How to Fix the “Windows protected your PC” SmartScreen Warning for Your Game

Every indie game distributed as a zip or installer from itch.io, Game Jolt, a Discord server or your own site hits this on Windows. The player double-clicks the game, a full-width blue dialog says Windows protected their PC and offers only a Don’t run button, and a good share of them conclude the game is malware. Here is what SmartScreen is actually checking, what to tell players today, and how to sign a build so the warning stops.

The exact warning

The dialog is drawn by Windows, not by your game, before any of your code runs:

Windows protected your PC
Microsoft Defender SmartScreen prevented an unrecognized app from starting.
Running this app might put your PC at risk.

[Don’t run]

Clicking the small More info link expands it to show App: MyGame.exe and Publisher: Unknown publisher, and only then does a Run anyway button appear. Many players never find the link. This is not the same thing as Microsoft Defender Antivirus quarantining a file as a virus; that is a separate detection with a different fix, covered in Fix a Game Flagged by Antivirus on Launch.

What causes it

SmartScreen runs when two conditions line up:

1. The file carries the Mark of the Web. Browsers tag downloads with a Zone.Identifier alternate data stream saying the file came from the internet zone. Windows Explorer copies that mark onto every file it extracts from a tagged zip, so a game unzipped from a browser download is marked too. Files written by the Steam client or the itch.io app never get the mark, which is why Steam players do not see the dialog.
2. The executable has no reputation. SmartScreen asks Microsoft’s reputation service about the file’s hash and its signing certificate. An unsigned executable has only its hash, and a brand new build has a hash nobody has ever run, so it is “unrecognized” on every release. A signed executable inherits the reputation of its certificate, which accumulates as people run things signed with it and is not reset by a new build.

That second point is the whole game. Unsigned builds start from zero reputation with every patch you ship. Signed builds start from wherever your certificate left off.

Fix 1: what to tell players now

Put this in your store page, your download page and a pinned message wherever players talk to you:

1. On the blue dialog, click More info.
2. Click Run anyway.

If they would rather clear the mark than click through, right-clicking the downloaded zip, opening Properties and ticking Unblock before extracting removes the Mark of the Web from everything inside. The PowerShell equivalent is Unblock-File .\MyGame.zip. Say in the same message that the warning appears because the game is a small independent release without a Microsoft-recognized publisher, not because anything was detected. Players accept that explanation when it comes from you; they do not accept silence.

Fix 2: code-sign every release

Signing attaches your verified identity to the executable, replaces “Unknown publisher” with your studio name, and lets reputation carry across builds. Two routes exist today:

Azure Trusted Signing is Microsoft’s own service. You create an account, pass identity validation, and sign in the cloud with signtool through a small dlib plug-in, with no hardware token to manage. It is priced monthly, and because the certificates are issued by Microsoft they tend to reach a clean SmartScreen state far sooner than third-party certificates. If your studio is a registered business, this is the path to take first.

A code-signing certificate from a certificate authority (DigiCert, Sectigo, GlobalSign and others), in OV or EV flavour. Since 2023 these are issued on hardware tokens or in cloud HSMs rather than as files, so budget for that in your build pipeline. EV certificates used to be granted immediate reputation; Microsoft has pulled back on that, so treat any certificate as something that earns trust as it is used.

Whichever you choose, the signing command is the same shape and belongs in your build script, not in someone’s memory:

signtool sign /fd sha256 /tr http://timestamp.digicert.com /td sha256 ^
  /n "Your Studio LLC" MyGame.exe

Use /tr for an RFC 3161 timestamp so the signature stays valid after the certificate expires. Sign every executable you ship: the game, the crash handler, any launcher, and the installer itself if you use one. An unsigned installer wrapping a signed game still triggers the dialog, because the installer is what the player double-clicks.

Fix 3: keep the reputation you earn

Reputation attaches to the certificate and, for unsigned files, to the exact file hash. A few habits make it stick:

• Use one certificate for everything you ship, across games and across years. Renew it rather than buying a different one, and keep the subject name identical.
• Do not repack between signing and upload. Signing an executable and then letting an installer builder or a packer rewrite it leaves the final file unsigned.
• Avoid self-extracting archives and exotic packers. Both look like what malware does and depress reputation on their own.
• Ship a signed build to a few hundred players before launch day. A demo, a Next Fest build or a playtest branch gives the certificate its first runs so the full release does not start from zero.

Fix 4: distribute through a client

If you cannot sign yet, change how the file reaches the player. Steam downloads, and installs through the itch.io desktop app, write files without the Mark of the Web, so SmartScreen is never consulted. On itch, push builds with butler and tell players the app is the smoother way to install; keep the direct zip for people who insist. This does not fix the direct download, but it moves most players off the path that warns.

How to confirm it works

Your own machine is a poor test because the mark is only applied to browser downloads, and your account may already trust the file. Upload the final build, download it in a fresh Windows virtual machine through Edge or Chrome, extract with Explorer and run it. Before launching, check the signature with:

signtool verify /pa /v MyGame.exe
Get-AuthenticodeSignature .\MyGame.exe

A freshly signed build may still get the dialog for its first few hundred runs while the certificate builds reputation; what changes immediately is that More info names your studio instead of “Unknown publisher”. Keep the VM check in your release checklist so an unsigned executable never slips out when the signing step silently fails in CI.

Hearing about the players who click Don’t run

SmartScreen stops the game before a single frame renders, so no crash reporter will ever log it; the only signal is players who downloaded and never showed up. What you can do is make the known issue visible and make the next step easy. Bugnet’s public bug tracker gives you a page to pin the warning as a known issue with the two-click workaround, so a player who searches your game’s name plus “windows protected your pc” lands on your answer rather than a forum guess. Once the game is running, the Godot, Unity and GameMaker SDKs file the crashes that happen afterwards with the player’s OS build attached, which is how you find out that the launch problem was only the first of two.

Related problems

• Fix a Game Flagged by Antivirus on Launch
• Fix: Godot Export Windows Defender Flags Binary as Virus
• How to Stop Antivirus Software Flagging Your GameMaker Game as a Virus
• How to Fix “is damaged and can’t be opened” for Your Mac Game
• Unity Game Won’t Launch on a Player’s PC? How to Fix It

Frequently asked questions

Does “Windows protected your PC” mean my game was detected as a virus?

No. SmartScreen is a reputation check, not a malware scan. It warns about any downloaded executable that is unsigned or whose publisher has not yet been seen running on enough machines. A Defender Antivirus detection shows a different notification and quarantines the file.

How do players run a game past the SmartScreen warning?

Click the More info link on the dialog, then the Run anyway button that appears. Alternatively, right-click the downloaded zip, open Properties, tick Unblock and extract it again.

Why does Steam not show the warning for the same game?

SmartScreen only inspects files that carry the Mark of the Web, which browsers add to downloads. The Steam client and the itch.io desktop app write game files directly, so they are never marked and never checked.

Will a code-signing certificate remove the warning immediately?

Not always. Signing replaces “Unknown publisher” with your name at once, but SmartScreen may still warn until the certificate has been seen on enough machines. Reputation then carries across every build signed with it, which is why unsigned games get the warning again on every patch.

Sign the build that nobody will play, the demo, three months before the one everybody will. Reputation is earned by runs, and you want them banked before launch day.