Security Risk in Excel: How to Find and Check It Safely

To find security risks in an Excel workbook, first check where it came from and whether Excel shows a security warning; then review its macros, external links, data connections, hidden content, and sharing permissions. Excel does not provide one overall security-risk score, so use the checks below before enabling content, editing, or sharing a file. These instructions are for Microsoft Excel for Microsoft 365 on Windows.

What You’ll Need

The workbook you want to review. If it is unfamiliar or unexpected, do not enable macros or click links in it while checking.
Excel for Microsoft 365 desktop on Windows for the full set of inspection steps. Some options differ in Excel for Mac and Excel for the web.
If possible, a separate copy of the workbook. Some inspection and link-removal actions can change the file.

Step-by-Step

Check the file source and name before opening it. Confirm who sent the workbook and whether you expected it. Be cautious with an unexpected attachment, a file from an unfamiliar download site, or a message urging you to enable content immediately. Check the file extension in File Explorer: .xlsm and .xlsb workbooks can contain macros, and the older .xls format can also contain them. A .xlsx file cannot store VBA macros, but it can still contain external links, connections, or other content worth reviewing. A familiar-looking name or sender address is not proof that a file is safe.
Pay attention to Excel’s opening warning. If the workbook opens in Protected View with a warning bar, leave it there while you decide whether the source is trustworthy. Protected View limits editing; it is not a guarantee that every kind of risk has been detected. If Excel says macros have been blocked because the file came from an untrusted source, do not bypass the warning just to view the spreadsheet. Ask the sender to confirm the file and explain why macros are needed. Only enable editing or content when you have verified the source and have a legitimate reason.
Review the workbook’s file information. In desktop Excel, select File > Info. Check the file type and look for security notices, workbook properties, or indicators that the file came from the internet or another source. Available notices depend on the file and your organization’s settings. If you need to preserve the original, use File > Save As to create a review copy in a folder you control; do not save an untrusted file to a trusted location to silence a warning. A trusted location is intended for files you have already judged safe.
Check macros and embedded active content. In Excel, go to File > Options > Trust Center > Trust Center Settings > Macro Settings to review the policy currently in effect. Do not change the setting to enable all macros as a shortcut. If you need to inspect code, review it with your organization’s security team or someone qualified to assess VBA before running it. You can also use File > Info > Check for Issues > Inspect Document and review any available options for macros, embedded objects, or other content. Inspection options vary with workbook type and Excel version; inspect a copy because removing content may affect the file.
Look for links to other workbooks and outside data. Select the Data tab and look for Workbook Links and Queries & Connections. Workbook Links can show references to other files; Queries & Connections can reveal connections to databases, websites, or other sources. Review the source names, locations, and refresh behavior. Do not choose to refresh a connection unless you recognize and trust its source. If a source is missing or unfamiliar, ask the workbook owner what it is for. Avoid breaking links until you understand what cells, reports, or calculations depend on them.
Inspect hyperlinks and formulas that refer outside the workbook. Look for links in cells, shapes, and objects, especially links that lead to sign-in pages or file downloads. Hover over a hyperlink to check its destination where Excel displays it, but do not follow a suspicious address. Also review formulas that refer to another workbook or location. A link may be legitimate, but it can expose information or return unexpected results if its destination is changed. Ask the owner to explain any external reference you cannot identify.
Check hidden sheets, rows, columns, and document content. In a review copy, use Home > Format > Hide & Unhide > Unhide Sheet to see whether ordinary hidden worksheets are present. Check for hidden rows or columns if the workbook’s displayed totals or instructions seem incomplete. Then use File > Info > Check for Issues > Inspect Document and review the available categories, such as hidden content or personal information. Hidden content is not automatically malicious; it may hold calculations or historical notes. Do not delete it until you know what depends on it.
Review who can access the file before sharing it. Check whether the workbook is stored locally, on a network share, or in OneDrive or SharePoint, and confirm that the intended audience has access. In cloud storage, review the sharing settings and remove access that is no longer needed, following your organization’s rules. Inspect the workbook for personal or confidential information, including comments, hidden data, and identifying details. Password protection or sheet protection can limit editing, but it does not make a file safe to open or replace appropriate access controls.

