Unsafe site warnings on Authentik reddit / selfhosted ---------------------------------------------------------------------- PassTheSaltPlease123 · 2023-10-02 17:08 Hi, I setup Authentik for my home services (Nextcloud, Immich etc) last week and the next day I started getting "This site has been reported as unsafe" with the bright red background on all major browsers. I suppose it got added to the malicious website database maintained by Google. I can't think of any reason of why or even how this is possible. ​ Has anyone experienced this before? I submitted "not a malicious website" report a few times but that's about it. Is there a way to get it removed? ---------------------------------------------------------------------- thekrautboy · 2023-10-02 17:22 https://www.reddit.com/r/selfhosted/search?q=unsafe&restrict_sr=on&inc lude_over_18=on&sort=relevance&t=all ---------------------------------------------------------------------- MeudA67 · 2023-10-02 18:59 I posted something similar earlier this year, after the third or fourth occurence of it happenning to me: [https://www.reddit.com/r/hom elab/comments/1396oi7/deceptive\_site\_ahead/](https://www.reddit.com/ r/homelab/comments/1396oi7/deceptive_site_ahead/) You have to go to the Google Search Console ([https://search.google.com/search- console](https://search.google.com/search-console)) and request review. Tell you fixed the issues, and that these services are only used by you. Now...I have not had an issue since this post. Here is what I think has resolved it: Do not use almost "legit" names for your subdomains! I had [nextcloud.xxx.com](https://nextcloud.xxx.com), [immich.xxx.com](https://immich.xxx.com), [cockpit.xxx.com](https://cockpit.xxx.com) ... etc. I renamed all my subdomains to some very unique names, so that it doesn't look like I am trying to impersonate the real websites, and I have not had any issue since! Just my theory...but worked for me (unless I just jinxed myself!) ---------------------------------------------------------------------- carl2187 · 2023-10-02 19:26 Use Firefox. Problem solved as they don't reference Googles garbage database of "bad" sites. Chrome is NOT a web browser nor a HTTP client. It's a Google service launcher, that can browse to some web sites as an added feature. ---------------------------------------------------------------------- PassTheSaltPlease123 · 2023-10-02 19:41 I am using Firefox. They do use Google database to track malicious sites. I had to install Chrome just to test it out. > In these cases, Firefox will submit some information about the file, including the name, origin, size and a cryptographic hash of the contents, to the Google Safe Browsing service which helps Firefox determine whether or not the file should be blocked. https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware- protection-work#w_how-does-phishing-and-malware-protection-work-in- firefox ---------------------------------------------------------------------- PassTheSaltPlease123 · 2023-10-02 19:43 I had a bunch of directly exposed sites but never got that warning. However the only difference this time is I used a wildcard certificate. ---------------------------------------------------------------------- clubsilencio2342 · 2023-10-02 20:56 Had this happened to me over the weekend, literally Saturday night. I've had authentik for a while, so I'm not sure what prompted it this weekend. I sent an appeal through their form explaining that it's just a self hosted domain and the next day, it just started working again. You'll get it back IMO but it may take a solid 24 ---------------------------------------------------------------------- Familiar-Newspaper23 · 2023-10-03 00:39 same - im using a wildcard right now for calibre.blahbittyblah.com and airsonic.blahbittyblah.com and the like and haven't ever had an issue with it...certs were done with certbot, using haproxy as a reverse proxy, and thus far alls well in blahbittyblah-land ---------------------------------------------------------------------- Familiar-Newspaper23 · 2023-10-03 00:40 then again, i AM using googles dns service as well though so perhaps that keeps me on their nice list...? i have no idea how that works tbh... ---------------------------------------------------------------------- AviationAtom · 2023-10-03 01:07 You're positive someone didn't somehow get into your network and configure it to serve up some type of malicious content? ---------------------------------------------------------------------- usa_commie · 2023-10-03 18:28 Lol ---------------------------------------------------------------------- ookerberry · 2023-10-12 15:17 I've had the same issue. I'm using authentik as traefik middleware to protect access to self-hosted services. I've had the site flagged and filed a request for review and 10+ days later it has not been removed. What is it about authentik that is causing it to get flagged? Does anyone know how to avoid getting flagged? ---------------------------------------------------------------------- cac2573 · 2023-10-18 02:31 Just ran into this as well. Wildcard DNS record + Authentik + LetsEncrypt certs.