Riot phishing and smishing simulations take employees to a fake login page hosted on a Riot domain. Google Safe Browsing, built into Chrome, can flag these pages as deceptive. When that happens, the employee sees a red warning page instead of the simulation, and your campaign results no longer show how employees really behave.
What an employee sees when Safe Browsing flags a simulation page. Illustration, the real page may look slightly different.
Add the Riot simulation domains to Chrome's allowlist to stop the warning.
Did you know? The allowlist only turns off Safe Browsing checks for the domains you add. Every other website keeps full Safe Browsing protection.
Who should do this?
A Chrome administrator with access to the Google Admin console (Chrome Enterprise Core, formerly Chrome Browser Cloud Management), or a Windows administrator who manages Chrome with Group Policy or Microsoft Intune.
Which steps do I need?
You manage Chrome from the Google Admin console: do steps ❶, ❷ and ❹.
You manage Chrome on Windows with Group Policy or Intune: do steps ❶, ❸ and ❹.
❶ Get your Riot simulation domains
You need the phishing page domains Riot generated for you. You will have about 10 domains to add, listed in Riot under Settings > Domain > Check configuration.
Add each of these domains as its own entry in the steps below.
⚠️ Do not copy example domains from this article. Use the list from your own Riot workspace. Riot can add new domains over time, so check the list again before a large campaign.
❷ Add the domains in the Google Admin console
Chrome uses the SafeBrowsingAllowlistDomains policy for this. In the Google Admin console, it is called Safe Browsing allowed domains.
Sign in to the Google Admin console with an administrator account.
Go to Menu > Devices > Chrome > Settings. If you use Chrome Enterprise Core, go to Menu > Chrome browser > Settings instead. The User & browser settings page opens.
To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
In the Safe Browsing section, click Safe Browsing allowed domains.
Enter each Riot domain from step ❶, one per line. Enter the domain only, without
https://or a path.Click Save.
Subdomains are included automatically. If you add example-login.com, Chrome also trusts a1b2c3.example-login.com.
For more details, see Google's article Set up active password detection, which documents the same setting.
❸ Windows: set the policy with Group Policy or Intune
⚠️ On Windows, Chrome only applies this policy to managed browsers. The computer must be joined to Active Directory, joined to Microsoft Entra ID, or the browser must be enrolled in Chrome Enterprise Core. On any other Windows computer, Chrome ignores the policy. On macOS, Chrome must be managed with an MDM.
With Group Policy
Make sure the Google Chrome administrative templates (ADMX) are installed.
Open the Group Policy Management Editor and go to Computer Configuration > Administrative Templates > Google > Google Chrome > Safe Browsing settings.
Open Configure the list of domains on which Safe Browsing will not trigger warnings.
Select Enabled, click Show…, and add each Riot domain on its own line.
Click OK, then Apply.
With Microsoft Intune
In the Intune admin center, go to Devices > Configuration > Create > New policy.
Choose Windows 10 and later as the platform and Settings catalog as the profile type.
Click Add settings, search for
Safe Browsing, and select the Google Chrome > Safe Browsing settings category.Select Configure the list of domains on which Safe Browsing will not trigger warnings, set it to Enabled, and add each Riot domain.
Assign the profile to the groups that will receive simulations, then click Create.
❹ Try it out
Check the configuration on a managed computer.
Open Chrome and go to
chrome://policy.Click Reload policies.
Check that SafeBrowsingAllowlistDomains is listed with the status OK and shows your Riot domains.
Open one of your Riot domains in a new tab, for example
https://followed by the first domain in your list. You should see the page load without a red warning.
Please note: the policy can take some time to reach every computer. If everything looks correct and you still see a warning, wait about an hour and try again.