What Is Web Risk?
Web Risk is an enterprise security product from Google Cloud. Client applications use it to check URLs against Google’s constantly updated lists of unsafe web resources, covering phishing, deceptive sites, malware, and unwanted software.
The service is consumed through APIs. Depending on your requirements for latency, privacy, and integration effort, different access paths are available.
Core Capabilities
- Lookup API: direct server queries with the actual URL; simple to implement, but URLs are not hashed and are therefore visible to the server
- Update API: a local database of hashed URL lists that you download and periodically update; more setup effort, but better privacy and faster local lookups
- Submission API: reporting detected unsafe resources to Google
- Evaluate API: URL evaluation
- Constantly updated lists of unsafe web resources
- Documented procedures for URL hashing and for access control through IAM
Typical Use Cases
User-generated content: Forums, messengers, and marketplaces check submitted links before showing them to other users.
Communication products: Email and collaboration solutions check embedded links for phishing and malware.
Privacy-sensitive checks: With the Update API the checked URLs stay local, since the service works against hashed lists.
Feedback to Google: The Submission API lets you report unsafe resources you have identified.
Benefits
- Access to Google’s constantly updated lists of unsafe web resources
- Choice between simple integration (Lookup API) and stronger privacy (Update API)
- Fast local lookups when using the Update API
- Access control through IAM
- An external reputation source that complements your own security processes
Working with innFactory
As a certified Google Cloud Partner, innFactory supports you with Web Risk:
- API selection: weighing the Lookup API against the Update API based on your latency, privacy, and effort requirements
- Integration: embedding the check into your applications and processing paths
- Local database operation: building and refreshing the local copy when using the Update API
- Process design: handling misclassifications and reporting through the Submission API
Get in touch for a consultation on Web Risk and application security on Google Cloud.
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Web Risk?
Web Risk is an enterprise security product that lets your client applications check URLs against Google's constantly updated lists of unsafe web resources, including phishing, deceptive sites, malware, and unwanted software.
Which APIs are available?
The documentation lists four APIs - the Lookup API for checking URLs, the Update API for receiving updated threat data, the Submission API for reporting unsafe resources, and the Evaluate API for URL evaluation.
What is the difference between the Lookup API and the Update API?
The Lookup API queries the server directly with the actual URL. That is simple to implement, but the URLs are not hashed, so the server knows which URLs you look up, and each query adds latency. The Update API works against a local database of hashed lists that you download and periodically update. It requires more setup but offers better privacy and faster local lookups.
Which API suits privacy-sensitive use cases?
The Update API provides superior privacy because it maintains a local database of hashed lists instead of sending the checked URLs to the server.
How reliable are the results?
Google explicitly states that it cannot guarantee its information is comprehensive and error-free - some risky sites may not be identified, and some safe sites may be classified in error.
Can I report unsafe resources myself?
Yes. The Submission API is provided for reporting unsafe resources to Google.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Google Cloud (official documentation). This page does not represent an offer by Google Cloud.
