Microsoft defender is blocking customers from using my website.

Question

I have a website, www.ellacard(.)com that thousands of customers use to send digital greeting cards and other digital goods. Today I have been notified by several customers that their access to our site has been blocked by Microsoft defender all of a sudden. We have not been given any information by Microsoft as to why or what we can do here. How am I supposed to get Microsoft to remove us from this block list? What can I do?

Answer 1

Microsoft Defender SmartScreen and Defender for Endpoint can classify a site as malicious based on URL reputation, page content, file behavior, TLS security, user feedback, and dynamic behavior. When that happens, users see a red block page and are prevented from accessing the site.

To get Microsoft to re-evaluate and remove an incorrect block (false positive), follow these steps:

1. Use the “this site is safe” link on the block page
   • On the SmartScreen/Defender block page in Microsoft Edge, select the link such as Report that this site doesn't contain (malware/phishing) threats under the More information section.
   • Submit the requested details and contact email.
   • Wait for the confirmation email from the SmartScreen Reputation Group and, if the issue is urgent, reply to that email to provide additional context and request expedited review.
2. Submit the URL through the Microsoft submission portal
   • If the block is being enforced by Defender web protection or Defender for Office 365, submit the affected URLs as false positives using the WDSI file submission portal. This can be done by both the site owner and impacted customers.
   • Follow the guidance in Submit files for analysis to provide as much detail as possible (that the site is a digital greeting card service, approximate traffic, when the block started, etc.).
3. Improve the site’s security posture to avoid future blocks SmartScreen and Defender consider several dimensions when deciding whether to block a site. To reduce the likelihood of being flagged again:
   • Ensure HTTPS is enabled everywhere and uses a valid, up-to-date certificate.
   • Avoid frequent changes to hosting provider or DNS that can hurt domain reputation.
   • Block iframes from loading unknown or untrusted third‑party content.
   • Configure strong security headers such as Content Security Policy (CSP) and other secure response headers.
   • Regularly scan the site and hosting environment for WebShells, trojans, and suspicious uploaded files.
4. Ongoing monitoring and false-positive handling
   • If customers are in organizations using Microsoft Defender for Endpoint with Web Content Filtering, admins can temporarily override the block with an Allow indicator while Microsoft completes its review.
   • For future false positives, always use the link on the Edge block page to report the site as safe; this feeds directly into SmartScreen’s reputation system.

Following these steps gets the URL into the official SmartScreen/Defender review pipeline and addresses both the immediate false positive and the underlying factors that may have triggered the block.

---

References:

• Unexpected SmartScreen block or warning on website
• Web protection
• Respond to web threats
• Getting started with web protection in Microsoft Defender
• Getting started with Microsoft Defender