial engineering is content that tricks visitors into doing something dangerous, such as\nrevealing confidential information or downloading software. If Google detects that your website\ncontains social engineering content, the Chrome browser may display a \"Deceptive site ahead\"\nwarning when visitors view your site. You can check if any pages on your site are suspected of\ncontaining social engineering attacks by visiting the Security Issues report in Search Console.\n\n[Open\nthe Security Issues Report](https://search.google.com/search-console/security-issues)\n\nWhat is social engineering?\n---------------------------\n\nA *social engineering attack* is when a web user is tricked into doing something\ndangerous online.\n\nThere are different types of social engineering attacks:\n\n- **[Phishing](https://support.google.com/websearch/answer/106318):** The site tricks users into revealing their personal information (for example, passwords, phone numbers, or social security numbers). In this case, the content pretends to act, or looks and feels, like a trusted entity --- for example, a browser, operating system, bank, or government.\n- **Deceptive content:** The content tries to trick you into doing something you'd only do for a trusted entity --- for example, sharing a password, calling tech support, downloading software, or the content contains an ad that falsely claims that device software is out-of-date, prompting users into installing unwanted software.\n- **Insufficiently labeled third-party services:** A *third-party service* is someone that operates a site or service on behalf of another entity. If you (third party) operate a site on behalf of another (first) party without making the relationship clear, that might be flagged as social engineering. For example, if you (first party) run a charity website that uses a donation management website (third party) to handle collections for your site, the donation site must clearly identify that it is a third-party platform acting on behalf of that charity site, or else it could be considered social engineering.\n\n[Google Safe\nBrowsing](https://www.google.com/transparencyreport/safebrowsing) protects web users by warning users before they visit pages that consistently\nengage in social engineering.\n\nWeb pages are considered social engineering when they either:\n\n- Pretend to act, or look and feel, like a trusted entity, like your own device or browser, or the website itself, or\n- Try to trick you into doing something you'd only do for a trusted entity, like sharing a password, or calling a tech support number, or downloading software.\n\n### Social engineering in embedded content\n\nSocial engineering can also show up in content that is embedded in otherwise benign websites,\nusually in ads. Embedded social engineering content is a policy violation for the host page.\n\nSometimes embedded social engineering content will be visible to users on the host page, as\nshown in the [examples](#example). In other cases, the host site does not contain\nany visible ads, but leads users to social engineering pages via pop-ups, pop-unders, or other\ntypes of redirection. In both cases, this type of embedded social engineering content will\nresult in a policy violation for the host page.\n\nBut I don't engage in social engineering!\n-----------------------------------------\n\nDeceptive social engineering content may be included via resources embedded in the page, such\nas images, other third-party components, or ads. Such deceptive content may trick site visitors\ninto downloading [unwanted\nsoftware](https://www.google.com/about/unwanted-software-policy.html).\n\nAdditionally, **hackers** can take control of innocent sites and use them to\nhost or distribute social engineering content. The hacker could change the content of the site\nor add additional pages to the site, often with the intent of tricking visitors into parting\nwith personal information such as credit card numbers. You can find out if your site has been\nidentified as a site that hosts or distributes social engineering content by checking the\nSecurity Issues report in Search Console.\n\nSee our [Help\nfor Hacked Sites](https://web.dev/articles/hacked) if you believe that your site has been hacked.\n\nExamples of social engineering violations\n-----------------------------------------\n\n### Deceptive content examples\n\nHere are some examples of pages that engage in social engineering practices:\n\n\u003cbr /\u003e\n\nDeceptive popup intended to trick the user into installing malware.\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nDeceptive popup claiming to help the user update their browser\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nFake Google login page\n\n\u003cbr /\u003e\n\n| Note the deceptive URL. Other phishing sites like this could trick you into giving up other personal information such as credit card information. Phishing sites may look exactly like the real site---so be sure to look at the address bar to check that the URL is correct, and also check to see that the website begins with `https://`.\n\n### Deceptive ad examples\n\nHere are some examples of deceptive content inside embedded ads. These ads appear to be part\nof the page interface rather than ads.\n\n\u003cbr /\u003e\n\nDeceptive popup claiming that the user's software is out of date.\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nDeceptive popup claiming to come from the FLV developer\n\n\u003cbr /\u003e\n\n\u003cbr /\u003e\n\nAds masquerading as page action buttons.\n\n\u003cbr /\u003e\n\nFixing the problem\n------------------\n\nIf your site is flagged for containing social engineering (deceptive content), ensure that\nyour page doesn't engage in any of the [practices](#examples), and then follow these steps:\n\n1. **Check in Search Console** .\n - [Verify that you own your site in Search Console](https://support.google.com/webmasters/answer/2739618) and that no new, suspicious owners have been added.\n -\n Check the\n [Security Issues report](https://search.google.com/search-console/security-issues)\n to see if your site is listed as containing deceptive content (the\n reporting term for social engineering). If the report contains sample flagged URLs, visit\n some of those URLs listed in the report, but use a computer that's not inside the network\n that is serving your website (clever hackers can disable their attacks if they think the\n visitor is a website owner).\n\n\n If the report doesn't contain sample URLs and you're confident your site doesn't contain\n social engineering (deceptive content),\n [request a security review](https://support.google.com/webmasters/answer/9044101#fix)\n in the Security Issues report.\n2. **Remove deceptive content** . Ensure that none of your site's pages contain deceptive content. If you believe Safe Browsing has classified a web page in error, [report it](https://www.google.com/safebrowsing/report_error/).\n3. **Check the third-party resources included in your site** . Ensure that any ads, images, or other embedded third-party resources on your site's pages are not deceptive.\n - Note that ad networks may rotate the ads shown on your site's pages. Therefore, you might need to refresh a page a few times before you're able to see any social engineering ads appear.\n - Some ads may appear differently on mobile devices and desktop computers. You can use the [URL\n Inspection tool](https://support.google.com/webmasters/answer/9012289) to view your site in both mobile and desktop views.\n - Follow the [third-party service guidelines](#third-party-guidelines) for any third-party services, such as payment services, that you use in your site.\n4. **Request a review** . After you remove all social engineering content from your site, you can [request a security review](https://support.google.com/webmasters/answer/9044101#fix) in the Security Issues report. A review can take several days to complete.\n\n### Third-party service guidelines\n\nIf you include a third-party service in your site, we recommend that you meet the following conditions\nin order to avoid being labeled as social engineering:\n\n- On every page, the third-party site clearly includes the third-party brand in a way that ensures users understand who is operating the site. For example, by including the third-party brand at the top of the page.\n- On every page that contains first-party branding, explicitly state the relationship between the first and third party, and provide a link for more information. For example, a statement like this: *This service is hosted by Example.com on behalf of Example.charities.com. More\n information.*\n\nA good usability guideline is whether a user viewing the page in isolation understands which\nsite they are on, and the relationship between the first and third party at all times.\n| **Best practice:** If you need a third party to perform a basic support service for your site, a best practice is to use an industry standard third party for that service. For example, to manage user authentication on your site, use [OAuth](https://oauth.net/) rather than managing authentication yourself.\n\nIf you're a Search Console user and are having trouble with persistent or unfixable security issues on your site, you can let us know.\n\n[Report a security issue](https://support.google.com/webmasters/contact/report_security_issues)"]]
