Microsoft SmartScreen Blocking My Website: How to Report a False Positive

What a Microsoft Defender SmartScreen flag looks like

A full-page red Microsoft Edge interstitial saying the site has been reported as unsafe, with a More information link. On Windows, Defender SmartScreen can also block a download from the site. A 'not commonly downloaded' warning on a file is different: it means the file has little reputation yet, not that the site is flagged.

Why clean sites end up flagged here

• URL reputation: a newly registered domain, a malicious history, the hosting provider, or low traffic volume — all factors Microsoft lists.
• Page content that looks deceptive: login or payment forms, malicious scripts or phishing pages, including ones injected by a compromise.
• Files served from the site that are unsigned or were previously detected.
• TLS problems — an invalid certificate or an old protocol version — and heavy redirects or obfuscated JavaScript.
• User reports: enough visitors reporting the site as unsafe.

Where to submit: Edge block page → More information → Report that this site doesn't contain threats

https://learn.microsoft.com/en-us/troubleshoot/microsoft-edge/development/unexpected-block-warning

Account: None; the report starts from the SmartScreen block page in Microsoft Edge.

What it asks for:

1. Started from the block page for the specific URL, so the report is per URL
2. An indication that you are the site owner or a representative
3. The information the feedback page asks for about the site

Microsoft's 'Report an unsafe site' page on the Security Intelligence portal only reports phishing or malware — it has no 'not unsafe' option. Blocked downloads are a different system (file reputation) and are reported through the WDSI file submission portal.

Step by step

1. Reproduce the block in Edge. Open the exact blocked URL in Microsoft Edge. Note whether it is a site block (red page) or a download block, because they are reported through different routes.
2. Fix what SmartScreen checks. Remove any injected script, redirect or phishing page; make sure HTTPS uses a valid certificate; check for web shells and suspicious uploaded files. Microsoft's own list of factors is the checklist.
3. Report from the block page. On the red page select More information, then 'Report that this site doesn't contain threats'. On the feedback page, indicate you are the site owner and describe the site and what changed. Repeat for each blocked URL.
4. Watch for the Reputation Group email. Microsoft says to wait for a confirmation message from the SmartScreen Reputation Group. If the matter is urgent, or you need a response after their investigation, reply to that message.
5. Handle downloads separately. If Edge or Windows blocks a file from the site, submit the file through the WDSI file submission portal. A 'not commonly downloaded' warning on a new, unsigned file fades as the file builds reputation; code signing helps.

What to write

Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.

Site owner report for {URL}.
The site is a {one-line description of what the site is}. {Either: 'The content that triggered the warning ({what}) was removed on {date}; the URL now returns {404 / the clean page}.' Or: 'The page has not changed and hosts no phishing or malware; it has no login or payment form imitating another brand.'}
HTTPS uses a valid certificate issued to {domain}. Please re-review the URL and remove the warning.

Why requests get rejected, and the fix

• The content is still there — on another URL, a subdomain, or only served to some visitors. Check the whole site for the same pattern and re-test from an external network before reporting the next URL.
• The report went to the wrong channel — the 'Report an unsafe site' page or the file portal for a site block. Site blocks are reported from the Edge block page; file blocks through the WDSI file submission portal.
• Reputation signals are still weak: new domain, invalid certificate, unsigned downloads. Fix the certificate and sign downloadable files; new domains gain reputation with time and clean traffic.

Who copies this verdict

• Windows Defender SmartScreen and Microsoft Defender for Endpoint on managed Windows devices use the same Microsoft verdict, so they clear with it.

Sources

• Microsoft Learn — Unexpected SmartScreen block or warning on website
• Microsoft Defender SmartScreen — Frequently Asked Questions
• Microsoft Learn — Microsoft Defender SmartScreen overview