Built into Microsoft Defender SmartScreen, the feature can warn when that protected password is entered into a malicious or suspicious site or app, reused elsewhere, or stored in a plain-text location such as Notepad or supported Microsoft 365 apps. It is a useful second opinion at precisely the moment phishing pages want users to stop thinking and start typing.
Before you start: what Enhanced Phishing Protection does
Enhanced Phishing Protection is not a password manager, malware scanner, or a guarantee that every bad website will be identified. It is a Windows 11 protection layer focused on the password associated with your Windows sign-in.
Microsoft’s Windows documentation says the feature is available in Windows 11 version 22H2 and later. Its strongest documented protections are for work or school passwords used to sign in to Windows. Microsoft Support also describes protection for Microsoft credentials across browsers and apps.
The important catch is authentication method:
- You must sign in to Windows with a password for password-entry detection to apply.
- If you sign in solely with a Windows Hello PIN, fingerprint, or face recognition, Enhanced Phishing Protection may not produce these password-entry warnings.
- It protects the specific password Windows recognizes for the signed-in account—not every password stored in a browser or password manager.
- A work or school PC may have these settings controlled by an administrator through Intune, Group Policy, or other device-management tools.
In short: it is a safety net for Windows credentials, not permission to reuse passwords with abandon. Even the best safety net has limits when someone brings scissors.
Turn on Enhanced Phishing Protection
- Open Start and search for Windows Security.
- Select App & browser control in the left-hand navigation.
- Choose Reputation-based protection settings.
- Scroll to Phishing protection.
- Turn on Phishing protection if it is off.
- Enable the available warning options:
- Warn me about malicious apps and sites
- Warn me about password reuse
- Warn me about unsafe password storage
- Approve the User Account Control prompt if Windows requests permission.
The exact wording can vary slightly between Windows 11 releases, but the settings live under the same App & browser control and Reputation-based protection area.
What each warning means
| Setting | What Windows can warn about | Why it matters |
|---|---|---|
| Malicious apps and sites | Entering a protected Windows password into a site or application SmartScreen considers dangerous | A convincing fake sign-in page is still a fake sign-in page |
| Password reuse | Reusing the Windows sign-in password on another site or app | One breached service can become a master key to other accounts |
| Unsafe password storage | Typing or saving the protected password in an unprotected text-based app | Plain-text notes are a gift basket for malware and unauthorized users |
For most people, enabling all three warnings is the sensible configuration. The only meaningful trade-off is that Windows may interrupt a risky action with a warning dialog. That is rather the point.
Confirm Microsoft Defender SmartScreen is active
Enhanced Phishing Protection relies on Microsoft Defender SmartScreen, but SmartScreen also covers other Windows safety checks, including suspicious downloads and unrecognized applications.
While you are still on Reputation-based protection settings, verify that these items are enabled where available:
- Check apps and files
- SmartScreen for Microsoft Edge
- Potentially unwanted app blocking
- Phishing protection
The first option helps Windows evaluate apps and files by reputation. The Edge setting applies SmartScreen’s web and download protections in Microsoft Edge. The phishing controls extend credential-use warnings beyond the usual browser-only defenses.
Microsoft explains that SmartScreen uses reputation and reported-threat information to warn about phishing sites, malicious downloads, and potentially unsafe apps. A site may look polished, use a familiar logo, and still be a cardboard movie set held up by bad actors. Reputation checks provide another way to spot the scenery wobbling.
If the controls are grayed out
A disabled switch is not always a broken switch. On a managed work or school device, an organization can enforce SmartScreen and Enhanced Phishing Protection settings centrally. In that case:
- Do not attempt registry edits or policy workarounds.
- Check whether Windows Security says the setting is managed by your organization.
- Contact the IT administrator if a required warning is missing or if you believe the policy is too restrictive.
Microsoft’s enterprise documentation notes that administrators can separately configure malicious-site warnings, password-reuse warnings, unsafe-app warnings, and optional data collection for investigation. That means a company device can have the service enabled but some user-facing warnings suppressed.
What to do when Windows flags a risky sign-in
Treat an Enhanced Phishing Protection alert as a prompt to pause, not as a nuisance to swat away.
If you typed your password into a suspicious site or app
- Stop entering information immediately.
- Close the page or app. Do not continue to click through prompts or download a “verification” tool.
- Change the affected password from a known-good device or trusted browser session.
- If it is a work or school account, report the incident to your organization’s IT or security team.
- Review account sign-in activity and multi-factor authentication methods where the account provider offers them.
- Run a Quick scan in Windows Security if the warning involved an unfamiliar application, a downloaded file, or other suspicious PC behavior.
If you entered the password but did not submit the form, changing it is still prudent when the page was clearly suspicious. Credential-harvesting pages can use scripts, deceptive overlays, or other techniques that are not obvious from the outside.
If Windows warns about password reuse
The correction is straightforward, if mildly annoying: make the password unique.
Change the password on the non-Windows site first if that is the account you just accessed. Then make sure your Windows account password is not reused anywhere else. A reputable password manager can generate and retain distinct passwords, which removes the temptation to recycle the same one with a different exclamation mark bolted on like a spoiler.
Where supported, move important accounts to passkeys or other phishing-resistant sign-in methods. Windows Hello and passkeys can reduce reliance on typed passwords, although using Windows Hello alone may also mean you no longer receive Enhanced Phishing Protection warnings tied to password typing.
If Windows warns about unsafe password storage
Delete the password from the note, document, or other unprotected file. Then empty the Recycle Bin if the file contained credentials in plain text.
Avoid replacing one risky storage method with another, such as emailing the password to yourself or putting it in an unprotected spreadsheet. Use a trusted password manager, or use the account provider’s supported passwordless sign-in option where available.
If you do not see Phishing protection
First, confirm the device runs Windows 11 version 22H2 or later and install pending Windows updates. Microsoft introduced the Windows Security controls as part of Windows 11’s 22H2-era SmartScreen enhancements.
Then check the basics:
- Open Settings > System > About to identify the Windows version.
- Install pending updates through Settings > Windows Update.
- Restart after cumulative or feature updates.
- Open Windows Security again and revisit App & browser control > Reputation-based protection settings.
- Check whether a work or school management policy has hidden or locked the controls.
- Ensure you are testing with a password sign-in, rather than only a Windows Hello PIN or biometric sign-in.
Do not test the feature by deliberately entering a real password into a questionable website. Security testing should not double as a donation drive for phishers.
A small setting with a useful job
The best defense against phishing remains deliberate sign-in habits: inspect the address bar, use bookmarks or known URLs for important accounts, avoid unexpected links, use multifactor authentication, and keep every password unique.
But humans are busy, tired, and occasionally one click away from a very convincing counterfeit. Enhanced Phishing Protection gives Windows 11 a chance to intervene when a protected credential is about to be reused, exposed, or saved somewhere it should never live. Enable the warnings, keep SmartScreen active, and let Windows be the mildly skeptical friend every login deserves.