Important: The National Public Data breach exposed personal information, including names, addresses, and social security numbers. Learn how to protect yourself and how Microsoft Defender is helping to prevent fraud. See: National Public Data breach: What you need to know.
Microsoft Defender's web protection helps protect you against malicious sites that are being used for phishing or spreading malware. Web protection is currently available on Windows, iOS, and Android.
It does this by checking links you click on, or that an app tries to open on your device and comparing them against our constantly updated list of sites known to be dangerous. If we see you're on your way to a site we know is dangerous, we'll warn you.
Microsoft does not see your browsing activity.
Tip: Most of what web protection checks happens in the background, when apps on your device connect to servers or services on the internet as part of their normal business.
You won't see web protection in action unless it detects that a dangerous link has been called—such as in this example on Android.
Note: On Windows, web protection is provided by Microsoft Defender SmartScreen in the Microsoft Edge browser. For more information, see How can SmartScreen help protect me in Microsoft Edge?
What about Defender web protection on iOS?
On iOS we can't show you the block screen in the browser, but Defender will still block dangerous pages for you and give you a notification that we've blocked the page (and why).
Due to the built-in security settings in iOS, other apps aren't able to see the address (URL) an app is trying to open, including those being opened in the web browser. To make sure the site you're going to isn't known to be dangerous, Defender needs to be able to see the address.
To do that, we set up a local VPN. It's called a local VPN because it doesn't leave your device—it's just a connection between your browser and Microsoft Defender running on your device.
Note: This local VPN sometimes confuses data usage calculations because they count the data leaving the app, but don't always recognize that the data going to another app on your local device, and seldom uses any network connection. If you want to see your actual data usage, it's always best to rely on the reports generated by your mobile carrier who are measuring the data that comes across their network.
When you click on a link, the browser sends the address you're going to through that local VPN to Defender. Defender checks the address and then (assuming it's good), lets the browser open that site. The whole thing happens so quickly you won't even notice.
If you've decided not to allow Microsoft Defender to show notifications it will still block the page, it just won't send you the notification to explain why.
