Enabling macros is safe when you trust the source of the file, and genuinely dangerous when you do not. A macro is a program, not a setting: once enabled it can do anything you can do on your computer, including reading, changing and deleting files, connecting to the internet and launching other programs. Excel cannot tell a useful macro from a harmful one, which is why it asks you rather than deciding for you.
That is the honest short answer. The rest of this page is how to decide for a specific file, and what the warnings Excel shows you actually mean.
Why Excel blocks macros in files from the internet
Since 2022, Excel blocks macros outright in files that came from the internet. You get a red banner reading “Microsoft has blocked macros from running because the source of this file is untrusted”, and there is no Enable button on it.
This is not Excel judging the file. When you download something, Windows attaches a hidden marker to it, often called the Mark of the Web, that records it came from outside your machine. Excel sees that marker and refuses to run the macros. It behaves identically whether the file is a legitimate business tool or malware, because at that moment Excel knows nothing about the contents, only the origin.
Why the block exists
Macro-enabled documents were, for years, one of the most common ways malware reached office computers. An attacker emails an invoice or a delivery note, the recipient opens it and clicks Enable Content, and the macro downloads and runs the actual payload. The block exists because that attack worked, repeatedly, at scale.
What a macro can actually do once enabled
It is worth being specific, because “macros can be dangerous” is vague enough to be ignored. VBA code in an enabled workbook runs with your user account’s permissions. That means it can:
- Read, modify or delete any file your account can reach, including network drives
- Make network requests, so it can send data out or download something else in
- Launch other programs
- Read and write Windows registry settings
- Send email through an installed Outlook profile
It cannot do anything your own account cannot do, so a standard user account limits the blast radius. But for most people, everything that matters, their documents and their email, is reachable by their own account.
Five checks before you enable macros in a file
These are in order of how much they tell you.
1. Do you know where the file came from?
Not “does it look official” but “did I go and get this, or did it arrive?” An unexpected attachment is the single strongest warning sign there is, and it does not matter how convincing the covering email reads. A file you deliberately downloaded from a site you chose to visit is in a completely different category.
2. Is it digitally signed, and by whom?
A digital signature tells you two specific things: which organisation signed the file, and that it has not been altered since. When you open a signed file, Excel names the publisher. If a file claims to be from a company and carries no signature at all, that gap is worth noticing.
3. Does the publisher have a real, checkable presence?
A signature proves identity, not good intent. Look the publisher up. A business with a website, a support address that works, and a history you can verify is a very different proposition from a name you cannot find anywhere.
4. Does the file need macros for what it claims to do?
A workbook advertised as a template or a data file has no obvious reason to contain code. If something arrives as .xlsm when .xlsx would do the job, that is worth a question.
5. Can you read the code before you enable it?
You do not have to enable macros to look at them. Opening the workbook without clicking Enable Content stops the code running, but the code is still in the file: press Alt+F11 to open the Visual Basic editor and read the modules, then close the file and decide. On a Mac, the editor is under Tools → Macro → Visual Basic Editor, since the keyboard shortcut depends on how the function keys are configured. This is the most direct check available, because it looks at what the file actually does rather than at who sent it.
Two things limit it in practice. Most commercial tools password-protect their VBA project, so the editor opens but the modules stay locked, and reading VBA is only useful if you can follow what you are reading. Neither makes a file suspicious on its own; they just mean you fall back on checks 1 to 3.
What a signature does not tell you
A digital signature is an identity check, not a safety check. It says a specific organisation signed this file and nobody has changed it since. It says nothing about whether the code is well written, or whether that organisation is trustworthy. Signed malware exists. Use the signature to know who, then decide separately whether you trust them.
How to unblock a file you have decided to trust
If the red banner is showing, the Enable Content button will not appear until you clear the internet marker in Windows:
1 Close the file in Excel.
2 Find it in File Explorer, right-click it and choose Properties.
3 On the General tab, tick Unblock at the bottom, then click OK.
4 Open the file again. You will now get the ordinary yellow bar with an Enable Content button.
Only do this for a specific file you have decided to trust. The step exists deliberately: it is a moment to think, not an obstacle to route around by habit.
Two things not to do
Do not switch on “Enable all macros” in Trust Center settings. It removes the warning for every file you will ever open, including the one you should have been warned about. And do not add your Downloads folder as a Trusted Location, which has the same effect for anything that lands there.
When the answer is simply no
Some situations do not need a judgement call:
- The file arrived unexpectedly, however plausible the sender looks
- The covering message pushes urgency, a payment problem, a deadline, an account about to close
- The file is unsigned and you cannot establish who made it
- It asks you to enable macros to “view the content”, which is not a thing that requires macros
- You are on a work machine and unsure, in which case ask IT rather than deciding alone
Common questions
Is .xlsm more dangerous than .xlsx?
An .xlsx file cannot contain macros at all, so it cannot run code. .xlsm can. The extension tells you whether code is possible, not whether it is harmful.
Does antivirus catch malicious macros?
Often, but not reliably, and not instantly for something newly written. Treat it as one layer rather than the answer.
Can I enable macros for one file without changing my settings?
Yes, and that is the right way to do it. Clicking Enable Content applies to that workbook only. Changing Trust Center settings applies to everything, which is why it is the wrong tool for a single file.
Does opening the file without enabling macros put me at risk?
Opening an .xlsm without enabling macros does not run the code. That is exactly what the warning bar is for: you can look at the contents first and decide afterwards.
Is it safe to enable macros in ExcelGurus tools?
Apply the same five checks you would to anyone. Our workbooks are digitally signed, so Excel names ExcelGurus, LLC as the publisher when you open one, and you can verify that we are a real business with working support before you decide. We would rather you checked than took our word for it.
When Formulas Aren’t Enough
Macros exist because some jobs cannot be done with formulas alone:
- Multi-step processes — importing, cleaning, validating and exporting in one action
- Working across files — pulling from several workbooks without opening each by hand
- Generating documents — building a PDF, an email or a report from spreadsheet data
- Enforcing rules — validating entries and blocking bad data before it is saved
A custom VBA tool does the work your team currently does by hand, the same way every time.
Need an Excel Tool Your Team Can Trust?
Tell us what the process is and we’ll build a tool that handles it, signed and documented.
Start a Project