Review Windows 11 phishing protection before relying on its warnings

Windows Security's phishing protection can warn when a protected Windows sign-in password is typed into suspicious content, and can offer reuse or unsafe-storage warnings. It is easy to overestimate its scope. Microsoft's current support text says only the typed password used to sign into Windows 11 is protected, and the default configuration focuses on malicious content. It is not an inventory of all passwords in your browser or password manager.

Before you start​

This guidance applies to a supported Windows 11 installation. On a managed computer, organizational policy may set these options. If you normally sign into Windows with a PIN or face, understand whether you still have a Windows account password; do not type any real password into a test website to see if a warning appears.

Do it step by step​

1. Open Windows Security, then App & browser control and Reputation-based protection settings. Find Phishing protection and inspect the options actually shown on this Windows build.
2. Read each control's description before enabling it. Keep warning and protection options on where appropriate, including password reuse or unsafe storage warnings if offered. Note Microsoft may collect diagnostic information for suspicious content under this feature.
3. Check that the device's security provider and Windows updates are current. A greyed-out option may be controlled by an administrator; do not modify policy or registry values from an untrusted forum post.
4. Review your sign-in habits without exposing a credential. Use the password manager to generate unique website passwords so a Windows sign-in password is never reused on a site.
5. If a warning appears during normal work, stop typing. Close the suspicious page, navigate to the service from a known address and change the affected Windows account password if you submitted it anywhere untrusted.
6. After a suspected disclosure, inspect account sessions and recovery methods and run a trusted device scan. Treat the warning as a lead for investigation rather than proof that data was or was not transmitted.

Check the result​

The intended phishing controls are enabled or their managed status is understood. The Windows sign-in password is not reused for sites, and the user knows how to respond to a warning.

If something goes wrong​

If the feature is missing, confirm Windows version and whether another security product or policy changes the interface. Do not weaken other protections just to surface this setting. Use unique passwords and careful link verification regardless.

Know the limit​

The protection's scope is limited and product behavior changes. Microsoft documents protection for the typed Windows 11 sign-in password, not every account secret. Even without a warning, a lookalike site can steal a password typed there; use passkeys or security keys where available. Microsoft Windows phishing-protection controls