nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

What in the WHAT Atlassian? Making Shadow (Accidental) IT even easier!

Darryl Lee

Oh hi. You may remember these old posts:

tl;dr

In March/April 2025 Atlassian seemed to have made fixes to product pages that made it too easy for users to create new sites when they just were trying to log in. In the last 10 days or so, it looks like they've made it EVEN WORSE than it was before.

Long version

Thanks to an overzealous marketing funnel, Atlassian made it way too easy for users who are simply trying to login to their sites to instead accidentally create new Jira or Confluence sites. The problem was that people don't remember their exact Jira or Confluence site URLs, but figure that like every other SaaS product, if they just Google search for "jira" or "confluence" that it'll eventually take them to the right place.

In most cases, users had previously logged on to Jira or Confluence, so there were existing session cookies that Atlassian COULD see and use to guide users to log into their EXISTING Jira/Confluence sites instead of leading them to create new sites. (Which admins then have to go in and delete.)

Back in March/April it seemed like Atlassian had made some progress on fixing this, despite the lack of updates to CLOUD-12193 - Reduce occurrences of accidental site creations.

10 new sites in the last 9 days

As of Jun 26, 2025, we've had 10 new sites created by accident in the past 9 days. This is the highest rate of accidental site creation that've I've seen since we migrated to cloud in May 2024 and begun to accidental sites created at a rate of maybe 1-2 per week.

I took a very brief look at what is happening, and it seems like there was a regression. For Jira, it gives you a very pleasant, "Welcome back, Darryl" message, but the URL it suggests? That is a NEW SITE that it will create if I click Continue.

Screenshot 2025-06-26 at 1.54.41 PM.png

There is NOTHING on that page indicating to a user that they are creating a new site. At least before we could point out to users that they clicked through screens that said "Sign up" or "Agree" and had words like "no credit card needed":

But this? This is HORRIBLE, and explains why we're seeing this spike of accidental site creations.

Yes, I'm going to post a Support ticket. But I wanted to put this out here in case other people are seeing the same issue.

Accepted answers

All comments

Vilius Šumskas

Completely agree. I started wondering why these sites started to popup, in "New apps" page. Now I know. We should be able to have possibility to deny new site creation for managed users. This should be done only by org. admins.

Darryl Lee

So ok, I've done some more testing, and I think I've figured out that the SALES and MARKETING team or whoever is trying to drive up their SALES NUMBERS is doing something shady with the SPONSORED GOOGLE LINKS.

Screenshot 2025-06-26 at 1.54.44 PM.png

So here’s the URL of the first link above :
https://www.atlassian.com/software/jira?campaign=18440774103&adgroup=136973856930&targetid=kwd-855725830&matchtype=e&network=g&device=c&device_model=&creative=639487383004&keyword=jira&placement=&target=&ds_eid=700000001558501&ds_e1=GOOGLE&gad_source=1&gad_campaignid=18440774103&gbraid=0AAAAAD_uzhBkCOWEFUEOB9am0JwH3RAOl&gclid=CjwKCAjw3_PCBhA2EiwAkH_j4g-JDVCFDwmi3qg9Jt3z_DySc5s4PhZsmlRpS70HYm7fVGly1UK0VRoCOHMQAvD_BwE

And it generated yet ANOTHER new darryllee-123456789.atlassian.net random site ready to be created if I click the big blue Continue button.

BUT, if I scroll down and click the first ORGANIC (not Sponsored) Google Link for Jira, then I get PROPERLY prompted to log into my actual Jira site.

Screenshot 2025-06-26 at 10.21.47 PM.png

So yeah, some go getter in SALES and MARKETING decided that tricking existing users into creating new sites was a great way to boost their monthly numbers.

Mission accomplished! So many new sites created!

Now look at the numbers of cancelled/deleted sites?

I guess they're banking on the fact that people won't notice and won't cancel or delete them. And by that time, they've hit their targets and woohoo, that Cadillac El Dorado, or a set of steak knives.

chris sieverts

we just had this happen the other day and what added to the confusion about the legitimacy of the site is that it showed as a 'premium'. the user did say it was accidental & the result of trying to log into our existing implementation.

