I have created a website using WordPress. After some days, Chrome is showing Deceptive site ahead warning. But Firefox, Opera, Edge don't show any warning.
I have added my site to Google Search Console. In Security Issues tab, it says No issues detected. But google chrome is still showing the warning.
How can I fix this issue? Is there a way to submit my site for a review?
UPDATE:
I followed this link provided by #scytale and followed the following steps. But it is still the warning.
Scan Website for Malware or Threat: I have scanned my website using Sucuri, ReScan, VirusTotal, and Quttera. None of the scans detected any malware in the website.
Install SSL Certificate Properly: I am using AutoSSL from cPanel Inc. If I click on the alert icon at the left of warning, it shows the certificate is valid. So I guess my SSL is okay.
Redirect the Website From HTTP to HTTPS (301 Redirections): I have enabled in just like the example they provided. All http requests are being redirected to https.
Remove Mixed Content Warning: I have tested each individual page and haven't found any Mixed content.
The issue is, google search console is not showing any warning. So there is not option to request a review. Is there any other way I can ask google for a review? What else can I do?
According to Google the warning appears when "The site you try to visit might be a phishing site." However, if this were the case I would have thought it would be identified in Google Search Console.
dZone (a reputable security site) says the warning can appear for these reasons:
your website contains malware i.e. you've been hacked. However as
Google and other browser don't report issue this is unlikely.
issues with your site's SSL certificate (for HTTPS requests) maybe
installed incorrectly or not issued by an "approved" certificate
authority
Website traffic is not redirected to HTTPS (for fix see dZone article)
Mixed Content warning i.e. your https page "includes" content
obtained by HTTP (no S) URLs e.g. images, CSS, your or 3rd party
scripts. However, I'm pretty sure some of my pages use 3rd party
http affiliate scripts and I don't get this warning.
To fix check these issues and correct accordingly.
Its some time since I've used search console/webmaster tools but if Google has completed indexing of all your pages I would have thought it would also identify issues like mixed content. N.B. https://example.com and http://example.com are treated as "different sites" and you have to select appropriately in console. This Chrome extension claims to identify causes of mixed content for you (I've not used and have no idea as to its reliability).
Edit following request from Zakaria
I've no personal experience of this but I've done a bit of Googling:
Does the warning also explain why site is "dangerous" e.g. does it mention Phishing?
If you provide your domain name in the question then someone maybe able to identify why. I may not have time to check quickly, but others might be better qualified than me to check and comment.
Do you trust the theme and plugins you are using on your site? Google them for issues.
Chrome safe browsing, as well as using downloaded lists of dodgy sites; also locally analyses the properties of each page you visit and if it thinks suspicious forwards to Google for further checking. In which case it may be possible to find out which part of the page or script Chrome finds suspicious. See this Chrome Help Page.
Enter your domain here to see if you are on a "Google Blacklist"
Is your domain name new to you? Perhaps it was used for Malwre/Phishing in the past?
Related
We run a website from where users can share pages on LinkedIn using the basic sharing URL https://www.linkedin.com/cws/share?url=https://THE_URL.
This worked without any problems for years, yet recently we are facing problems that we cannot explain. Some of our URLs can be shared, while others, pointing to very similar pages, fail.
All of our sharable pages are served from the same infrastructure, same servers, same setup, same TLS certificate, rendered from the same application, etc.
As an example, I attached screenshots for two pages, which are basically identical, except from a few very small details.
While https://open.sap.com/courses/fg1 can be shared,
Screenshot: A "Create a Post" widget on LinkedIn with correct page preview
the almost identical page https://open.sap.com/courses/fg1-1 can not be shared, the sharing widget shows an error:
Screenshot: A "Create a Post" widget on LinkedIn with error message in preview area
Additionally: since a while, both pages - fg1 as well as fg1-1 - cannot be opened in the LinkedIn Post Inspector - this worked earlier, there was no notable change on our side.
The error message in the post inspector says (for the page where actual sharing in the widget works):
Ingestion Feedback
Error We encountered a server error while trying to inspect the URL.
URL redirect trail
1 0 undefined https://open.sap.com/courses/fg1
Summarizing: I am quite confident that this is not an issue caused by our infrastructure or the application - otherwise I would expect that all pages resulted in the same error when sharing.
Does anyone else face this issue or did so in the past and found a solution?
Note: it feels a bit odd to post this question here instead of filing a support ticket, but I was told that this would be the way to reach out.
I'm having a few issues with making our site shareable on linked in and I'm at a loss. The og: meta tags all look fine, the facebook scraper picks it up fine, but the linkedIn scraper does not... and the img etc are not on a protected folder or anything like that.
When inspecting the developer tools the get request to the url-preview?url= link shows that the img etc.. aren't there.
The image is less than 1mb, all og: meta tags are obeyed. The only think that may not be 100% is the image ratio is not 1/4 or 4/1 (it's 2/1)... But that is only a recommendation and not a hard and fast rule.
Does LinkedIn provide something similar to FB (https://developers.facebook.com/tools/debug/) where you can test the scraper and re-run it? Or is there another way to debug this? Any help appreciated.
https://www.hipla.co.uk (is the page i'm trying to share).
cheers
It transpires linked in doesn't offer a similar facility to FB or twitter to test the OG meta tags and re-scrape the page. They cache a page for 7 days and then re-scrape again. However, you can refresh the linkedIn crawler cache simply by appending GET params to the URL, i.e. https://www.hipla.co.uk?123.
