Avast's HTTPS Scanning is preventing clients from accessing a Squarespace site
When HTTPS scanning is enabled in a client's Avast antivirus software (on a Windows machine) and they try to access the site, they get the messages below and the site doesn't load. If I turn HTTPS scanning off, the site loads without issue.
From Google Chrome:
This site can’t be reached The connection was reset. Try: Checking the connection Checking the proxy and the firewall Running Windows Network Diagnostics ERR_CONNECTION_RESET
From IE:
This page can’t be displayed Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to [site here] again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 (link for the details), which is not considered secure. Please contact your site administrator.
Avast Antivirus Pop Up
We've safely aborted connection on [site here] because it was infected with URL:Mal.
What are some things on a site that could be meeting Avast's criteria for malware and causing it to show these messages on the browsers?
Troubleshooting I've done
- I checked all pages and removed any links that do not start with https
- I've entered the site in google's safe status and malware page to check for any malware and it doesn't find any.
- Contacted Avast: their recommendation was to ask each client to add the site to their exclusion list. I may not know a potential client or have contact with them to be able to ask them to add the site to their exclusions list -- I would rather remove whatever is tripping Avast.
Additional information
- SSL on the site is active
- Domain is managed by Squarespace and active (paid for)
- There is also a built-in domain that never expires
anti-virus website avast
edited Dec 29 '18 at 0:01
JakeGould
31.2k1096138
asked Dec 28 '18 at 23:47
allicsallics
112
add a comment |
When HTTPS scanning is enabled in a client's Avast antivirus software (on a Windows machine) and they try to access the site, they get the messages below and the site doesn't load. If I turn HTTPS scanning off, the site loads without issue.
From Google Chrome:
This site can’t be reached The connection was reset. Try: Checking the connection Checking the proxy and the firewall Running Windows Network Diagnostics ERR_CONNECTION_RESET
From IE:
This page can’t be displayed Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to [site here] again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 (link for the details), which is not considered secure. Please contact your site administrator.
Avast Antivirus Pop Up
We've safely aborted connection on [site here] because it was infected with URL:Mal.
What are some things on a site that could be meeting Avast's criteria for malware and causing it to show these messages on the browsers?
Troubleshooting I've done
- I checked all pages and removed any links that do not start with https
- I've entered the site in google's safe status and malware page to check for any malware and it doesn't find any.
- Contacted Avast: their recommendation was to ask each client to add the site to their exclusion list. I may not know a potential client or have contact with them to be able to ask them to add the site to their exclusions list -- I would rather remove whatever is tripping Avast.
Additional information
- SSL on the site is active
- Domain is managed by Squarespace and active (paid for)
- There is also a built-in domain that never expires
anti-virus website avast
edited Dec 29 '18 at 0:01
JakeGould
31.2k1096138
asked Dec 28 '18 at 23:47
allicsallics
112
I suggest you pursue this more intently with Avast. Use Virustotal.com to confirm your site is clean. If it is, the suggestion that you add exclusions to client machines is utterly ridiculous and they need to be called out on that.
– Twisty Impersonator
Dec 29 '18 at 1:59
You have two options, add an exception so the website is allowed, or report the issue to Avast and wait till an update is issued that allows it. There is no mechanism to share information privately. This is purely and 100% an issue with how Avast scans encrypted traffic. This security feature, breaks the internet, and makes secure encrypted traffic insecure, by requiring Avast to use a fake certificate allowing allowing it to scan encrypted traffic. There isn’t anything you can do except add the exception allowing the website or disable SSL on the website entirely
– Ramhound
Dec 29 '18 at 2:28
1
@TwistyImpersonator, thank you. I will call them again and send an email to their customer service. I used Virustotal.com and it came back clean.
– allics
Dec 29 '18 at 22:45
@Ramhound, thank you for the information on how the security feature works. I will be reporting the issue to Avast.
– allics
Dec 29 '18 at 22:46
add a comment |
When HTTPS scanning is enabled in a client's Avast antivirus software (on a Windows machine) and they try to access the site, they get the messages below and the site doesn't load. If I turn HTTPS scanning off, the site loads without issue.
From Google Chrome:
This site can’t be reached The connection was reset. Try: Checking the connection Checking the proxy and the firewall Running Windows Network Diagnostics ERR_CONNECTION_RESET
From IE:
This page can’t be displayed Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to [site here] again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 (link for the details), which is not considered secure. Please contact your site administrator.
Avast Antivirus Pop Up
We've safely aborted connection on [site here] because it was infected with URL:Mal.
What are some things on a site that could be meeting Avast's criteria for malware and causing it to show these messages on the browsers?
Troubleshooting I've done
- I checked all pages and removed any links that do not start with https
- I've entered the site in google's safe status and malware page to check for any malware and it doesn't find any.