So this leads me to asking all, how do you determine what is a 'legit' instance vs accidental? are you simply having to ask the person who created the instance?

Thanks!

Bill Sheboy

Thanks, @Darryl Lee , and...

A.B.C. = Always Be Creating [new sites]

Darryl Lee

I email the site creators. I have a whole form letter ready to go.

Not all folks replied, but those who have confirm that they didn't know they were creating new sites and were just trying to log in.

Again, 100% of people who responded said they accidentally created sites while trying to log in.

Darryl Lee

Ok, has it been 24 hours? Yes ok.

Perhaps I was a bit hasty to scream at the Sales guys and assume bad intent.

But hey, GGR is a great movie.

So upon further inspection and reflection, this is a DIFFERENT KIND OF SCREW-UP.

I think this is because Atlassian revamped their "home pages" for Jira and Confluence.

Before	After

You'll notice that in the new design, they put the LOGIN BOX right there.

I'm sure the designers were like "YES! We are eliminating clicks!"

Yes, if it worked, this should absolutely streamline logging in.

But alas. It does not. As evidenced by the TEN accidental sites I've had created in the last TEN days.

So. #CANHAZFIX?

I've uploaded all my cookies to my Support ticket. Maybe I'll give them a HAR file they didn't ask for. I still don't think it's been escalated to the right people yet.

Darryl Lee

Welp, I filed a ticket about this, and it finally got routed to "Marketing and Search-Optimization specialists" last week.

Tested again today, and whew, I think our long national nightmare is over. :-}

Or well, let's hope they fixed it. I haven't heard back on that ticket, so I wrote them:

Hey! I haven’t heard anything, but I decided to test today, and it appears that the Sponsored Links that Google is returning for searches for jira or confluence are no longer leading people to create new sites.

Woot!

Do you have any information from Marketing and Search-Optimization that would confirm they changed something to fix this? It would be great to know affirmatively that this was something they fixed.

Thank you!

Because admitting you have a problem is the first step towards recovery. :-}

Steve Rhodes

Hi Darryl, the latest from my side, the Guard-free side is that people are still creating useless sites with our company emails. This year around 91 sites so far. Atlassian's response in a ticket was to start (another) Guard trial and claim them. But there's more...

Screenshot 2025-08-06 at 15.14.49.png

Because of these sites that I can't shut down, I now have users who have left the company that I'm unable to deactivate because they are the key user:

You can't deactivate this account
The account for -name redacted- can't be deactivated because:

User is last billing admin of a transaction account that has one or more active entitlements.
User is last billing admin of a transaction account that has one or more non-cancelled subscriptions.

Screenshot 2025-08-06 at 15.18.19.png

They are the admins on these shadow sites and it tells me which sites which is at least something because in the Discovered Products section above it does not even give me the name of the site unless I have Guard.

We don't even have the problem of not being able to delete the sites because of Rovo, because we can't claim them.

Vilius Šumskas

What I usually do in such case is create an email alias of ex-employee's email to my own email, then login with their Jira credentials and claim billing admin/org admin permissions on that site.

Steve Rhodes

Thats a great solution :-)

Darryl Lee

Oh man, I'm sorry to hear about that situation Steve. That really sucks.

Yes - if you have control over your email, I think @Vilius Šumskas's is spot-on.

But man, what a hassle. And this is for a CLAIMED DOMAIN, no less!

Abbey Lawe

Hi all,

I'm a Product Manager on the Admin Experiences team, conducting research on this issue.

Your feedback has already helped us ship several updates to www.atlassian.com with the purpose of reducing site proliferation. We’ve heard from several customers about a recent resurgence and are eager to better understand how we can continue to address this.

If you’re open to sharing more about your experience as an admin, please book time with our team here [https://atlassian.zoom.us/zbook/abbey-lawe] to help inform our roadmap. We'd be grateful for your insights.

Thank you for your time and continued feedback!

Abbey Lawe

Atlassian, Product Manager

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

jira-cloud