Norton Antivirus Warning

[JayAy]

Forum URL: (private)
One of our memebrs messaged to say her Norton 360 Antivirus alerts her every time she comes to the forum, and tells her it's an unsafe website and not to access it. She disregards the warning and logs in anyways, and has had no isssues. 

I read a couple threads here from almost a year ago, asking the same thing, but I didn't find any solutions other than that it's a "false positive", and to report it to Norton? 

Many of our members are older seniors, and not likely to follow through to report anything to Norton. Is there a simple and reassuring explanation you can offer, that I could copy to my members, since I doubt she is the only one seeing the warning?

Thanks!

[bigballofyarn]

Do you know the exact message she is receiving? Is her browser giving her any errors? Is she only seeing this while logged in or at all times?

Assuming you are talking about the forum you linked to in the past (https://ja********s.proboards.com/), I cannot replicate this error as a guest.

[JayAy]

Yes, same forum. I only know what my mod reported to me, so 'll have to message the member back, myself, to be sure. Hopefully she can give me more information, thanks. 

[JayAy]

This is what she told me:

The warning comes up every time I access Proboards on my Ipad or Iphone.

It only happens occasionally on my Macbook.

Norton is not giving me any error codes just the warning "UNSAFE SITE. We recommend that you not use this site".

This happens every time I go to the site, I stay logged in.

I've been getting them about a month now.

[Kami]

Just a courtesy reply, it's outside of office hours so it is unlikely a PB Admin will respond until next week. Office hours are M-F, 9am to 5pm pacific (-8gmt), excluding US federal holidays.

[jessitap]

I don't know if this is the case but I get a warning about Proboards being unsafe if I put www in front of the URL. Ex. www.support.proboards.com. Maybe ask the member if that's what they're doing and ask them to try just doing support.proboards.com (except your website) instead? Not sure if this applies to your situation, but I thought I would suggest it anyway.

[JayAy]

That’s interesting, jessitap, I’ll ask her to give it a try, thank you!

[JayAy]

Mar 4, 2023 14:41:35 GMT -8 jessitap said:

I don't know if this is the case but I get a warning about Proboards being unsafe if I put www in front of the URL. Ex. www.support.proboards.com. Maybe ask the member if that's what they're doing and ask them to try just doing support.proboards.com (except your website) instead? Not sure if this applies to your situation, but I thought I would suggest it anyway.

This seems to be working, thank you! 

She said she hasn't seen the warning since she omitted "www" in the address. I don't know why it works, but it does.

[Kami]

Mar 8, 2023 0:21:25 GMT -8 JayAy said:

Mar 4, 2023 14:41:35 GMT -8 jessitap said:

I don't know if this is the case but I get a warning about Proboards being unsafe if I put www in front of the URL. Ex. www.support.proboards.com. Maybe ask the member if that's what they're doing and ask them to try just doing support.proboards.com (except your website) instead? Not sure if this applies to your situation, but I thought I would suggest it anyway.

This seems to be working, thank you!

She said she hasn't seen the warning since she omitted "www" in the address. I don't know why it works, but it does.

Once upon a time in days gone by, "www" was a URL prefix command that indicated you wanted the server to direct you to the HTML page of a particular website, differentiating it from other prefix commands like "mail" or "ftp".

But, "www" was never truly necessary, and since a majority of people trying to access a website are only trying to access the HTML page, it's fallen out of use. It's not "wrong" per se, it's simply an artefact of days gone by.

From a technical perspective, PB is set up to be secure - httpS, versus http - and no longer uses the www prefix. Because the security certificate is applied to the non-www forum, attempting to access the www means you're trying to access a site without httpS, and most modern browsers and protective software will flag it as unsafe.

Other sites may apply https to both their www and non-www versions of their URL, but PB does not, hence the warning when using www.

[Chris]

It also might not be a prudent business decision to pay even more to enable sub-subdomain certification such as www.myspaceforum.proboards.com when I suspect a growing number of people are running adblockers preventing the ability to pay the bills and provide this free service we love so much.

Cloudflare SSL/TLS Docs said:

Limitations for Universal SSL

Universal SSL certificates are limited by the hostnames they cover and the browsers they support.

​​Hostname coverage

​​Full setup

Universal SSL certificates only support SSL for the root or first-level subdomains such as example.com and www.example.com. To enable SSL support on second, third, and fourth-level subdomains such as dev.www.example.com or app3.dev.www.example.com, you can:

• Purchase Advanced Certificate Manager, to cover more than one level of subdomain, remove Cloudflare branding from the Universal certificate, or adjust the shortest certificate lifespan.
• Upgrade to a Business or Enterprise plan to upload a Custom SSL certificate

[JayAy]

Mar 8, 2023 7:17:00 GMT -8 Kami said:

Mar 8, 2023 0:21:25 GMT -8 JayAy said:

This seems to be working, thank you!

She said she hasn't seen the warning since she omitted "www" in the address. I don't know why it works, but it does.

Once upon a time in days gone by, "www" was a URL prefix command that indicated you wanted the server to direct you to the HTML page of a particular website, differentiating it from other prefix commands like "mail" or "ftp".

But, "www" was never truly necessary, and since a majority of people trying to access a website are only trying to access the HTML page, it's fallen out of use. It's not "wrong" per se, it's simply an artefact of days gone by.

From a technical perspective, PB is set up to be secure - httpS, versus http - and no longer uses the www prefix. Because the security certificate is applied to the non-www forum, attempting to access the www means you're trying to access a site without httpS, and most modern browsers and protective software will flag it as unsafe.

Other sites may apply https to both their www and non-www versions of their URL, but PB does not, hence the warning when using www.

Thank you, Kami! That makes good sense. I knew www wasn't necessary any more, but I hadn't considered it from a security certificate standpoint, so I appreciate your easy to understand explanation.