Earlier this month, Microsoft released a Windows 11 cumulative update addressing several known feature issues and security vulnerabilities. Among the modifications introduced, one notable change involves the way File Explorer handles files downloaded from the internet.
For security reasons, the preview pane in File Explorer will no longer display content from files obtained online. For example, if an image is downloaded from the web, clicking on it will no longer generate a preview in the right-hand pane of File Explorer.
This restriction was implemented to patch a security flaw that could potentially expose NTLM authentication hashes when processing unsafe files. Specifically, if a user previewed an HTML file containing references to external paths, an attacker could exploit this to access sensitive information such as user credentials.
As a result, previews for files tagged as originating from the web are now disabled by default. This does not prevent users from opening files normally—attempting to preview such content will simply trigger a warning: “The file you are attempting to preview could harm your computer. If you trust the file and the source you received it from, open it to view its contents.”
If users trust a downloaded file, they can right-click the file, select Properties, and then unblock it to remove the “web mark.” Once unblocked, the file can again be previewed normally in File Explorer. Importantly, this update does not affect users’ ability to open downloaded files or perform other standard operations.
This adjustment to the File Explorer preview feature applies to all supported editions of Windows 11, Windows 10 (including ESU versions), as well as Windows Server 2012/2012 R2/2016/2019/2025 and Windows Server version 23H2.