"Microsoft has blocked macros from running because the source of this file is untrusted"
This red bar is different from the old yellow "Macros have been disabled" message. Starting in 2022, Microsoft changed how Office handles files downloaded from the internet or received as email attachments — and there's no simple "Enable Content" button to click anymore.
What the red bar means and what to do
The message means two things at once: the file contains VBA (Visual Basic for Applications) macros — code that can run automatically and interact with your computer — and Excel detected that the file came from an untrusted source (most commonly, it was downloaded from the internet or arrived as an email attachment). The combination of "has macros" and "came from outside" is what triggers the hard block. A macro-enabled file you created yourself on your own machine usually doesn't get this treatment.
Before you do anything to unblock it, check what's actually inside. Our free tool inspects the file without opening it in Excel and without running any code — it tells you whether macros are present, what kind they are, and whether it finds anything else worth knowing, so you can make an informed call before you unblock anything.
If you decide the file is trustworthy
If you know the sender and are confident the file is safe, the way to unblock it in newer Excel versions is to right-click the file in Windows Explorer, choose Properties, and check the "Unblock" checkbox at the bottom of the General tab. That removes the Mark of the Web tag, and Excel will open the file normally on the next launch.
Should you be worried?
Not automatically. Most macro-enabled spreadsheets are completely legitimate: accounting tools, automated reports, forms that calculate things for you. The block doesn't mean the file is malicious. It means Excel doesn't know where the file came from and is being conservative.
The files you should be most cautious about are ones you weren't expecting — an invoice from an unknown sender, a spreadsheet attached to a job offer you didn't apply for, a "payment confirmation" from a company you've never heard of. Attackers use exactly those scenarios because the urgency makes people want to click through warnings.
Why the message changed
For years, Excel showed a yellow warning bar with an "Enable Content" button whenever a file contained macros. Attackers figured out that enough people would click that button, so macro-based malware became one of the most common ways to infect a computer through a spreadsheet. In response, Microsoft pushed a significant change in 2022: files downloaded from the internet or email now carry an invisible tag called the "Mark of the Web." When Excel sees that tag, it shows the red bar and blocks macros entirely — no Enable Content button.