Microsoft SmartScreen

SmartScreen (officially called Microsoft Defender SmartScreen, and formerly Windows SmartScreen, Windows Defender SmartScreen and SmartScreen Filter in different places) is a cloud-based anti-phishing and anti-malware component included in several Microsoft products:

• All versions of the Microsoft Windows operating system since Windows 8
• Web browsers Internet Explorer and Microsoft Edge
• Xbox One and Xbox Series X and Series S video game consoles
• Online services Microsoft 365 (including Microsoft Outlook and Exchange) and Microsoft Bing.

SmartScreen as a business unit includes the intelligence platform, backend, serving frontend, UX, policy, expert graders, and closed-loop intelligence (machine learning and statistical techniques) designed to help protect customers from safety threats like social engineering and drive-by downloads.

SmartScreen in Internet Explorer

Internet Explorer 7: Phishing Filter

SmartScreen was first introduced in Internet Explorer 7, then known as the Phishing Filter. Phishing Filter does not check every website visited by the user, only those that are known to be suspicious.

Internet Explorer 8: SmartScreen Filter

With the release of Internet Explorer 8, the Phishing Filter was renamed to SmartScreen and extended to include protection from socially engineered malware. Every website and download is checked against a local list of popular legitimate websites; if the site is not listed, the entire address is sent to Microsoft for further checks. If it has been labeled as an impostor or harmful, Internet Explorer 8 will show a screen prompting that the site is reported harmful and shouldn't be visited. From there the user can either visit their homepage, visit the previous site, or continue to the unsafe page. If a user attempts to download a file from a location reported harmful, then the download is cancelled. The effectiveness of SmartScreen filtering has been reported to be superior to socially engineered malware protection in other browsers.

According to Microsoft, the SmartScreen technology used by Internet Explorer 8 was successful against phishing or other malicious sites and in blocking of socially engineered malware.

Beginning with Internet Explorer 8, SmartScreen can be enforced using Group Policy.

Internet Explorer 9: Application Reputation

In Internet Explorer 9, SmartScreen added protection against malware downloads by launching SmartScreen Application Reputation to identify both safe and malicious software. The system blocked known malware while warning the user if an executable was not yet known to be safe. The system took into account the download website’s reputation based on SmartScreen’s phishing filter launched in prior web browser versions Internet Explorer 7 and Internet Explorer 8.

Internet Explorer Mobile 10

Internet Explorer Mobile 10 was the first release of Internet Explorer Mobile to support the SmartScreen Filter.

Microsoft Edge

Chromium-based Microsoft Edge includes Microsoft Defender SmartScreen for website and download reputation checks, extending protections first introduced in Internet Explorer. Microsoft Edge Legacy, the original Edge browser built on Microsoft's proprietary engine and shipped with early Windows 10 releases, also included SmartScreen before it was replaced by the Chromium-based browser in 2020.

From 2024 onward, Microsoft added Edge-specific protections that complement SmartScreen's cloud reputation service. At Microsoft Ignite 2024, Microsoft announced a scareware blocker that uses a local machine learning model to detect full-screen tech support scam pages before they are indexed by SmartScreen. The feature entered public preview in January 2025 and was enabled by default on most Windows and Mac devices by late 2025.

Starting in Microsoft Edge version 142 (November 2025), a scareware sensor can notify SmartScreen immediately when the scareware blocker detects a suspicious full-screen page, without sending screenshots or data beyond what SmartScreen already receives, helping block newly reported scams worldwide more quickly. The sensor was disabled by default as of its introduction; Microsoft stated it intended to enable it for users who have SmartScreen turned on.

Addressed criticisms

In October 2017, criticisms regarding URL submission methods were addressed with the creation of the Report unsafe site URL submission page. Prior to 2017, Microsoft required a user to visit a potentially dangerous website to use the in-browser reporting tool, potentially exposing users to dangerous web content. In 2017, Microsoft reversed that policy by adding the URL submission page, allowing a user to submit an arbitrary URL without having to visit the website.

SmartScreen Filter in Microsoft Outlook was previously bypassable due to a data gap in Internet Explorer. Some phishing attacks use a phishing email linking to a front-end URL unknown to Microsoft; clicking this URL in the inbox opens the URL in Internet Explorer; the loaded website then, using client-side or server-side redirections, redirects the user to the malicious site. In the original implementation of SmartScreen, the "Report this website" option in Internet Explorer only reported the currently-open page (the final URL in the redirect chain); the original referrer URL in the phishing attack was not reported to Microsoft and remained accessible. This was mitigated beginning with some versions of Microsoft Edge Legacy by sending the full redirection chain to Microsoft for further analysis.

