Forum Discussion
HathMH
Jul 20, 2022Copper Contributor
Defender and Smart Screen
Recently we have had several "phishing" or "Phishing email domain" alerts in MS 365 Defender (security.microsoft.com) in which the URL visited is either a school ISD webpage (http://www.friscoisd.org...
PaulEdlund
Microsoft
Jul 20, 2022I think there are some things you can do that will minimize the likelihood of your sites being flagged by SmartScreen. I see one concerning thing right off the bat in using http but redirecting to port 443 on the Optimum website. That should be changed to a regular SSL site with a valid certificate. I think you are introducing some port confusion by redirecting port 80 (http) to port 443.
Some other things that will assist as per this website.
https://fb.smartscreen.microsoft.com/smartscreenfaq.aspx
There are several things you can do that can help minimize the chance of your site being flagged as suspicious. Think of these as best practices or optimal website design ethics.
If you ask users for personal information, use HTTPS with a valid, unexpired server certificate issued by a trusted certification authority.
Make sure that your webpage doesn't expose any cross-site scripting (XSS) vulnerabilities. Protect your site by using anti-cross-site scripting functions such as those provided by the Microsoft Anti-Cross Site Scripting library.
Use the fully-qualified domain name rather than an IP-literal address. (This means a URL should look like "microsoft.com" and not "207.46.19.30.")
Don't encode or tunnel your URLs unnecessarily. If you don't know what this means, you probably aren't doing it.
If you post external or third-party hosted content, make sure that the content is secure and from a known and trusted source.
Some other things that will assist as per this website.
https://fb.smartscreen.microsoft.com/smartscreenfaq.aspx
There are several things you can do that can help minimize the chance of your site being flagged as suspicious. Think of these as best practices or optimal website design ethics.
If you ask users for personal information, use HTTPS with a valid, unexpired server certificate issued by a trusted certification authority.
Make sure that your webpage doesn't expose any cross-site scripting (XSS) vulnerabilities. Protect your site by using anti-cross-site scripting functions such as those provided by the Microsoft Anti-Cross Site Scripting library.
Use the fully-qualified domain name rather than an IP-literal address. (This means a URL should look like "microsoft.com" and not "207.46.19.30.")
Don't encode or tunnel your URLs unnecessarily. If you don't know what this means, you probably aren't doing it.
If you post external or third-party hosted content, make sure that the content is secure and from a known and trusted source.