links sent via square marketing emails are flagged as not private

[timelord]

When we send marketing emails via Square, the links we include are transformed with Square tracking after we tell Square to send.:

i.e.:  www.sabatinis.com/bottleshop 

becomes

https://zpzl839y.r.us-west-2.awstrack.me/L0/https:%2F%2Fsqclick.com%2Foutreach%2Ft%2FjfYvbkhNvVuo%2F...

The issue is Safari and Chrome flag these transformed links as

"Your connection is not private
Attackers might be trying to steal your information from zpzl839y.r.us-west-2.awstrack.me (for example, passwords, messages, or credit cards). "

It is possible that spam filters and other malware prevention tools may flag these emails.  Not the experience we want for our customers.

[throughtheriver]

I am experiencing the same issue. I have chatted with support and they had no real solutions for me. We spend hours each week creating email marketing campaigns and it is frustrating that the links are not working for our customers. Does anyone have a solution?

[Loamibathandbod]

We are having the exact same issue as well. 

[mitin]

@timelord 

I saw the issue you're having with the 'Connection not private' warnings on your Square marketing links.

What’s happening is that Square is wrapping your links in a tracking URL ($awstrack.me$), and browsers like Safari and Chrome are flagging it because of a security certificate mismatch or a 'reputation' issue with that specific tracking domain.

Normally there should be an option to turn of tracking but I do not see that, I would try to avoid 'Hidden' Links: Instead of hyperlinking text like 'Click Here,' try writing out the full URL or using a clear button. Sometimes that helps bypass the filter. The button approach might be better visually as well

[Loamibathandbod]

Have tried hyperlinks, buttons, embedded items...all links are getting this same error. 

[throughtheriver]

I have tried using buttons and the same error happens. 

[RedHill]

I had not gotten this before, but with my most recent email my anti-virus is flagging all my links in the email. Is there no way to just turn off the tracking urls created by square? I don't want customers thinking we are sending them infected emails This is one of the links created:  https://zpzl839y.r.us-west-2.awstrack.me/L0/https:%2F%2Fsqclick.com%2Foutreach%2Ft%2FA6qxH7N6rTQA%2F...

[_Violet]

Hi all @timelord @RedHill @throughtheriver @Loamibathandbod @mitin 👋

Thank you for reaching out about this question regarding your Square Marketing Email links. I've escalated this directly to the Square Marketing engineers, so they can take a look, and provide more details.

I'll reach back out to you here once I gather more info!

[timelord]

Any updates?  This is still occurring, and our customers are either not getting the emails due to their spam filters or are concerned that when they click a link in our email, their malware defenses are flagging it.  Can we an option to not have Square wrap our links with this tracking?  At this point, this negates the email marketing feature's value we are paying for.

[mitin]

Hi @timelord 

This issue is strictly on the square side, not on your platform or website, Its something Square would need to fix

What’s actually causing the warning

1. Square rewrites links through tracking + redirect domains

Square Marketing uses:

• AWS tracking domains (*.awstrack.me)

• Their own redirect layer (sqclick.com)

Safari and Chrome don’t just check SSL anymore — they check:

• Redirect chains

• Domain reputation

• Known tracking infrastructure

• Link obfuscation patterns

Long redirect chains + URL encoding = phishing-like pattern
Browsers flag it even if SSL is technically valid.

---

2. Why it shows “Your connection is not private”

That warning can mean:

• Invalid or mismatched certificate OR

• Browser distrust of the redirect domain OR

• Tracking domain recently flagged or reputation-degraded

Square’s tracking domain is being flagged, not your website.

@_Violet This should be escalated within Square, I am sure its affecting many people, at the minimum it should allow the customers no disable tracking withing their configuration to avoid such flags

[_Violet]

Hi all @timelord @RedHill @throughtheriver @Loamibathandbod @mitin - I appreciate your patience here.

When I replied on 1/29, I mentioned that I escalated this directly to the Square Marketing Engineers. They've let me know that they have stabilized the issue and are investigating the root cause.

@timelord I see this doesn't seem to be the case for you though 😞 I've just reached out to them again to let them know. I'll follow up with you all again, once I have another update to share.

Again, I thoroughly appreciate your patience 🙏