# Vaultwarden flagged as unsafe by Google

**URL:** <https://vaultwarden.discourse.group/t/vaultwarden-flagged-as-unsafe-by-google/967>\
**Category:** Help\
**Created:** [June 27, 2021, 10:42am UTC](https://vaultwarden.discourse.group/t/vaultwarden-flagged-as-unsafe-by-google/967 "2021-06-27T10:42:45Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![qwasy](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/qwasy/32/362_2.png) [@qwasy](https://vaultwarden.discourse.group/u/qwasy)\
**Post date:** [June 27, 2021, 10:42am UTC](https://vaultwarden.discourse.group/t/vaultwarden-flagged-as-unsafe-by-google/967/1 "2021-06-27T10:42:45Z")

</div>

Hi there.  
I’m hosting vaultwarden on a VPS, but google flags the website as unsafe, for potential phishing.  
I’m using docker-compose with caddy, just like here:[Using Docker Compose · dani-garcia/vaultwarden Wiki · GitHub](https://github.com/dani-garcia/vaultwarden/wiki/Using-Docker-Compose)  
I have a DNS from [Dynv6.com](http://Dynv6.com), which I point towards my VPS IP.  
Caddy itself is working, only Chrome is flagging the site. Firefox doesn’t complain.

![image](https://global.discourse-cdn.com/free1/uploads/vaultwarden/original/1X/e07a88ae35ef9f826a77a0dc2dc86005d96e59a0.png)

Vaultwarden works fine, the addons can connect, websockets and logins are working.

I also submitted my url to googles safe browsing for reviewing, but nothing changed.

Is there anything wrong with my setup? Or anyway how I can fix it?  
Thanks^^

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [June 27, 2021, 11:09am UTC](https://vaultwarden.discourse.group/t/vaultwarden-flagged-as-unsafe-by-google/967/2 "2021-06-27T11:09:13Z")

</div>

Google Safe Browsing works via URL/Domains.  
So, it seems your domain, or part of the domain is flagged by it.

---

<div class="post-metadata">

**Author:** ![qwasy](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/qwasy/32/362_2.png) [@qwasy](https://vaultwarden.discourse.group/u/qwasy)\
**Post date:** [June 27, 2021, 11:10am UTC](https://vaultwarden.discourse.group/t/vaultwarden-flagged-as-unsafe-by-google/967/3 "2021-06-27T11:10:37Z")

</div>

Crap^^  
Probably, because it’s free…  
I will search for a better one, or live with the flagged issue.  
Thanks^^

---

<div class="post-metadata">

**Author:** ![juanbretti](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/juanbretti/32/959_2.png) [@juanbretti](https://vaultwarden.discourse.group/u/juanbretti)\
**Post date:** [July 12, 2023, 9:24pm UTC](https://vaultwarden.discourse.group/t/vaultwarden-flagged-as-unsafe-by-google/967/4 "2023-07-12T21:24:23Z")

</div>

Does anyone have a solution to this?  
I have been reporting my domain as being legit… But no answer yet from **Google**.

Looks like this issue with the URL from the icons should happen to anyone.  
It is also listed at **Bitwarden** : [Privacy when using Website Icons | Bitwarden Help Center](https://bitwarden.com/help/website-icons/)

Is there any way to “encrypt” the URL so Google does not complain anymore?  
Something to change:

`https://mypersonalvault.mydomain.com/icons/us1a.app.anaplan.com/icon.png`

To something like:

`https://mypersonalvault.mydomain.com/icons/dXMxYS5hcHAuYW5hcGxhbi5jb20=/icon.png`  
(maybe Base64 encode)

Thanks!  
(and sorry for bringing back an old thread)

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [July 13, 2023, 3:52pm UTC](https://vaultwarden.discourse.group/t/vaultwarden-flagged-as-unsafe-by-google/967/5 "2023-07-13T15:52:49Z")

</div>

I actually do not think the icon endpoint is the issue.

If Google is at play you probably have Bitwarden in your subdomain, and that gets flagged as scam by Google.

If you have any proof of the icon endpoint, i would love too see that.  
But if that is an issue, it’s not something we can fix, since the clients handle the requests.
