search

matomo-org / matomo

Empowering People Ethically with the leading open source alternative to Google Analytics that gives you full control over your data. Matomo lets you easily collect data from websites & apps and visualise this data and extract insights. Privacy is built-in. Liberating Web Analytics. Star us on Github? +1. And we love Pull Requests!
https://matomo.org/
GNU General Public License v3.0
19.85k stars 2.65k forks source link

Document how to troubleshoot when the Matomo instance is showing a warning Chrome due to being added to safe browsing list (or other reasons) #20246

Open gvo-exante opened 1 year ago

gvo-exante commented 1 year ago

trying to open my website, where Matomo code installed and here is what it shows: image

after deleting Matomo code, everything works okay.

MatomoForumNotifications commented 1 year ago

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/chrome-displaying-red-screen-saying-deceptive-site-ahead/49178/5

peterbo commented 1 year ago

This is more likely caused by bad IP address reputation (checked with https://scamalytics.com). The reported instances both have scam / fraud scores > 70

Findus23 commented 1 year ago

This looks a lot like your Matomo domain is on the google safe browsing list. You can check here: https://transparencyreport.google.com/safe-browsing/search

And report an incorrectly blocked site here: https://safebrowsing.google.com/safebrowsing/report_error/?hl=en

sgiehl commented 1 year ago

@sandrocantagallo Did someone from Google tell you that you need to remove the tracking to be removed from safe browsing list, or is that an assumption from yourself?

sgiehl commented 1 year ago

Is maybe the domain of the matomo instance on the safe browsing list, causing all sites using that instance to land on the list as well?

sgiehl commented 1 year ago

I'm unfortunately not deep enough into that topic to provide a solution. Also I doubt there is much we can do in the code to solve that issue. Maybe someone else has an idea here...

FredBl79 commented 1 year ago

Just installed Matomo on a sub domain of my plex....same issue as yours. I had inactivated the sub domain and deactivated the plugin WP matomo....only by this way the red flag is removed by Google. So it is really due to the script loading matomo.js which is sensitive for Google :(

Finally how can you enable matomo ??? I don't understand if it feasible to use it if google is blocking automatically....

mattab commented 1 year ago

Here I think we would want to create a FAQ to explain how to troubleshoot this use case: imagine your Matomo instance has this problem suddenly, then you expect Matomo to have an FAQ to clearly explain why, the next steps on what to do.

Re-opening and renaming issue to restrict scope.

heurteph-ei commented 1 year ago

Hi @mattab Isn't Google transgress anti-monopoly laws? By doing like they do, they prevent companies to switch form GA to Matomo on premise...

mattab commented 1 year ago

So far we have no evidence that there is an issue with this, so we would want to document to the rare people who have an issue like this, how to learn more about the issue. Then in the FAQ we could mention they can reach out to us if they still don't know / understand. Then we could learn if there are some strange things happening. But hopefully not.

FredBl79 commented 1 year ago

I don't know if that can help but on my side, after the matomo deployment, I also installed GA extension in order to retrieve my GA3 data to matomo . By this way, I received an alert email from Google just before the warning page.

I stopped the GA import, deactivate the WordPress plugins and automatically my site was again visible. I requested google to analyse my website and 2 days after I received a clear answer. So I reactivates matomo plugin to track data....no more issue.... everything is ok since 2 weeks

Cross the fingers ! Fred

vlakam commented 1 year ago

Last friday google marked my site with self-hosted Matomo analytics as fraud. Classic red banner. Removed Matomo script at saturday and today (monday) everything is okay. Unlucky, gonna migrate to another analytics provider.

heurteph-ei commented 1 year ago

Hi @vlakam The problem doesn't come from Matomo but from Google, some kind of monopolistic behavior coming from monopolistic company... Did you try the workaround suggested by Sandro Cantagalo / Eternity6 in the Matomo forum:

  • The first step is to disable matomo on all portals where there is a tracking code.
  • The second step is to go to Google Search Console → Security Issues → Request review for the portal indicating in the notes that it is a Matomo installation
  • The third step is to wait for google to remove the red flag on the domain where matomo is installed.
  • The fourth step is to put Matomo on upkeep and leave it upkeep all the time. It will continue to track but at least Google won’t see the portal even though the robots.txt file was supposed to keep Google away
  • The fifth point is to reactivate all tracking codes

At this point we just need to cross our fingers and hope that Google doesn’t put the red flag back on the domain

See: https://forum.matomo.org/t/chrome-displaying-red-screen-saying-deceptive-site-ahead/49178/9

vlakam commented 1 year ago

@heurteph-ei Understandable. But i can't afford this risk. Another analytics platform (not GA) does not trigger google warning so i stick with them at the moment

jamesmpetry commented 1 year ago

I just had this issue happen twice. I did a review request and everything was going well for about five weeks and then the red screen came back. Unfortunately I don't see a legit way to put this code on cleints' sites without doing a server to server implementation. Unless anyone else here has some ideas.

CyrPen commented 1 year ago

Same Red page after one month without troubles. How do you put Matomo in maintenance mode ?

heurteph-ei commented 1 year ago

Hi @CyrPen. Here is the doc: https://matomo.org/faq/how-to/faq_111/

CyrPen commented 1 year ago

Thank U @heurteph-ei,

i finally found an issue by :

  1. Commenting Matomo scripts from all websites to make them work again (hopefully my Matomo installation was on his own server, so only the Matomo server was red flagged)
  2. Declaring @Google my server was not dangerous but a Matomo analytics installation : https://safebrowsing.google.com/safebrowsing/report_error/
  3. waiting a few hours for my Matomo server work again
  4. Reactivating Matomo scripts
  5. Crossing fingers

Regards, CyrPen

MatomoForumNotifications commented 1 year ago

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/chrome-displaying-red-screen-saying-deceptive-site-ahead/49178/20

boxcleverliam commented 1 year ago

Same issue here. Interested to find out why Google flags these as deceptive.

Is it because of something in the Matomo web interface, and therefore all instances are likely to get flagged? (Google Search Console reported that the index.php URL was flagged)

Or is it because the tracking code tracks sensitive information?

If it’s very common, maybe it should be part of the installation / setup instructions to set up Google Search Console to monitor it.

boxcleverliam commented 1 year ago

I think that the Matomo login page looks identical for everyone. This could be seen as suspicious by Google. Maybe outputting the name of the current domain in the page content, or an option to set your own logo, would make all instances look unique and potentially less suspicious.

MatomoForumNotifications commented 1 year ago

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/le-site-web-que-vous-allez-ouvrir-est-trompeur/51178/3

MatomoForumNotifications commented 1 year ago

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/chrome-displaying-red-screen-saying-deceptive-site-ahead/49178/29

MatomoForumNotifications commented 1 year ago

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/site-dangereux/51175/6

MatomoForumNotifications commented 1 year ago

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/chrome-displaying-red-screen-saying-deceptive-site-ahead/49178/32

MatomoForumNotifications commented 11 months ago

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/dato-visitatori-unici-non-tracciato-correttamente-utilizzando-il-lettore-logs-di-apache-import-logs-py/54005/3

shekhov commented 9 months ago

The same issue happened to me today. I've just finished the installation and placed the instance on subdomain of the website that I have in Google Search Console. A day later I come and see that my website have phishing and deceptive pages issues.

jcmundy commented 5 months ago

Has any progress been made on this? We've been only using Pixel tracking with our on-premise, as our installation was repeatedly flagged by Google when we were trying to use javascript during setup.

MatomoForumNotifications commented 2 months ago

This issue has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/security-problem/59247/2