How to configure Internet Explorer 7 Security Zones for high security
This article describes how to achieve the highest possible security in Internet Explorer.There are basic instructions for beginning users, explanations and advanced settings for more experienced users, and reference tables for custom settings.
If you’re new to this or in a hurry, you can quickly improve the security of each zone just by using the IE slider controls.
Open the Internet Options dialog box from either of these locations:
Click on each zone, and set its slider to the level shown:
| Zone | Recommended setting |
| Restricted | High |
| Internet | High |
| Trusted Sites | Medium-high. If experience shows this is too restrictive for too many sites, you can reduce to Medium or tweak individual settings, but never put any setting below the level it has for Medium. |
| Local Intranet | Medium-low |
When done, click OK.
When visiting unfamiliar websites, these settings ensure that you have High security. When you are on a website that you trust and you need to allow features that the High setting doesn’t permit (such as file downloads, JavaScript, or ActiveX), you can manually add that site to your Trusted Sites list, where security is lower and the needed features are allowed.
All sites start out in the Internet Zone. To add a site to Trusted Sites, go to:
This box appears to have been an afterthought, and when it is checked, it makes the Trusted Sites concept virtually useless. It only allows sites to be Trusted if they a) use secure “https” encryption on their web pages to prevent eavesdropping, and b) present an authorized certificate that guarantees their identity. The result is that only online banks and big commercial sites can ever qualify to be Trusted. https is too high a standard to expect all Trusted Sites to meet.
From the standpoint of personal information protection, https is important, and you should make sure it is used on any site where you enter credit card numbers or other critical personal information. It protects you from data interception and from fraudulent websites pretending to be other websites (phishing).
However, that has nothing to do with what the Security Zones were supposed to be for: keeping malware off your computer. From that standpoint, the more appropriate standard for trust is: “If I lower my security for this website, do I trust it not to install malware?”
If you’re not viewing the site at the time you want to add it, manually type or copy-and-paste its URL into the “Add this website…” box. The URL looks like: http://www.websitename.com.
Web pages are plain text files which, by themselves, cannot harm your computer. So are emails. However, some of the text in them can be instructions to your browser or email viewer that tell it to do the following things:
Each of these types of objects does have the potential to harm your computer under some circumstances.
The key to making your browsing safer is to restrict what types of these “secondary” objects are allowed to be fetched, restrict JavaScript and VBScript from executing, and restrict what types of applications (plug-ins, browser helper objects, or programs on the local computer) are permitted to be activated as the result of instructions on a web page or in an email.
You can be very secure if you ALWAYS disable ALL of these secondary objects and disallow ALL plug-ins, so that your browser only displays the text on the web page and absolutely nothing else, but you might find these restrictions unacceptably limiting, and some of your favorite web pages might not work properly.
Shouldn’t there be a way to differentiate between places whose content you believe is probably safe and other places where you suspect it might not be? That’s what Internet Explorer’s Security Zones are for.
Different sources deserve different levels of trust. A well known website you’ve visited many times without problems deserves more trust than a site you’ve never seen before and know nothing about.
By assigning sites to different zones, you can manage the amount of risk you face. When visiting new unfamiliar sites, your defenses are high, but if a trustworthy site requires additional features, you can put it in the Trusted Sites zone to enable them.
| Local Intranet | Your local computer and the local area network it’s connected to, if any. You and your family or coworkers probably have not created malicious files to damage your own computer system, so this zone has a low level of security. Web pages and files in this zone normally run with few restrictions or warning prompts. |
| Trusted Sites | Websites you’re confident will not try to damage your computer with malicious files. A site only gets into the Trusted Sites zone if you put it there manually. You can base your decision on your experience or the website’s reputation. The “trust” implied here only concerns whether you think a site might try to harm your computer. You might or might not like or trust a company in various different ways, for example, but any site can go in Trusted Sites as long as you’re confident that its site isn’t designed to be malicious and is competently enough maintained that it’s not likely to get hacked and become malicious. The Trusted Sites zone has a medium level of security, higher than your local computer but low enough to allow various types of enhanced content to run or be displayed. |
| Restricted Sites | Websites you think WILL try to damage your computer with malicious files. Why this is a Zone, I don’t know. Why would you go there? Putting a site in this zone (which you do manually) doesn’t prevent you from going there. It would be more useful if it did, preventing you from accidentally returning to a site you discovered was bad. The Restricted Sites zone has a high level of security. |
| Internet | All other websites: ones you’ve never visited before and ones that fully function without your having to put them in Trusted Sites. By default, IE7 sets Internet Zone security lower than Restricted Zone. This makes no sense. You must go to an unfamiliar site, such as the hundreds of unfamiliar ones listed in search engine result pages, with your security set to the highest possible level. Otherwise, when do you move a site to the Restricted Zone? After you’ve gone there and it’s already damaged your computer? No! Thus, the Internet Zone must be the one with the highest security level, and the Restricted Zone is basically useless. |