Using the official Apple Pay JS SDK (https://applepay.cdn-apple.com/jsapi/1.latest/apple-pay-sdk.js), the onvalidatemerchant event returns the validationURL: https://apple-pay-gateway.apple.com/paymentservices/startSession Our server performs merchant validation via mTLS using exactly this URL, with a valid Merchant Identity Certificate, and Apple responds with HTTP 400 Bad Request. Apple's current documentation instead references /paymentservices/paymentSession and states that "Start Session is being phased out and replaced by Payment Session". Since the URL is provided by Apple's own SDK, is startSession still valid when returned by onvalidatemerchant, and why is it rejected with 400? Anyone is experiencing this?

I am creating passkeys using client side javascript and trying to see how the friendly name of the passkey is created. When the passkey gets created the publicKey the name for the relying party is ignored and iOS and MacOS retrieves the page of the relying party. It seems the Open Graph site_name meta tag is used for the friendly name. And the apple-touch-icon is the icon on iOS (but not on MacOS) in the passwords app and it needs to be over 180px. Is there anywhere this is documented and confirmed as once the passkey is enrolled updating the site_name or apple-touch-icon the image never gets updated.

Two unrelated, legitimate websites I own are both shown as "Deceptive Website — Apple has identified this website as fraudulent" in Safari (iOS + macOS), and even inside my installed PWA on iOS. This is a false positive and I can't find a working way to get Apple to remove it. Why I'm confident it's a false positive: Google Safe Browsing site status: clean Google Search Console (verified owner) > Security Issues: none Yandex Webmaster > Security: no violations VirusTotal: 0/92 detections Chrome, Firefox, Yandex Browser: NO warning on any platform Only Safari shows it, wording is "Apple has identified..." — i.e. Apple's own list, not the Google Safe Browsing feed The sites are genuinely benign: no brand impersonation, no third-party credential harvesting, no malware, no drive-by downloads. The interesting part — it's TWO unrelated sites: Site A: a small web app (SaaS with a login form) Site B: my personal developer portfolio — static, no login at all They share almost nothing: different codebase, different design, different hosting (Site A is behind Cloudflare with a Google Trust Services edge cert; Site B is a plain nginx box with a Let's Encrypt cert), different TLS issuers, different stacks. The ONLY common denominator is me as the owner/registrant (same person, same contact email, same registrar account). This makes me think the domains were clustered by registrant/owner rather than by anything on the sites themselves. The two-sites fact also rules out the usual scapegoats: it isn't Cloudflare (Site B isn't even on Cloudflare and is flagged too), nor the cert issuer, host, or stack, since those differ. What I've already done: Clicked "Report an error" on the Safari warning page Submitted the Google Safe Browsing incorrect-warning report Filed a tracked report in Feedback Assistant (FB number, status Open) Hardened both sites anyway: CSP + security headers, SPF/DKIM/DMARC, and real trust pages (About with owner identity + contact, Privacy Policy, Terms, linked from homepage and login page) It's been about a week with no response. My questions: When Google Safe Browsing is clean but Safari still flags, what feeds Apple's OWN fraudulent-site list? Is registrant/owner clustering a real mechanism here? Which removal channel actually works in practice? Realistic timeline for a false-positive removal? If one domain is cleared, does that clear the owner-level association for the other, or do I appeal each separately? Is there anything that re-triggers it? (Considering a domain migration as a last resort and want to avoid a new domain getting re-flagged.) Any first-hand experience is appreciated — the process is completely opaque.

My site formtracker.ru shows Safari's "Deceptive Website" warning. I believe it is a false positive, and I am trying to understand how the Apple-side check is reviewed, since every other signal I can measure is clean. What the site is A strength-training tracker that runs as a Telegram Mini App. There is no login form, no payment form, and no field anywhere that asks a visitor for credentials, card details or personal data — authentication happens inside Telegram, not on the page. The site does not imitate any brand or product; all content is our own. Privacy policy and terms are published at /privacy.html and /terms.html with a working contact address. What I verified Google Safe Browsing: clean VirusTotal: no detections Chrome, Firefox and other browsers on the same device: no warning The warning appears only in Safari One reproducible observation After migrating hosting I created a brand-new subdomain that had never been published, linked or crawled anywhere, pointing at the new IP. Safari flagged it immediately on first load. That strongly suggests the entry applies to the registrable domain and all of its subdomains rather than to a specific URL or IP — and therefore that nothing I change on my side (hosting, content, subdomain) can clear it. Possible contributing factor, already removed Until 19 Aug 2026 the site was hosted at 79.137.205.96. That address sits inside a range listed by Spamhaus SBL under a "bulletproof hosting" classification. The listing covers the whole /24 and the neighbouring /24s, including addresses unrelated to my service, so it was not specific to me; AbuseIPDB has zero reports for that address. I have since moved to a different provider entirely, and the current IP is clean in Spamhaus ZEN, Barracuda, SpamCop and SORBS. I am not claiming this was the cause — I have no way to know. It is simply the one negative signal I could find and verify, and it no longer applies. What I have already submitted "Report an Error" from the Safari warning screen The Fraudulent Website Warning review request form Feedback Assistant: FB24430497 One more detail The warning also appears with the device region set to Germany, so it does not appear to be region-specific. My questions Is there a review channel for the Apple-side list other than the three above, and is there any way to tell whether a submission was received at all? Since a never-published subdomain was flagged on first load, is the entry expected to apply to the whole registrable domain? If so, is a domain-level review the only path? Has anyone here had a Safari-only false positive cleared, and roughly how long did it take? I am happy to provide anything else that would help — full URLs, screenshots, timestamps.

