First, which Microsoft product is it?
Microsoft runs two separate systems. Microsoft Defender Antivirus scans files on the device and names the threat it finds. SmartScreen checks the reputation of downloads, apps and websites. Microsoft's developer FAQ says SmartScreen "isn't related to Microsoft Defender Antivirus", so a fix for one does not change the other.
People meet SmartScreen as a "Windows protected your PC" window or as a red block page in Edge. They meet Defender Antivirus as a threat name in Windows Security. Microsoft uses no third-party engine, and the two systems decide on their own.
Who can't reach you right now
Where the verdict shows up
These Microsoft products act on the same verdicts:
Microsoft EdgeBrowser, blocks sitesWindowsChecks downloaded filesSmart App ControlWindows 11 app blockingDefender for EndpointBusiness protectionThese engines are independent from Microsoft. If they flag you too, each one needs its own request:
Kaspersky →
ESET →
Bitdefender →
Google Safe Browsing →How to tell if you're flagged
- The warning on the screen. A threat name in Windows Security means Defender Antivirus. A "Windows protected your PC" window means SmartScreen. A red page in Edge means SmartScreen blocks the site. We found no public SmartScreen lookup for a URL.
VirusTotal. Scan the URL or file and find the Microsoft row. The same scan shows whether other engines flag you too.- A clean test machine. Download or run your file on a fresh Windows device and open your site in Edge.
- User reports. Ask affected users for a screenshot of the warning. A Defender Antivirus screenshot shows the threat name.
FormatMicrosoft names are written as Type:Platform/Family.Variant!Suffix, for example Trojan, Backdoor, Ransom or HackTool as the type.PUA:Potentially unwanted application. Microsoft says PUAs are not considered malware. Related types are PUAAdvertising and PUABundler.Program: / Misleading:Unwanted software types. They name software that Microsoft does not treat as a classic virus.Behavior:The detection is based on what the file does when it runs.!A suffix that begins with ! is an indicator Microsoft uses internally. Copy it into your report as the product shows it.Asking Microsoft to fix it
Find out which system flags you
A threat name in Windows Security means Defender Antivirus. A "Windows protected your PC" window means SmartScreen. A red page in Edge means SmartScreen blocks the site. Write down the exact text, because the channel for each case is different.
Check that it is a mistake
Scan your server and your scripts for injected code, and rebuild files from clean source. A SmartScreen warning for an unknown file is not a block. Microsoft says "Warnings for unknown software aren't blocks", so a new file with no reputation can show one without any detection.
Report a blocked website from the Edge block page
On the block page in Edge, choose More information, then "Report that this site doesn't contain (malware/phishing) threats". Wait for a confirmation email from the SmartScreen Reputation Group. If the matter is urgent, reply to that email. Microsoft states no time for the review. A site flagged as phishing has no file to send, so say what the site is, who owns it and what each form on the page collects.
Website flagged as phishing
Reply to the SmartScreen confirmation email:
Body: hxxps://example[.]com is the website of our company,
Example Ltd. SmartScreen blocks it as phishing.
We own the domain and run the site ourselves. The only
form is the customer login at hxxps://example[.]com/login,
and it sends data to our own server. The site offers
nothing to download. Please review the verdict.
Submit a file as a software developer
Open the official form at microsoft.com/wdsi/filesubmission and choose Software developer. Microsoft accepts submissions only through this portal and has no email address for them. A personal Microsoft account works for the form, and no company account is needed. For a SmartScreen download warning, use the same form and select "Microsoft Defender SmartScreen" in the product menu. The upload limit is 50 MB. Put a ZIP or RAR archive under the password "infected", and send only the specific files. The additional information holds 1,900 characters, in English. Solve the CAPTCHA and submit.
File flagged as malware
Submit as: Software developer
Product: Microsoft Defender Antivirus
Company name: Example Ltd
File: example-app-setup.zip (password: infected)
Detection name: <name exactly as Windows Security shows it>
What do you believe
this file is? Incorrectly detected as malware
Definition version: <version from Windows Security>
Additional information: This file is the installer of our product
Example App 2.1. Defender detects it as a
threat. We built it from our own source.
The official download page is
hxxps://example[.]com/download. Please
review the verdict.
(limit: 1,900 characters, in English)
Track the submission and rescan
Sign in with a Microsoft account and open microsoft.com/wdsi/submissionhistory to see the history. Use "rescan" on the details page of a submission. The form offers priority levels. Microsoft says Low "may never be processed by an analyst", Medium is processed "within a few days", and High is "within two hours" and is for emergencies only. If you disagree with the result, Microsoft says to "use the developer contact form provided with the submission results".
Check the result
Update Windows Security on the test device, then run your file again. Edge caches SmartScreen results on the device. Clearing the browsing cache and the download history clears them, so a visitor who still sees the block should do that first. Scan your file or URL on VirusTotal and look at the Microsoft row.
Other ways to report
Microsoft Defender explains its own rules for false positives on these pages: