Web platform and delivery on errno

Search Console says "Possible phishing detected on user login" on a site with no login

Tue, 15 Sep 2026 00:00:00 +0000

Symptom

Search Console, Security Issues, on a static site of mine:

Security issues
1 issue detected

Possible phishing detected on user login
The browser will show pop-up warnings when users enter saved login
credentials into some pages on your site

Sample URLs: N/A

The site is a generated static blog. No accounts, no login page, no registration, no comments, no newsletter signup, no <input type="password"> anywhere in the output, and none of those ever existed. There is nothing on it that a user could enter login credentials into, which makes the message read like either a false positive or — the reading that ruins your evening — evidence that someone is serving a login page from my domain that I have never seen.

A phone input mask that silently rewrote the number I typed

Sat, 05 Sep 2026 00:00:00 +0000

Numbers in this post are placeholders; the original test used a real number that has been redacted.

What happened

A registration form had a mobile number field with a national format mask:

<input type="text" class="form-control mask-phone" name="phone"
 maxlength="14" minlength="14" required placeholder="Mobile number">

I filled it with a foreign number in international form. The field did not go red, no message appeared — the value became:

input: +421900123456
field: 06

Typing digit by digit was worse. The mask pre-seeds the national trunk prefix, so my leading digits were consumed as part of it and the rest shifted:

Cloudflare Email Routing rejects mail with 550 5.7.26 "not authenticated"

Sat, 05 Sep 2026 00:00:00 +0000

Symptom

A freshly created routing rule (contact@example.com → a Gmail mailbox) looked configured. Sending a test message straight to the MX from a host with no outbound mail authentication failed at the DATA stage:

smtplib.SMTPDataError: (550, b'5.7.26 Cannot forward emails that are not authenticated.
Refer to https://developers.cloudflare.com/email-routing/postmaster/ for more information..')

Note where it failed: MAIL FROM and RCPT TO were both accepted, so it is not an unknown-recipient or configuration problem.

HTTP 522 after pointing a domain at Cloudflare Pages (and the Search Console fallout)

Sat, 05 Sep 2026 00:00:00 +0000

What I did, and what broke

Migrating a static site to Cloudflare Pages, in this order:

POST /accounts/{id}/pages/projects — create project
wrangler pages deploy public --project-name … — upload, deployment succeeded
POST /accounts/{id}/pages/projects/{p}/domains — add site.example.com
immediately repoint the DNS record to <project>.pages.dev, proxied

Seconds later:

$ curl -sSI https://site.example.com/
HTTP/2 522
server: cloudflare
cf-ray: a3664d60bfb3386b-LHR

The domain was serving Cloudflare’s “connection timed out” error, because the Pages side had not finished attaching it:

reCAPTCHA v3 rejects your headless Chromium and no fingerprint patch fixes it

Sat, 05 Sep 2026 00:00:00 +0000

Symptom

An end-to-end check drives a form on a site I am allowed to automate. In a normal browser session the submission succeeds. From headless Chromium, the token is generated without error — grecaptcha.execute() resolves and returns a 2 361-character token — but the backend rejects it:

{"success":false,"errors":{"general":["validation.recaptchav3"]}}

The important detail: the failure is not client-side. There is no exception, no missing site key, no network error. The token exists and is syntactically fine. reCAPTCHA v3 is score-based, and the score arrives at the server too low to pass its threshold.