A warning about a “potentially risky site” can appear without warning while browsing. It describes high-risk content and may offer a way to continue anyway. Is the computer infected? Did the browser, Windows, or the Internet provider block the connection? How do we keep that protection when we leave the home network?

The right first step is not buying another antivirus or clicking “visit anyway.” It is identifying which layer raised the alert and examining the defenses available at each level.

This is an anonymized educational scenario. The originally flagged website, Internet provider, real screenshots, accounts, names, identifiers, access dates, and device details have been removed. Any technical paths below are publicly documented Windows and Edge conventions, not personal information.

1. Which layer blocked the website?

Several defenses can stop a connection:

LayerWhat it may checkImportant limitation
Internet provider or home routerDomain reputation and known threats, depending on the serviceProtection may disappear when switching networks.
Browser (Microsoft Defender SmartScreen)Reported phishing/malware sites and suspicious downloadsA warning does not prove the computer is infected.
Filtering DNS resolverDomains appearing on threat intelligence listsUsually does not inspect a URL’s specific path or the page content.
Windows Security / antivirusRisky apps, files, and suspicious behaviorIt does not replace web reputation or DNS protections.

The brand or URL on a warning page may suggest the source, but the warning alone is not conclusive attribution. Check the provider’s security events, browser configuration, and operating system protection history.

Crucially, a blocked destination can be dangerous even when the local computer is clean. An advertisement, deceptive link, or redirect can lead to that warning.

2. Harden Edge without unnecessarily breaking websites

In Microsoft Edge, open edge://settings/privacy/security and check:

  1. Microsoft Defender SmartScreen: warnings for phishing, malicious websites, and risky downloads.
  2. Block potentially unwanted apps: protection against low-reputation software downloads.
  3. Website typo protection: warnings for deceptive lookalike domains.
  4. Automatically switch to HTTPS: attempts encrypted web connections where appropriate; HTTPS alone does not prove a website is trustworthy.
  5. Enhance your security on the web → Balanced: additional mitigations for unfamiliar sites without requiring maximum restrictions everywhere.
  6. Scareware blocker, if available: detection of fake infection alerts and fraudulent technical-support pages.

Strict can apply more mitigations but may break some websites. Balanced is a practical default. Depending on the Edge version, users can choose stricter protection for InPrivate sessions.

Scareware protection is another layer; it does not establish that any particular website is malicious.

3. Edge SmartScreen and Windows SmartScreen are different controls

Under Windows Security → App & browser control → Reputation-based protection, look for:

  • Check apps and files: app/file reputation checks for downloads from the Internet.
  • SmartScreen for Microsoft Edge: website and download protection inside Edge.
  • Potentially unwanted app blocking: blocking unwanted programs and downloads.
  • SmartScreen for Microsoft Store apps: reputation checks for web content used by Store apps.

Edge SmartScreen being on does not prove that “Check apps and files” is enabled in Windows. Verify both separately. Keep real-time antivirus protection and the firewall enabled.

A grayed-out option labeled “This setting is managed by your administrator” does not, on its own, prove remote control by an organization. The cause may be a local policy, management agent, security software, or another policy mechanism.

4. Diagnose policies without weakening defenses

Visit edge://policy first. It displays policy names, values, sources, and statuses.

An “Error, Ignored” status means that a policy is not being applied as intended. It is neither evidence that the requested defense is active nor proof that someone maliciously administers the device. Treat it as a diagnostic clue.

These PowerShell checks are read-only:

# Is this PowerShell session elevated?
([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

# Edge policies; does not modify the registry
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -ErrorAction SilentlyContinue |
  Select-Object SmartScreenEnabled, SmartScreenPuaEnabled, DnsOverHttpsMode

# Windows app/file SmartScreen policy
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -ErrorAction SilentlyContinue |
  Select-Object EnableSmartScreen

In Microsoft’s documented Windows policy, EnableSmartScreen=0 means disabled and 1 means enabled. This is a separate control from Edge’s own SmartScreen setting.

If the administrator check returns False, the current PowerShell session is not elevated. Registry access errors do not automatically imply malware or a compromised account.

Do not delete registry policies, take ownership of protected keys, or disable Defender just to unlock a switch. For managed computers, contact the responsible administrators. On personal devices, first establish the policy’s origin, back up its current state, change only what is necessary through the appropriate management mechanism, and verify defenses after restarting. A third-party management tool may restore the policy.

5. Encrypted DNS is not the same as DNS threat filtering

DNS resolves a name such as example.org into a network address. DNS over HTTPS (DoH) encrypts queries between the browser and DNS resolver. This limits exposure in transit, but does not guarantee that the chosen resolver blocks malware.

Some public resolvers focus on speed or privacy and do not filter threats. Others offer separate filtering configurations.

Quad9 documents a free threat-blocking option:

PurposeValue
DNS over HTTPShttps://dns.quad9.net/dns-query
Primary IPv4 DNS9.9.9.9
Alternative IPv4 DNS149.112.112.112

To use it in Edge:

  1. Open edge://settings/privacy/security.
  2. Turn on Use secure DNS.
  3. Choose Choose a service provider.
  4. Enter https://dns.quad9.net/dns-query and save.

If the control is disabled, inspect Edge’s policy state and restrictions before touching the registry. Edge’s DNS configuration need not match the router’s or Windows’. VPNs, managed profiles, and applications using their own DNS resolution can also affect the result.

Verify what the test actually establishes

Open on.quad9.net in the configured browser. A “YES” result indicates that the check reached Quad9; it does not independently prove the query used encrypted DoH. Quad9 also documents a system-level protocol test:

Resolve-DnsName -Type txt proto.on.quad9.net.

Here doh indicates DNS over HTTPS for the tested query, while do53-udp and do53-tcp indicate traditional DNS. PowerShell usually tests Windows’ DNS path, not necessarily Edge’s internal resolver: do not confuse those measurements.

To protect other applications, configure Windows DNS separately, considering IPv4, IPv6, encryption, and VPN behavior. A browser-only test does not establish system-wide DNS filtering.

6. What these layers cannot do

Filtering DNS is not antivirus software and does not inspect every URL path, download, or web payload. SmartScreen cannot identify every emerging threat either. Filtering can generate false positives and negatives. DoH does not make a fraudulent page safe, and HTTPS verifies transport encryption rather than the site’s intentions.

Everyday defense also requires updates, active endpoint protection, a firewall, unique passwords, multifactor authentication, backups, and refusing to bypass warnings without investigating them.

Checklist: a sensible verification process

  • Determine whether the initial block came from the network, browser, or OS.
  • Check Edge SmartScreen and Windows “Check apps and files” independently.
  • Use Balanced and enable download/scam protections when available.
  • Review edge://policy for restrictions; investigate before modifying settings.
  • Choose a DNS resolver that both encrypts and filters if both are goals.
  • Verify resolver and transport separately, and distinguish browser from OS DNS.
  • Never treat one warning as confirmed infection or one “YES” as perfect security.

The lesson

Real protection is not one router, antivirus product, or browser setting. It is a set of complementary layers, each verified independently, with evidence-based and reversible changes. An unexpected warning can become a useful security check without fearmongering or disabling valuable safeguards.

References