Back to Checks
googleworkspace

Warning prompt for clicks on untrusted domain links is enabled

gmail_untrusted_link_warnings_enabled
Service: gmailSeverity: medium
OfficialBuilt-inVerified
Categories:email-security
Resource Type:NotDefined

Gmail can display a warning prompt when users click on links to domains that are not trusted. This gives users an opportunity to reconsider before navigating to a potentially malicious website.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

Without untrusted link warnings, users may click on phishing links or links to malware distribution sites without any warning. This significantly increases the success rate of social engineering attacks targeting the organization.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks gmail_untrusted_link_warnings_enabled

Recommendation

Enable warning prompts for clicks on untrusted domain links so users are alerted before navigating to potentially malicious websites from email links.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Gmail**
3Click **Safety** > **Links and external images**
4Check **Show warning prompt for any click on links to untrusted domains**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.gmail.gmail_client import gmail_client


class gmail_untrusted_link_warnings_enabled(Check):
    """Check that warning prompts for clicks on untrusted domain links are enabled.

    This check verifies that Gmail is configured to show warning prompts
    when users click on links to domains that are not trusted, helping
    prevent users from navigating to malicious sites.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if gmail_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=gmail_client.policies,
                resource_id="gmailPolicies",
                resource_name="Gmail Policies",
                customer_id=gmail_client.provider.identity.customer_id,
            )

            warnings_enabled = (
                gmail_client.policies.enable_aggressive_warnings_on_untrusted_links
            )

            if warnings_enabled is True:
                report.status = "PASS"
                report.status_extended = (
                    f"Warning prompts for clicks on untrusted domain links are enabled "
                    f"in domain {gmail_client.provider.identity.domain}."
                )
            elif warnings_enabled is None:
                report.status = "FAIL"
                report.status_extended = (
                    f"Warning prompts for clicks on untrusted domain links "
                    f"are not configured and use Google's insecure default "
                    f"(disabled) in domain "
                    f"{gmail_client.provider.identity.domain}. "
                    f"Untrusted link warnings should be enabled to protect users."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Warning prompts for clicks on untrusted domain links are disabled "
                    f"in domain {gmail_client.provider.identity.domain}. "
                    f"Untrusted link warnings should be enabled to protect users."
                )

            findings.append(report)

        return findings

References