Back to Checks
googleworkspace

Service status for Google Sites is set to off

sites_service_disabled
Service: sitesSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

The domain-wide Google Sites configuration has the service disabled for all users. Google Sites allows users to create internal and external websites, which may expose sensitive information or create unmanaged content outside the organization's control.

Prowler logoProwlerprowler-provider-googleworkspace

Risk

When Google Sites is enabled, users can create websites that may inadvertently expose internal information to external parties. These sites can be difficult to track and manage, creating potential data leakage vectors outside the organization's standard content management controls.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler googleworkspace --checks sites_service_disabled

Recommendation

Disable Google Sites for all users to reduce the organization's attack surface. If specific users require access, enable it by exception for those users or groups only.

Remediation

Other

1Sign in to the Google **Admin console** at https://admin.google.com
2Navigate to **Apps** > **Google Workspace** > **Sites**
3Click **Service status**
4Select **OFF for everyone**
5Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGoogleWorkspace
from prowler.providers.googleworkspace.services.sites.sites_client import sites_client


class sites_service_disabled(Check):
    """Check that the Google Sites service is disabled for all users.

    This check verifies that the domain-level policy disables the Google Sites
    service, reducing the organization's attack surface by preventing users
    from creating internal or external websites.
    """

    def execute(self) -> List[CheckReportGoogleWorkspace]:
        findings = []

        if sites_client.policies_fetched:
            report = CheckReportGoogleWorkspace(
                metadata=self.metadata(),
                resource=sites_client.policies,
                resource_id="sitesPolicies",
                resource_name="Sites Policies",
                customer_id=sites_client.provider.identity.customer_id,
            )

            service_state = sites_client.policies.service_state

            if service_state == "DISABLED":
                report.status = "PASS"
                report.status_extended = (
                    f"Google Sites service is disabled "
                    f"in domain {sites_client.provider.identity.domain}."
                )
            else:
                report.status = "FAIL"
                if service_state is None:
                    report.status_extended = (
                        f"Google Sites service is not explicitly configured "
                        f"in domain {sites_client.provider.identity.domain}. "
                        f"The default is ON for everyone. Google Sites should be disabled."
                    )
                else:
                    report.status_extended = (
                        f"Google Sites service is enabled "
                        f"in domain {sites_client.provider.identity.domain}. "
                        f"Google Sites should be disabled."
                    )

            findings.append(report)

        return findings

References