Block or unblock external content in Office documents

To help protect your security and privacy, the 2007 Microsoft Office system is configured by default to block external content — such as images, linked media, hyperlinks, and data connections — in workbooks and presentations. Blocking external content helps to prevent Web beacons and other intrusive methods that hackers use to invade your privacy and lure you into running malicious code without your knowledge or consent.

Cool things you can do with Office 2010

The Office Blog

In this article


What is external content, and why are Web beacons a potential threat?

External content is any content that is linked from the Internet or an intranet to a workbook or presentation. Some examples of external content are images, linked media, data connections, and templates.

Hackers can use external content as Web beacons. Web beacons send back, or beacon, information from your computer to the server that hosts the external content. Types of Web beacons include the following:

  • Images     A hacker sends a workbook or presentation for you to review that contains images. When you open the file, the image is downloaded and information about the file is beaconed back to the external server.
  • Images in Outlook e-mail messages     Microsoft Office Outlook 2007 has its own mechanism for blocking external content in messages. This helps to protect against Web beacons that could otherwise capture your e-mail address. For more information, see Block or unblock automatic picture downloads in e-mail messages.
  • Linked media     A hacker sends you a presentation as an attachment in an e-mail message. The presentation contains a media object, such as a sound, that is linked to an external server. When you open the presentation in Microsoft Office PowerPoint 2007, the media object is played and in turn executes code that runs a malicious script that harms your computer.
  • Data connections     A hacker creates a workbook and sends it to you as an attachment in an e-mail message. The workbook contains code that pulls data from or pushes data to a database. The hacker does not have permissions to the database, but you do. As a result, when you open the workbook in Microsoft Office Excel 2007, the code executes and accesses the database by using your credentials. Data can then be accessed or changed without your knowledge or consent.

Top of Page Top of Page

How does the Trust Center help protect me from external content?

If there is external content present in your workbook or presentation, when you open the file the Message Bar notifies you that the external content has been blocked.

Message Bar

If you click Options on the Message Bar, a security dialog box opens, giving you the option to unblock the external content. To learn how to make a secure decision before clicking an option, see the next section.

Top of Page Top of Page

What should I do when a security warning asks if I want to enable or disable external content?

When a security dialog box appears, you have the option to enable the external content or to leave it blocked. You should only enable the external content if you are sure that it is from a trustworthy source.

Microsoft Office Security Options

 Important   If you are sure that the external content in a workbook or presentation is trustworthy, and if you do not want to be notified about this specific external content again, instead of changing the default Trust Center settings to a less safe security level, it is better to move the file to a trusted location. Files in trusted locations are allowed to run without being checked by the Trust Center security system.

Top of Page Top of Page

Change external content settings for Excel in the Trust Center

External content security settings are located in the Trust Center for Office Excel 2007 only. You cannot change external content settings globally for Office PowerPoint 2007 in the Trust Center.

If you work in an organization, your system administrator might already have changed the default settings, and this might prevent you from changing any settings yourself.

Change settings for Data Connections

  1. In Excel, click the Microsoft Office ButtonButton image, and then Excel Options.
  2. Click Trust Center, click Trust Center Settings, and then click External Content.
  3. Click the option that you want under Security settings for Data Connections:
    • Enable all Data Connections (not recommended)     Click this option if you want to open workbooks that contain external data connections and to create connections to external data in the current workbook without receiving security warnings. We don't recommend this option, because connections to an external data source that you are not familiar with can be harmful, and because you do not receive any security warnings when you open any workbook from any location. Use this option only when you trust the data sources of the external data connections. You may want to select this option temporarily, and then return to the default setting when you no longer need it.
    • Prompt user about Data Connections     This is the default option. Click this option if you want to receive a security warning whenever a workbook that contains external data connections is opened, and whenever an external data connection is created in the current workbook. Security warnings give you the option of enabling or disabling data connections for each workbook that you open on a case-by-case basis.
    • Disable all Data Connections     Click this option if you don't want any external data connections to be enabled in the current workbook. When you choose this option, no data connection in any workbook that you open is ever connected. If you create new external data connections after opening a workbook, those data connections are not enabled when you open the workbook again. This is a very restrictive setting, and may cause some functionality not to work as expected.

Change settings for Workbook Links

  1. In Excel, click the Microsoft Office ButtonButton image, and then Excel Options.
  2. Click Trust Center, click Trust Center Settings, and then click External Content.
  3. Click the option that you want under Security settings for Workbook Links:
    • Enable automatic update for all Workbook Links (not recommended)     Click this option if you want links to data in another workbook to be updated automatically in the current workbook without receiving a security warning. We don't recommend this option, because automatically updating links to data in workbooks that you are not familiar with can be harmful. Use this option only when you trust the workbooks that the data is linked to. You may want to select this option temporarily, and then return to the default setting when you no longer need it.
    • Prompt user on automatic update for Workbook Links     This is the default option. Click this option if you want to receive a security warning whenever you run automatic updates in the current workbook for links to data in another workbook.
    • Disable automatic update of Workbook Links     Click this option if you don't want links in the current workbook to data in another workbook to be updated automatically.

Top of Page Top of Page

 
 
Applies to:
Excel 2007, PowerPoint 2007