I eventually figured out what our issue was. We were using a wildcard cert (for multi domain, so we could have a single ssl cert for multiple subdomains) which meant we had to set the server name in the apache default-ssl.conf file, but we had a typo in it for the www instance ... which meant it gave an SSL error (for the linkedIn crawler) which isn't debuggable (if that's a word) using linkedIn but was spotted as we got an SSL error when testing the twitter metadata tags using the twitter card validator. Hope this helps anyone else who has a typo in their ssl settings. Note that the ssl error was not visible using a browser(s) as all looked fine.
I'm a new WordPress designer. My site runs Tesseract Theme and is built with Beaver Builder.
PROBLEM: When I post my website (https://louiseclark.tech) on Facebook it removed my site after a couple minutes. Now when I try to post my site it gives me this message--> It looks like a link you're sharing might be unsafe. If you can, please remove this link: louiseclark.tech Note: The unsafe link might be on the page you’re linking to.
What I've done to try and resolve:
When I ran my site through the Facebook debugger I got this message:
The 'fb:app_id' property should be explicitly provided, Specify the app ID so that stories shared to Facebook will be properly attributed to the app. Alternatively, app_id can be set in url when open the share dialog.
I created an app id following this instructional video: https://www.youtube.com/watch?v=V97h03H21y0
I pasted my app id into my Yoast SEO plugin under the Facebook category.
Check my Google Webmaster Tools Sitemap...all is verified and sitemap set.
SSL certificate is set - checked with my hosting company SiteGround. When I asked them about this problem they didn't really feel that the security issues where from their side.
I've reported this problem to the black hole that is Facebook support.
Thank you for any insight.
In case anyone sees this thread, I found the solution.
When I moved my WordPress sites to managed WordPress hosting I also migrated my websites to https with the SSL certificates. While the pages were migrated and displaying the https just fine, the images still held their old url (http).
I did two things:
I installed SSL Content Fixer plugin. This worked for some images but not others.
I installed Better Search Replace plugin. I had found the specific insecure images using Firefox. From my page in Firefox, I went to:
Tools -> Page Info -> Media This showed me every image/js/css call on this page. Finding these images allowed me to use the plugin to make the changes.
It worked. I'm quite sure knowing how to code my site would be much better in this situation. But I'm a newbie and this is what I could come up with.
What I learned: It's a flag when you have a secure site that embeds non secure objects/images.
Two days ago we posted a new blog on a site with the aim of being picked up for the search term "live comedy in chippenham". It’s been indexed by Google and we’re now 2nd in the results for the search query. The bad news is that for some reason the post has been indexed as a https URL so all browsers give a warning when the link is clicked.
Firefox gives this error:
The owner of www.neeld.co.uk has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.
The host has confirmed that it's not a server config error and we have other posts and pages on the site that are being indexed correctly. We're using WordPress and the Yoast plugin. I can't see anywhere in Webmaster Tools that could be causing the problem.
Can anyone offer any advice please? If you search Google for "live comedy in chippenham" you'll see the issue (it's the link https://www.neeld.co.uk/live-comedy-in-chippenham/)?
It's a really strange one but something I've experienced before.
It has mostly likely been caused by an external link to the page using https protocol which Google has followed before indexing the page. Google are very keen to index https pages at the moment so we might start seeing this kind of issue more often.
There's not a lot you can do other than wait for Google to realise their mistake and list the correct URL in the SERPS. You can help speed this along with a canonical link (which I can see is there), XML sitemap (which you've got) and a server level redirect of https to http.
Do not try to remove the page in Webmaster Tools as this won't have the desired effect and will stop Google reindexing the page properly.
Hope this helps.
An issue was brought to me involving malware on a WP environment. When I search the brand in Google and click the corresponding link, I'm redirected to a 3rd party spam site.
This has been happening for a while (over a week), but my site hasn't been put on Google's blacklist. Additionally, site scanners like , Norton Safeweb, etc. all claim the site isn't compromised.
Additional details:
I found and deleted some suspicious PHP eval() functions and then did a search and replace in my pages and database for any remaining code. After the site cleared into un-blacklisted status with Google I thought it was all over, ran updates and took numerous measures to protect the site from future infection.
However the issue still persists.
Were the nameservers ever changed by the malware or attackers? Google could have the wrong DNS information for your domain and thinks its hosted at said spam site? Resubmit your site to Google or report the issue to them to resolve (may also be resolved automatically next time Google tries to crawl your domain)?
It is a strange issue I have not seen before either, have you looked at your .htaccess file in the root directory? It is also possible that this has a rewrite condition that if the referrer is Google to redirect you to the spam site.
Solved this issue. At the time when this happened, this redirect attack was fairly new.
HTTP requests from visitors who passed referrer data from Google Search or Bing were being redirected, some of the time.
By targeting only those coming in from search, the webmaster or site owner is less likely to see the issue (until informed by a third party), while still manipulating a decent amount of the traffic (50% of traffic for most sites comes from search engines).
When I originally posted this question in 2012, this attack was new and because the redirect was being served server-side (directly in a lone PHP file, not via .htaccess), malware signatures from scanners didn't detect this.
Running Maldetect (with an updated database) was the best way to quarantine this issue and analyze the extent of the damage caused by malware.
This issue seems due to wp-vcd Malware that creates rogue WordPress admin users and injected spam links. I faced the similar issue and it got resolved after following these steps.
The files you should check for and delete:
wp-feed.php
wp-vcd.php
wp-tmp.php
Multiple copies of class.theme-modules.php, and
remove a bunch of code from the start of all the functions.php files.
For details you can find on this issue at following links...
https://wordpress.org/support/topic/wp-feed-php/
http://labs.sucuri.net/?note=2017-11-13
http://labs.sucuri.net/?note=2017-11-13