Google Safe Browsing

Overview

Google Safe Browsing lets you check URLs against Google’s malware/phishing blocklists. Auth is a Google API key.

Note (verified 2026-08): the v4 endpoint (/v4/threatMatches:find) returned HTTP 404 in our test — Google has moved to Safe Browsing v5 (API key can be passed as a key query param or the endpoint moved to /v5/). Consult the current docs (developers.google.com/safe-browsing) for the v5 migration.

Quick Start

V5 style (replace YOUR_KEY):

curl "https://safebrowsing.googleapis.com/v5/threatMatches:find?key=YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "client": { "clientId": "your-app", "clientVersion": "1.0" },
    "threatInfo": {
      "threatTypes": ["MALWARE", "SOCIAL_ENGINEERING"],
      "platformTypes": ["ANY_PLATFORM"],
      "threatEntryTypes": ["URL"],
      "threatEntries": [{ "url": "http://example.com/malware.exe" }]
    }
  }'

{
  "matches": [
    { "threatType": "MALWARE", "platformType": "ANY_PLATFORM", "threat": { "url": "http://example.com/malware.exe" } }
  ]
}

Authentication

• Get a key in Google Cloud Console → APIs & Services → enable Safe Browsing API.
• Send it as the key query parameter.

Rate Limits & Notes

• Free tier: generous daily quotas (check the console); usage beyond is billed.
• Threat types: MALWARE, SOCIAL_ENGINEERING, UNWANTED_SOFTWARE, POTENTIALLY_HARMFUL_APPLICATION.
• v5 is the current API — v4 endpoints may 404 (verified 2026-08).

FAQ

Is Safe Browsing free? Free tier with daily quotas; more is billed.

Why does v4 404? Google moved to Safe Browsing v5 (verified) — use the /v5/ paths.

How do I get a key? Google Cloud Console → enable the Safe Browsing API.