- Contacted Avast: their recommendation was to ask each client to add the site to their exclusion list. I may not know a potential client or have contact with them to be able to ask them to add the site to their exclusions list -- I would rather remove whatever is tripping Avast.
Additional information
- SSL on the site is active
- Domain is managed by Squarespace and active (paid for)
- There is also a built-in domain that never expires
anti-virus website avast
edited Dec 29 '18 at 0:01
JakeGould
31.2k1096138
asked Dec 28 '18 at 23:47
allicsallics
112
When HTTPS scanning is enabled in a client's Avast antivirus software (on a Windows machine) and they try to access the site, they get the messages below and the site doesn't load. If I turn HTTPS scanning off, the site loads without issue.
From Google Chrome:
This site can’t be reached The connection was reset. Try: Checking the connection Checking the proxy and the firewall Running Windows Network Diagnostics ERR_CONNECTION_RESET
From IE:
This page can’t be displayed Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting to [site here] again. If this error persists, it is possible that this site uses an unsupported protocol or cipher suite such as RC4 (link for the details), which is not considered secure. Please contact your site administrator.
Avast Antivirus Pop Up
We've safely aborted connection on [site here] because it was infected with URL:Mal.
What are some things on a site that could be meeting Avast's criteria for malware and causing it to show these messages on the browsers?
Troubleshooting I've done
- I checked all pages and removed any links that do not start with https
- I've entered the site in google's safe status and malware page to check for any malware and it doesn't find any.
- Contacted Avast: their recommendation was to ask each client to add the site to their exclusion list. I may not know a potential client or have contact with them to be able to ask them to add the site to their exclusions list -- I would rather remove whatever is tripping Avast.
Additional information
- SSL on the site is active
- Domain is managed by Squarespace and active (paid for)
- There is also a built-in domain that never expires
anti-virus website avast
anti-virus website avast
edited Dec 29 '18 at 0:01
JakeGould
31.2k1096138
asked Dec 28 '18 at 23:47
allicsallics
112
edited Dec 29 '18 at 0:01
JakeGould
31.2k1096138
asked Dec 28 '18 at 23:47
allicsallics
112
edited Dec 29 '18 at 0:01
JakeGould
31.2k1096138
edited Dec 29 '18 at 0:01
JakeGould
31.2k1096138
edited Dec 29 '18 at 0:01
JakeGould
31.2k1096138
31.2k1096138
asked Dec 28 '18 at 23:47
allicsallics
112
asked Dec 28 '18 at 23:47
allicsallics
112
asked Dec 28 '18 at 23:47
allicsallics
112
112
I suggest you pursue this more intently with Avast. Use Virustotal.com to confirm your site is clean. If it is, the suggestion that you add exclusions to client machines is utterly ridiculous and they need to be called out on that.
– Twisty Impersonator
Dec 29 '18 at 1:59
You have two options, add an exception so the website is allowed, or report the issue to Avast and wait till an update is issued that allows it. There is no mechanism to share information privately. This is purely and 100% an issue with how Avast scans encrypted traffic. This security feature, breaks the internet, and makes secure encrypted traffic insecure, by requiring Avast to use a fake certificate allowing allowing it to scan encrypted traffic. There isn’t anything you can do except add the exception allowing the website or disable SSL on the website entirely
– Ramhound
Dec 29 '18 at 2:28
1
@TwistyImpersonator, thank you. I will call them again and send an email to their customer service. I used Virustotal.com and it came back clean.
– allics
Dec 29 '18 at 22:45
@Ramhound, thank you for the information on how the security feature works. I will be reporting the issue to Avast.
– allics
Dec 29 '18 at 22:46
add a comment |
I suggest you pursue this more intently with Avast. Use Virustotal.com to confirm your site is clean. If it is, the suggestion that you add exclusions to client machines is utterly ridiculous and they need to be called out on that.
– Twisty Impersonator
Dec 29 '18 at 1:59
You have two options, add an exception so the website is allowed, or report the issue to Avast and wait till an update is issued that allows it. There is no mechanism to share information privately. This is purely and 100% an issue with how Avast scans encrypted traffic. This security feature, breaks the internet, and makes secure encrypted traffic insecure, by requiring Avast to use a fake certificate allowing allowing it to scan encrypted traffic. There isn’t anything you can do except add the exception allowing the website or disable SSL on the website entirely
– Ramhound
Dec 29 '18 at 2:28
1
@TwistyImpersonator, thank you. I will call them again and send an email to their customer service. I used Virustotal.com and it came back clean.
– allics
Dec 29 '18 at 22:45
@Ramhound, thank you for the information on how the security feature works. I will be reporting the issue to Avast.