Common Mistakes

A frequent mistake is treating every warning as an obstacle and selecting Enable Content or Enable Editing without checking the sender. The warning is a reason to pause, not proof that a workbook is harmful or harmless. Verify the file through a separate trusted channel if its arrival or request seems unusual.

Another mistake is assuming that .xlsx means risk-free. That format cannot contain VBA macros, but links, data connections, misleading hyperlinks, and confidential information can still be present. Conversely, a macro-enabled extension does not by itself prove that a workbook is malicious; it means you should identify and assess the macros before allowing them to run.

Do not confuse a hidden sheet or a protected worksheet with a security feature that makes content safe. Hidden material can still contain sensitive data, and sheet protection is mainly intended to control editing. Also avoid deleting links or hidden items in the original file just to make the workbook look clean. Those changes can break reports, remove useful records, or conceal evidence needed for a proper review.

Tips

When a workbook is unexpected, verify it with the sender using a separate message or call rather than replying to a suspicious email.
Keep the original unchanged and do exploratory work in a clearly named copy. Store sensitive review copies only where your organization permits.
Ask what a macro or connection is supposed to do before enabling it. A clear business purpose and a known source are more useful than a reassuring filename.
Use the Inspect Document results as a checklist, not as a safety certificate. It can help find certain content but cannot establish that every link, macro, or data source is trustworthy.
For a work device, follow your organization’s security policy. Do not change Trust Center settings or move files into trusted locations unless your administrator approves.

Troubleshooting

You cannot find Workbook Links. The command may appear only when the workbook contains links, or your Excel build may show link controls differently. Check Data > Queries & Connections as well, and look for formulas or hyperlinks that refer to other files. If the workbook is open in Excel for the web, open it in the desktop app for more complete review options.

Unhide Sheet is unavailable or no sheets appear. There may be no ordinary hidden sheets, or workbook structure protection may prevent changes. A worksheet set to VeryHidden through VBA will not appear in the standard Unhide list. Do not try to circumvent protection on a file you do not own; ask the owner or administrator to explain and provide an appropriate review copy.

Inspect Document is missing or reports no issues. Confirm you are using desktop Excel and look under File > Info > Check for Issues. The available checks depend on the file and version. A clean result does not certify the workbook as safe, so continue to review its source, links, connections, and sharing settings. If you are using Excel for Mac, the commands and inspection choices may differ; use the current Mac app’s menus and your organization’s guidance rather than assuming the Windows Trust Center path applies.

The workbook opens in Protected View or macros remain blocked. If you cannot verify the source, close the file and contact the sender or your IT team. Do not disable Protected View or lower macro security across Excel to get past the notice. In Excel for the web, VBA macros do not run; use desktop Excel only when the workbook has been verified and your organization’s policy permits it. Excel for the web also has fewer inspection and connection-management controls, so it is not a substitute for a full desktop review.

A connection or link is broken after review. If you changed the workbook, reopen your untouched copy and compare the affected sheet or report. Ask the owner to identify the correct source before reconnecting or refreshing it. If the workbook is important to business operations, have the owner or IT team validate the repair instead of guessing at a replacement location.

Frequently Asked Questions

Does Excel have a security-risk scanner?
Excel has protections and inspection tools, including Protected View, macro security settings, and Inspect Document, but it does not give a single complete risk score. Review the workbook’s source and contents as well.

Is a workbook safe if Excel shows no warning?
No. A warning-free opening is not a guarantee. A workbook may still contain untrusted links, connections, misleading content, or information that should not be shared.

Should I enable macros to see what is in a workbook?
Not just to inspect it. Ask why macros are required and verify the file with its sender or your IT team. Do not enable macros in an unexpected or untrusted workbook.

Can I check security risks in Excel for the web?
You can view and edit many workbooks, but the web app does not run VBA and has fewer desktop inspection controls. For a fuller review, use desktop Excel with a verified file and follow your organization’s policy.

Does password-protecting a sheet make the workbook secure?
No. Worksheet protection is not a substitute for safe file handling, careful sharing permissions, or protection of sensitive data. Use the access controls approved for the file’s storage location.

Try it: the Date Difference Calculator: days, months, years and weekdays between two dates, with the DATEDIF formulas.

More in How-to basics

Sources: Function behaviour and menu paths: Microsoft Support documentation for Excel. Method & sources

Spotted an error in this guide? Let us know.