Five of my sites are flagged by Safari's Deceptive Website Warning. They are legitimate and none of them collect credentials, imitate another brand or contain social engineering content: store-api.ru — paid access to third-party AI APIs (clearly states it is not affiliated with OpenAI, Anthropic or Google) cenwise.ru — price comparison service kirillportfolio.ru — personal developer portfolio (no login, no forms, no data collection at all) 3021.ru — habit tracking app animegenai.ru — AI image generation service All five are clean in Google Safe Browsing, Google Transparency Report, Google Search Console and Yandex Webmaster. Safari is the only place showing a warning. The flag appears to be inherited from a previous hosting provider whose IP ranges had reputation problems, and it seems attached to the domain names rather than to the current infrastructure. This is directly testable: On 20 July 2026 all sites were migrated to a new host — a single server, single IP (152.53.119.191). On that exact same server and IP, the domains created AFTER the migration are NOT flagged: filelama.com (live since 28 July, fully indexed), novelisstory.ru (25 July) and store-api.com (4 August). Only the domains that already existed under the previous host are still flagged. Same server, same IP, same certificates, same kind of content. The only variable is whether the domain existed before 20 July. store-api.ru and store-api.com are the clearest case: both are literally the same application behind the same nginx on the same IP, differing only in the domain name. The .ru is flagged, the .com is not. I submitted requests through websitereview.apple.com on 20 July and again on 11 August 2026. Neither produced a response or an acknowledgement, which as I understand is expected behaviour for that form. My questions: Is websitereview.apple.com still the correct — and only — channel for a site owner to dispute a false positive? Is there any way to confirm that a submission was received, or a typical review timeframe I should expect? Would a Feedback Assistant report under Safari add anything here, or would it simply duplicate the request?

Observed versions: Reproduced on Tahoe / Safari 26 and iOS 26 Safari. Not reproduced on v18 Safari. Not reproduced in Chrome with the same reduced test setup. We are seeing a Safari-only rendering issue affecting an ad creative inside an iframe on both desktop Safari and iOS Safari. What we observe: The issue is reproducible in Safari on OS X and iOS v26. We do not reproduce it in Chrome with the same test setup. We can reproduce it in a minimal test case, outside our site app code. The issue appears tied to the rendered iframe document/layout, not our outer page layout. The problematic rendered structure inside the iframe looks like this: <div class="GoogleActiveViewElement" style="display:inline"> <ins class="dcmads" style="display:inline-block;width:320px;height:50px"> <script src="https://www.googletagservices.com/dcm/dcmads.js"></script> </ins> </div> Here is a simplified, local-reproducible version for testing: <div class="GoogleActiveViewInnerContainer" style="left:0px; top:0px; width:100%; height:100%; position:fixed; pointer-events:none; z-index:-9999;"></div> <div class="GoogleActiveViewElement" style="display:inline"> <ins class="dcmads" style="display:inline-block;width:320px;height:50px"> <script> document.write( '<a target="_blank" href="#"><img ' + 'src="data:image/svg+xml;utf8,' + encodeURIComponent( '<svg xmlns="http://www.w3.org/2000/svg" width="320" height="50">' + '<rect width="320" height="50" fill="#ffd8d8"/>' + '<text x="160" y="30" text-anchor="middle" font-family="Arial" font-size="14" fill="#222">' + 'img placeholder' + '</text>' + '</svg>' ) + '" ' + ' alt="Advertisement" border="0" width="320" height="50" style="display:block" /></a>' ); </script> </ins> </div> In Safari, this produces extra vertical spacing / cutoff above the ad. In the test code you will only notice an added top spacing, but when rendered in a live ad, the bottom gets cut off. A few details that may help: If we manually change the inner ins.dcmads from display:inline-block to display:inline, or adding overflow:hidden, the spacing issue goes away. If the loader script is moved outside the ins during manual experimentation, the issue also goes away. This makes it look like a Safari layout/rendering issue involving an inline wrapper around an inline-block ad container during script-driven rendering. Questions: Is this a known Safari/WebKit layout issue involving inline + inline-block content in iframe documents? Has there been any recent Safari/WebKit change that could affect this rendering path? Is there a preferred reduced repro format for reporting layout issues like this?

When I login to an account on a subdomain of a main domain, I want to be able to store a separate password for the same login id on the main domain account. This doesn't seem possible in the current Safari implementation.eg: domain.com is the main domain and is the general information site.my.domain.com is the subdomain that hosts the customer support.I want different passwords on each for the same login ID... Can't I do this?--marcel

Hi, Looking for feedback from the community. We have a app that has a weather module and a subscription module. They are built in a table format. The weather module has Y and X scroll, however the subscription only has X scroll. When we test the app on an apple device using safari browser these modules moves around in all directions with touch method. The weather module should only move on X or Y scroll however with touch screen movement it moves it all directions, including the titles of the table columns. In regards to the subscription page in only has X scroll, however it has 2 scroll a top one after all the subscriptions are listed and then a bottom on after the total cost of all the subscriptions. The module behaves fine in windows and android devices, however it does not on safari. How do we address this issue? Any suggestion will be greatly appreciated. AJ