Deprecation in Internet Explorer and IE Mode

Starting with updates released in November 2025 for Windows 11 version 24H2 and later (including Windows Server 2025), Microsoft deprecated SmartScreen in Internet Explorer and Internet Explorer mode on Windows 11. SmartScreen remains active in Microsoft Edge, the Windows shell, and other supported environments, and continues to function in Internet Explorer and IE Mode on older Windows versions.

Files downloaded through IE or IE Mode on Windows 11 still receive Mark of the Web tagging; when opened, they are evaluated by SmartScreen in the Windows shell. Microsoft stated that SmartScreen in IE Mode was redundant for its intended use on enterprise-configured trusted intranet sites, and that retaining legacy SmartScreen components in IE would have caused instability after related infrastructure was removed.

SmartScreen in Windows

Windows 8 and Windows 8.1

In Microsoft Windows 8, SmartScreen added built-in operating system protections against web-delivered malware performing reputation checks by default on any file or application downloaded from the Internet, including those downloaded from email clients like Microsoft Outlook or non-Microsoft web browsers like Google Chrome.

Windows SmartScreen functioned inline at the Windows shell directly prior to execution of any downloaded software.

Whereas SmartScreen in Internet Explorer 9 warned against downloading and executing unsafe programs only in Internet Explorer, Windows SmartScreen blocked execution of unsafe programs of any Internet origin.

With SmartScreen left at its default settings, administrator privilege would be required to launch and run an unsafe program.

Reactions

Microsoft faced concerns surrounding the privacy, legality and effectiveness of the new system, suggesting that the automatic analysis of files (which involves sending a cryptographic hash of the file and the user's IP address to a server) could be used to build a database of users' downloads online, and that the use of the outdated SSL 2.0 protocol for communication could allow an attacker to eavesdrop on the data. In response, Microsoft later issued a statement noting that IP addresses were only being collected as part of the normal operation of the service and would be periodically deleted, that SmartScreen on Windows 8 would only use SSL 3.0 for security reasons, and that information gathered via SmartScreen would not be used for advertising purposes or sold to third parties.

Windows 10 and Windows 11

Beginning in Windows 10, Microsoft placed SmartScreen settings in the Windows Security app (formerly Windows Defender Security Center). SmartScreen evaluates files that any application, including third-party browsers and email clients, attempts to download and run.

Windows 11 added Enhanced Phishing Protection, which warns users when they enter work or school passwords into reported phishing sites, sites with invalid certificates, or unsafe applications, and can be managed through Group Policy or Microsoft Intune.

Further Windows 10 and Windows 11 updates have added enterprise configurability through Group Policy and Intune as part of Microsoft's endpoint protection products.

SmartScreen in Outlook

Outlook.com uses SmartScreen to protect users from unsolicited e-mail messages (spam/junk), fraudulent emails (phishing) and malware spread via e-mail. After its initial review of the body text, the system focuses on the hyperlinks and attachments.

Junk mail (spam)

To filter spam, SmartScreen Filter uses machine learning from Microsoft Research which learns from known spam threats and user feedback when emails are marked as "Spam" by the user.

Over time, these preferences help SmartScreen Filter to distinguish between the characteristics of unwanted and legitimate e-mail and can also determine the reputation of senders by a number of emails having had this checked. Using these algorithms and the reputation of the sender is an SCL rating (Spam Confidence Level score) assigned to each e-mail message (the lower the score, the more desirable). A score of -1, 0, or 1 is considered not spam, and the message is delivered to the recipient's inbox. A score of 5, 6, 7, 8, or 9 is considered spam and is delivered to the recipient's Junk Folder. Scores of 5 or 6 are considered to be suspected spam, while a score of 9 is considered certainly spam. The SCL score of an email can be found in the various x-headers of the received email.

Phishing

SmartScreen Filter also analyses email messages from fraudulent and suspicious Web links. If such suspicious characteristics are found in an email, the message is sent directly to the Spam folder, with a red information bar at the top of the message that warns of the suspicious properties. SmartScreen also protects against spoofed domain names (spoofing) in emails to verify whether an email is sent by the domain which it claims to be sent. For this, it uses the technology Sender ID and DomainKeys Identified Mail (DKIM). SmartScreen Filter also helps users distinguish email from authenticated senders by placing a green-shield icon in the subject line of those messages.

Effectiveness

Browser social engineering protection

In late 2010, the results of browser malware testing undertaken by NSS Labs were published. The study looked at the browser's capability to prevent users following socially engineered links of a malicious nature and downloading malicious software. It did not test the browser's ability to block malicious web pages or code.