– allics
Dec 29 '18 at 22:46
I suggest you pursue this more intently with Avast. Use Virustotal.com to confirm your site is clean. If it is, the suggestion that you add exclusions to client machines is utterly ridiculous and they need to be called out on that.
– Twisty Impersonator
Dec 29 '18 at 1:59
I suggest you pursue this more intently with Avast. Use Virustotal.com to confirm your site is clean. If it is, the suggestion that you add exclusions to client machines is utterly ridiculous and they need to be called out on that.
– Twisty Impersonator
Dec 29 '18 at 1:59
You have two options, add an exception so the website is allowed, or report the issue to Avast and wait till an update is issued that allows it. There is no mechanism to share information privately. This is purely and 100% an issue with how Avast scans encrypted traffic. This security feature, breaks the internet, and makes secure encrypted traffic insecure, by requiring Avast to use a fake certificate allowing allowing it to scan encrypted traffic. There isn’t anything you can do except add the exception allowing the website or disable SSL on the website entirely
– Ramhound
Dec 29 '18 at 2:28
You have two options, add an exception so the website is allowed, or report the issue to Avast and wait till an update is issued that allows it. There is no mechanism to share information privately. This is purely and 100% an issue with how Avast scans encrypted traffic. This security feature, breaks the internet, and makes secure encrypted traffic insecure, by requiring Avast to use a fake certificate allowing allowing it to scan encrypted traffic. There isn’t anything you can do except add the exception allowing the website or disable SSL on the website entirely
– Ramhound
Dec 29 '18 at 2:28
1
1
@TwistyImpersonator, thank you. I will call them again and send an email to their customer service. I used Virustotal.com and it came back clean.
– allics
Dec 29 '18 at 22:45
@TwistyImpersonator, thank you. I will call them again and send an email to their customer service. I used Virustotal.com and it came back clean.
– allics
Dec 29 '18 at 22:45
@Ramhound, thank you for the information on how the security feature works. I will be reporting the issue to Avast.
– allics
Dec 29 '18 at 22:46
@Ramhound, thank you for the information on how the security feature works. I will be reporting the issue to Avast.
– allics
Dec 29 '18 at 22:46
add a comment |
1 Answer
1
active
oldest
votes
Reported a false positive to Avast at https://www.avast.com/en-us/false-positive-file-form.php and they cleared the site's reputation in their database. Clients using Avast are now able to access the website.
answered Jan 6 at 17:02
allicsallics
112
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1388612%2favasts-https-scanning-is-preventing-clients-from-accessing-a-squarespace-site%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Reported a false positive to Avast at https://www.avast.com/en-us/false-positive-file-form.php and they cleared the site's reputation in their database. Clients using Avast are now able to access the website.
answered Jan 6 at 17:02
allicsallics
112
add a comment |
Reported a false positive to Avast at https://www.avast.com/en-us/false-positive-file-form.php and they cleared the site's reputation in their database. Clients using Avast are now able to access the website.
answered Jan 6 at 17:02
allicsallics
112
add a comment |
Reported a false positive to Avast at https://www.avast.com/en-us/false-positive-file-form.php and they cleared the site's reputation in their database. Clients using Avast are now able to access the website.
answered Jan 6 at 17:02
allicsallics
112
Reported a false positive to Avast at https://www.avast.com/en-us/false-positive-file-form.php and they cleared the site's reputation in their database. Clients using Avast are now able to access the website.
answered Jan 6 at 17:02
allicsallics
112
answered Jan 6 at 17:02
allicsallics
112
answered Jan 6 at 17:02
allicsallics
112
answered Jan 6 at 17:02
allicsallics
112
112
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1388612%2favasts-https-scanning-is-preventing-clients-from-accessing-a-squarespace-site%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
I suggest you pursue this more intently with Avast. Use Virustotal.com to confirm your site is clean. If it is, the suggestion that you add exclusions to client machines is utterly ridiculous and they need to be called out on that.
– Twisty Impersonator
Dec 29 '18 at 1:59
You have two options, add an exception so the website is allowed, or report the issue to Avast and wait till an update is issued that allows it. There is no mechanism to share information privately. This is purely and 100% an issue with how Avast scans encrypted traffic. This security feature, breaks the internet, and makes secure encrypted traffic insecure, by requiring Avast to use a fake certificate allowing allowing it to scan encrypted traffic. There isn’t anything you can do except add the exception allowing the website or disable SSL on the website entirely
– Ramhound
Dec 29 '18 at 2:28
1
@TwistyImpersonator, thank you. I will call them again and send an email to their customer service. I used Virustotal.com and it came back clean.
– allics
Dec 29 '18 at 22:45
@Ramhound, thank you for the information on how the security feature works. I will be reporting the issue to Avast.
– allics
Dec 29 '18 at 22:46