Enable or disable security alerts about links and files from suspicious websites

This article describes the risks involved when a document that you are working on contains a link to a suspicious website or when you try to open a file from a suspicious website. Microsoft Office helps protect you from these risks with settings in the Trust Center. In Office 2013, 2010, and 2007, you can modify these settings. The option to modify these settings is not available in Office 2016.

Newer Versions Office 2007



Enable or disable security alerts about links to suspicious websites

In Office, detection of suspicious links to websites is turned on by default. You can turn detection off so that you don't get security alerts. But we do not recommend this.

1. In an Office program, click the File tab.

2. Click Options.

3. Click Trust Center, and then click Trust Center Settings.

4. Click Privacy Options.

5. Under Privacy Options, select or clear Check Microsoft Office documents that are from or link to suspicious Web sites check box.

6. Click OK.

The following image is an example of the Privacy Options area of the Trust Center.

Top of page

How do I know if a link to a website is suspicious?

It's difficult to know if a link to a website is suspicious. However, security features in Office can prevent problems caused by clicking a link to a website that has malicious intent.

The following image is an example of an Outlook warning when a suspicious link is clicked.

Homograph attack, or spoofed websites

Options in the Trust Center can help protect you from malicious intent, such as a homograph attack, which are web addresses that use alphabet characters from different languages. The web address appears legitimate but could open a site that has malicious intent.

For example, the following web address looks legitimate, but what you cannot see is that the letter i in microsoft.com is a Cyrillic character from the Ukrainian alphabet: www.microsoft.com

How to respond to the alert message

An alert message appears when you click a link to a website that uses a potentially spoofed domain name. You can choose to visit the site, or you can click No on the alert message, which is what we recommend.

More safety and online-fraud information

You can learn more about online fraud in: Protect yourself from phishing schemes and other forms of online fraud.

Minimize the risk of cyberbullying, help children use social networking sites more safely, and use parental controls in Microsoft products to help keep your family safer online: Microsoft Online Safety.

Top of page

Disable security alerts for a website

If you know that a particular website is trustworthy, you can disable the alerts by adding the website to your Trusted Sites zone in Internet Explorer. Trusted sites can be on your organization's intranet, or sites that you learned about from trusted sources.

1. In Internet Explorer, on the Tools menu, click Internet Options.

2. On the Security tab, click Trusted sites, and then click Sites.

3. In the Add this Web site to the zone box, type or select the address of the website, and then click Add.

   Note: If you want Internet Explorer to verify that the server for each website in this zone is secure before you connect to any websites in this zone, select the Require server verification (https:) for all sites in this zone check box.

4. Click OK.

Note: By default, no websites are assigned to the Trusted Sites zone, and the security level for the Trusted Sites zone is set to Low.

Top of page

What is a homograph attack?

A homograph is a word with the same spelling as another word but with a different meaning. In computers, a homograph attack is a Web address that looks like a familiar Web address but is actually altered. This occurs when the domain name was created by using alphabet characters from different languages, not just English. For example, the following Web address looks legitimate, but what you can't see is that the "i" is a Cyrillic character from the Ukrainian alphabet.

www.microsoft.com

Phishers spoof the domain names of banks and other companies in order to deceive consumers into thinking that they are visiting a familiar Web site. Special software is needed to detect these kinds of spoofed domain names in Web addresses. See the next section to learn more about how The 2007 Office release helps protect you from links that attempt to lead you to suspicious Web sites.

Top of page

How can the Trust Center help protect me from homograph attacks?

By default, the 2007 Office release displays security alerts in the following situations:

• You have a document open and you click a link to a Web site with an address that has a potentially spoofed domain name.

• You open a file from a Web site with an address that has a potentially spoofed domain name.

The following is the alert that appears when you click a link to a Web site that uses a potentially spoofed domain name.

You can then choose whether to continue to visit the Web site. In this situation, we recommend that you click No. If you don't want to receive these alerts, you can disable them. For more information, see the next two sections.

Top of page

Enable or disable security alerts about links to and files from suspicious Web sites

Detection of potentially spoofed domain names is on by default. You can turn detection off so that you don't get security alerts, but we do not recommend this. Do the following in these 2007 Microsoft Office system programs:

Which 2007 Microsoft Office system program are you using?



• Which 2007 Microsoft Office system program are you using?
• Access
• Clip Organizer
• Excel
• InfoPath
• OneNote
• PowerPoint
• Project
• SharePoint Designer
• Visio
• Word

1. Click the Microsoft Office Button , and then click Access Options.

2. Click Trust Center, click Trust Center Settings, and then click Privacy Options.

3. Clear the Check Office documents that are from or link to suspicious Web sites check box.

1. On the Help menu, click Customer Feedback Options.

2. Under Web Link Privacy, clear the Check Office documents that are from or link to suspicious Web sites check box.

1. Click the Microsoft Office Button , and then click Excel Options.

2. Click Trust Center, click Trust Center Settings, and then click Privacy Options.

3. Clear the Check Office documents that are from or link to suspicious Web sites check box.

1. On the Tools menu, click Trust Center, and then click Privacy Options.

2. Clear the Check Office documents that are from or link to suspicious Web sites check box.

1. On the Help menu, click Customer Feedback Options.

2. Under Web Link Privacy, clear the Check Office documents that are from or link to suspicious Web sites check box.

1. Click the Microsoft Office Button , and then click PowerPoint Options.

2. Click Trust Center, click Trust Center Settings, and then click Privacy Options.

3. Clear the Check Office documents that are from or link to suspicious Web sites check box.

1. On the Help menu, click Customer Feedback Options.

2. Under Web Link Privacy, clear the Check Office documents that are from or link to suspicious Web sites check box.

1. On the Help menu, click Customer Feedback Options.

2. Under Web Link Privacy, clear the Check Office documents that are from or link to suspicious Web sites check box.

1. On the Tools menu, click Trust Center, and then click Privacy Options.

2. Clear the Check Office documents that are from or link to suspicious Web sites check box.

1. Click the Microsoft Office Button , and then click Word Options.

2. Click Trust Center, click Trust Center Settings, and then click Privacy Options.

3. Clear the Check Office documents that are from or link to suspicious Web sites check box.

Disable security alerts for a Web site by marking it as a Trusted site

If you think that a particular Web site is trustworthy, you can disable the alerts by adding the Web site to your Trusted sites zone in Windows Internet Explorer. The Trusted sites zone contains Web sites that you consider to be safe, such as sites that are located on your organization's intranet or sites that you learned about from established sources in whom you have confidence. When you add a Web site to the Trusted sites zone, you indicate that you think any files that you download or run from that Web site will not damage your computer or data. By default, no Web sites are assigned to the Trusted sites zone, and the security level for the Trusted sites zone is set to Low.

Assign a Web site to the Trusted sites zone

1. In Internet Explorer version 5, 6, or 7, on the Tools menu, click Internet Options.

2. On the Security tab, click Trusted sites, and then click Sites.

3. In the Add this Web site to the zone box, type or select the address of the Web site, and then click Add.

4. If you want Internet Explorer to verify that the server for each Web site in this zone is secure before you connect to any Web sites in this zone, select the Require server verification (https:) for all sites in this zone check box.

5. Click OK twice.

Top of page