According to NSS Labs, Internet Explorer 9 blocked 99% of malware downloads compared to 90% for Internet Explorer 8 that does not have the SmartScreen Application Reputation feature as opposed to the 13% achieved by Firefox, Chrome, and Safari; which all use a Google Safe Browsing malware filter. Opera 11 was found to block just 5% of malware. SmartScreen Filter was also noted for adding legitimate sites to its blocklists almost instantaneously, as opposed to the several hours it took for blocklists to be updated on other browsers.

In early 2010, similar tests had given Internet Explorer 8 an 85% passing grade, the 5% improvement being attributed to "continued investments in improved data intelligence". By comparison, the same research showed that Chrome 6, Firefox 3.6 and Safari 5 scored 6%, 19% and 11%, respectively. Opera 10 scored 0%, failing to "detect any of the socially engineered malware samples".

In July 2010, Microsoft claimed that SmartScreen on Internet Explorer had blocked over a billion attempts to access sites containing security risks. According to Microsoft, the SmartScreen Filter included in Outlook.com blocks 4.5 billion unwanted e-mails daily from reaching users. Microsoft also claims that only 3% of incoming email is junk mail but a test by Cascade Insights says that just under half of all junk mail still arrives in the inbox of users. In a September 2011 blog post, Microsoft stated that 1.5 billion attempted malware attacks and over 150 million attempted phishing attacks have been stopped.

In 2017, Microsoft addressed criticisms about the URL submission process by creating a dedicated page to report unsafe sites, rather than requiring users to visit the potentially dangerous site.

SmartScreen expanded to protect users against new threats such as tech-support scams, potentially unwanted applications (PUAs), and drive-by attacks that do not require user interaction.

Recent developments

In Chromium-based Microsoft Edge, SmartScreen blocks URLs associated with potentially unwanted applications in addition to phishing and malware sites. From 2025, Microsoft paired SmartScreen with a local scareware blocker in Edge that detects full-screen tech-support scam pages before they appear in SmartScreen's blocklist; an optional scareware sensor in Edge 142 can then notify SmartScreen immediately to accelerate global blocking. In November 2025, Microsoft deprecated in-browser SmartScreen for Internet Explorer and IE Mode on Windows 11 while retaining shell-level file scanning for downloads tagged with Mark of the Web.

Criticism

Validity of browser protection tests

Manufacturers of other browsers have criticized the third-party tests which claim Internet Explorer has superior phishing and malware protection compared to that of Chrome, Firefox, or Opera. Criticisms have focused mostly on the lack of transparency of URLs tested and the lack of consideration of layered security additional to the browser, with Google commenting that "The report itself clearly states that it does not evaluate browser security related to vulnerabilities in plug-ins or the browsers themselves", and Opera commenting that the results appeared "odd that they received no results from our data providers" and that "social malware protection is not an indicator of overall browser security".

Windows malware protection

SmartScreen builds reputation based on code signing certificates that identify the author of the software. This means that once a reputation has been built, new versions of an application can be signed with the same certificate and maintain the same reputation.

However, code signing certificates need to be renewed every two years. SmartScreen does not relate a renewed certificate to an expired one. This means that reputations need to be rebuilt every two years, with users getting frightening messages in the meantime. Extended Validation (EV) certificates seem to avoid this issue, but they are expensive and difficult to obtain for small developers.

SmartScreen Filter creates a problem for small software vendors when they distribute an updated version of installation or binary files over the internet. Whenever an updated version is released, SmartScreen responds by stating that the file is not commonly downloaded and can therefore install harmful files on your system. This can be fixed by the author digitally signing the distributed software. Reputation is then based not only on a file's hash but on the signing certificate as well. A common distribution method for authors to bypass SmartScreen warnings is to pack their installation program (for example Setup.exe) into a ZIP-archive and distribute it that way, though this can confuse novice users.

Another criticism is that SmartScreen increases the cost of non-commercial and small scale software development. Developers either have to purchase standard code signing certificates or more expensive extended validation certificates. Extended validation certificates allow the developer to immediately establish reputation with SmartScreen but are often unaffordable for people developing software either for free or not for immediate profit. The standard code signing certificates however pose a "catch-22" for developers, since SmartScreen warnings make people reluctant to download software, as a consequence to get downloads requires first passing SmartScreen, passing SmartScreen requires getting reputation and getting reputation is dependent on downloads.

See also

• Anti-phishing software
• Google Safe Browsing
• macOS Gatekeeper

External links

• Microsoft Defender SmartScreen overview at Microsoft Learn
• Report unsafe site — URL submission page for SmartScreen