4

Some users have reported this error generated by Windows Defender SmartScreen in the MS Edge browser. No problems in the other browsers. Here's a screenshot of the error:

Potentially unsafe content error - screenshot

It's been reported by some users when they are in the add new post page or when they're editing an existing page. Unfortunately I've never been able to replicate it. Our site has SSL but when this error occurs, instead of the lock in the address bar there's a unsafe website red text.

Has anyone faced the same issue? Please share what can be done to fix it.

Improve this question
3
  • Do you have any images or other content on a different domain (read: non-https) on that page? – Ivo van der Veeken Sep 1 '17 at 14:21
  • 1
    Could you post a screenshot of the "show unsafe content" page? – Ivo van der Veeken Sep 1 '17 at 14:27
  • Are you serving any 3rd party ad networks on your site? These can be a (common) source of malicious content. – MrWhite Sep 9 '17 at 0:00
1

I have not experienced this issue before, so I don't know how effective this will be, but from MS (8th question down) it appears you can just click "Report as Safe".

Improve this answer
3
  • 1
    That may be true, but it isn't ideal as a user experience for visitors to your website. – Steve Sep 3 '17 at 0:56
  • Agreed 100%. Was just offering the only option I was able to find. I suspect once you whitelist the domain, it's fine from then on, so perhaps a group policy could add the site in question to the Defender Exclusion list. If this is a public site, not sure how you would accomplish this without the users clicking "Report as Safe" once. – Dallas Sep 6 '17 at 22:28
  • I've informed all users who've reported this to me to click on "Report as Safe". They did that about 3 times in a week, after which I haven't got any reports of this error reoccurring. It's possible that it was a false positive from Windows Defender SmartScreen. Since the error hasn't reoccurred for me (in the past month) and there are no other useful answers, I will have to assume "Report as Safe" is what fixed it, albeit after some attempts and a few days. – sgr12 Sep 27 '17 at 12:49
1

Since your site is using HTTPS, according to what you said above, this means that some of the content being loaded into the browser is being loaded over HTTP instead of HTTPS (aka mixed content). This can be used to compromise the session, which is why it is saying it is unsafe.

To fix this, you will need to make sure that all content is loaded over HTTPS. There are a lot of WordPress plugins that load JavaScript and/or CSS hosted by the plugin developers over HTTP, so I'd start there. You may have to remove the plugin with that issue. You can view what is loaded in page by using the Chrome Developer Tools, or Firebug in Firefox.

Improve this answer
2
  • 1
    The OP doesn't appear to be getting a "mixed content" warning? This would be easy to replicate and would affect all browsers, not just MS Edge? The reported error seems to be generated by "Windows Defender SmartScreen". – MrWhite Sep 8 '17 at 23:49
  • @MrWhite is right. Mixed content warnings are different and are visible in other browsers. I did not have any content being loaded over HTTP instead of HTTPS. – sgr12 Sep 27 '17 at 12:41
0

I just started to get this error, too. The message appeared in my Wordpress Admin site. I am running Wordfence so I've asked them about it. So far they gave wrong response.

I searched for the URL you can use to solve the problem, but I can't find it using Google. But you can find the URL as follows:

The way to get this message to disappear is to go to your site where the message "unsafe site" appears, and click on the "unsafe site" message shown below.

enter image description here

You will get a dropdown (which I couldn't capture, but it is shown in one of the previous answers to this question). One of the choices is "report as safe."

Click "report as safe," which will take you to a Microsoft URL to solve the issue. You have to fill out a form so Microsoft can check your site out and get back to you.

You need to supply items such as your privacy message to users, what info you collect from them, etc. These things are required by the form.

The message about the site being unsafe remains on the site while they are checking it AND for 24 hours after they decide your site is okay. I sent this link from stackexchange to Microsoft as part of my response and asked them to fix the problem because it wastes a LOT of time on the site owner's part. I also did not provide my privacy statement. I explained that the site they are saying is unsafe is just my Wordpress admin site, so they fixed the problem and the "unsafe" message was removed.

Improve this answer
2
  • 1
    This will not fix the issue for everyone, just yourself. It also just clears the error, it doesn't address the actual issue. – tacotuesday Sep 8 '17 at 22:22
  • 1
    So, you're saying this is a false-positive from "Windows Defender"? This is going to be a bit tricky for the site owner to "fix", since the site owner appears to be unable to replicate it? "it is shown in one of the previous answers to this question" - which answer, what question? – MrWhite Sep 8 '17 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.