Web platform and delivery
Cloudflare, DNS and Search Console: email that is accepted and then refused, custom domains that answer 522, bot scoring that rejects headless browsers, and a phishing flag on a site with no login.
- Search Console says "Possible phishing detected on user login" on a site with no login
A static blog with no accounts, no forms and no password field got flagged for phishing on user login, with no sample URLs. How to prove it is not a blocklisting or a compromise, and the two changes that removed every credential-shaped surface.
- A phone input mask that silently rewrote the number I typed
A jquery.mask field with a fixed national format did not reject a foreign number — it reshaped the digits into a different, valid-looking one. How to detect this class of bug and why fixed-length masks are the wrong validation tool.
- Cloudflare Email Routing rejects mail with 550 5.7.26 "not authenticated"
A forwarding alias accepts RCPT TO and still refuses the message: Cloudflare will not forward mail that lacks SPF/DKIM alignment. How to prove the alias exists, what the rejection means for your contact address, and what the forwarded headers look like when it works.
- HTTP 522 after pointing a domain at Cloudflare Pages (and the Search Console fallout)
Adding a custom domain to a Pages project and flipping DNS in the same minute produces a short 522 window. That window is enough for Googlebot to record a failed sitemap read that sticks around after the site is healthy.
- reCAPTCHA v3 rejects your headless Chromium and no fingerprint patch fixes it
A form on your own site works in a normal browser and fails from a headless Chromium with a server-side score rejection. Here is what I measured across UA spoofing, navigator.webdriver, window.chrome.runtime and screen size — and the one change that actually mattered.