Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsInternet Explorer security zones are a legacy Windows security system that still matters for intranet applications, ActiveX-dependent software, and sites opened in Microsoft Edge’s Internet Explorer mode. Standalone Internet Explorer 11 is retired; for supported legacy compatibility, Microsoft directs organizations to Edge IE mode. IE mode continues to use Windows Internet security-zone settings, but zone changes cannot repair every compatibility, certificate, authentication, or rendering problem.
Use this guide to identify a site’s zone, make narrowly scoped changes, manage zones with policy, and troubleshoot legacy applications without weakening security for the entire web.
As an Amazon Associate I earn from qualifying purchases.
What Internet Explorer security zones do
A security zone is a group of websites to which Internet Explorer applies a common set of security controls. Those controls govern behaviors such as scripting, ActiveX, downloads, cross-domain access, navigation, and Protected Mode.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A zone is therefore more than a compatibility label. Moving a site to a more permissive zone changes the browser’s security context. Trusted Sites does not mean that Microsoft or Windows has verified a site as safe. It means that the site receives the Trusted Sites zone’s less restrictive settings.
#1 Best Overall
These settings remain relevant when a legacy application runs in Microsoft Edge IE mode. They do not replace modern browser isolation, endpoint protection, phishing defenses, patching, identity controls, or secure application design.
The five relevant zones
| Zone | Number | Typical purpose | Default template | Primary concern |
|---|---|---|---|---|
| Local Machine | 0 | Content stored on the computer | Special handling | Local content has historically received unusual privileges and requires careful policy control. |
| Local intranet | 1 | Internal hostnames and organization-controlled applications | Medium-Low | Incorrect intranet detection can give an external site more permissive behavior. |
| Trusted Sites | 2 | Specific, vetted compatibility exceptions | Low | Overly broad entries can enable legacy capabilities for more sites than intended. |
| Internet | 3 | Ordinary websites not assigned elsewhere | Medium | Lowering this zone affects every matching website. |
| Restricted Sites | 4 | Sites requiring the strongest zone-based restrictions | High | Useful as one control, but not a replacement for URL filtering or malware protection. |
Windows also exposes locked-down equivalents and policy controls for these zones. Microsoft documents the zone numbers, templates, settings, and assignment policies in its Internet Explorer policy documentation.
How Windows assigns a website to a zone
Zone assignment can come from several sources:
- Explicit entries in Local Intranet, Trusted Sites, or Restricted Sites.
- Automatic intranet detection based on naming and network conditions.
- Hostname, domain, IP address, IP range, or protocol-specific mappings.
- Group Policy, mobile-device management, or other organization policy.
- Registry-based zone maps.
- Special Local Machine and locked-down-zone handling.
The policy commonly used to assign sites is AllowSiteToZoneAssignmentList. Its zone values are 1 for Local Intranet, 2 for Trusted Sites, 3 for Internet, and 4 for Restricted Sites.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A host-only mapping such as www.example.com is broader than a protocol-qualified mapping such as https://www.example.com. The scope can also differ by hostname, parent domain, subdomain, and IP address. Do not add an entire parent domain unless every relevant subdomain is genuinely trusted.
For policy mappings, use the format the policy expects: normally a host, domain, IP address, range, or protocol-qualified host. Avoid URL paths and unnecessary trailing characters. Microsoft warns that extra characters after the domain can create conflicting or ineffective entries.
How to inspect the current zone and its settings
- Press Windows + R.
- Enter
inetcpl.cpland press Enter. - Open the Security tab.
- Select Local intranet, Trusted sites, Internet, or Restricted sites.
- Review the displayed Security level for this zone.
- Select Sites to inspect site assignments.
- Select Custom level to inspect individual permissions.
In older Internet Explorer interfaces, zone information could also appear in browser status or security indicators. The same indicators may not appear in an identical form when a page is rendered through Edge IE mode. For IE mode troubleshooting, verify the Windows Internet Options configuration, the Edge IE mode state, and the organization’s site list separately.
Rank #2
- google search
- google map
- google plus
- youtube music
- youtube
What each zone is for
Local intranet
Local Intranet is intended for internal resources such as short hostnames, internal web applications, and certain local network resources. It can support legacy behavior needed by controlled business systems.
Its main risk is misclassification. DNS changes, proxy configuration, network topology, short versus fully qualified hostnames, and automatic detection can cause a site to be treated as Internet content or, more seriously, cause an insufficiently trusted site to receive intranet behavior. Microsoft documents this failure in Intranet site is identified as an Internet site.
Trusted Sites
Trusted Sites is for narrowly defined exceptions: for example, a known internal application or a vetted vendor portal that requires a legacy browser feature.
Add a site only when the business need is understood, the owner or vendor is vetted, the exception is documented, and the hostname and protocol scope are as narrow as practical. Do not use it simply because a download is blocked, a script fails, a certificate warning appears, or a vendor’s generic instructions say to add its whole domain.
Internet
The Internet zone is the default for websites that do not match another assignment. Keep it at the default or organization-approved level. Lowering it to fix one legacy site changes behavior for every site assigned to the zone and is usually a poor security trade-off.
Restricted Sites
Restricted Sites applies the strongest zone-based restrictions and may be appropriate for known malicious or unwanted sites, domains that must not run legacy content, or administrative blocklists.
Rank #3
- Seamless inbox management with a focused inbox that displays your most important messages first, swipe gestures and smart filters.
- Easy access to calendar and files right from your inbox.
- Features to work on the go, like Word, Excel and PowerPoint integrations.
It is not a complete blocking or malware-prevention system. Use endpoint, DNS, proxy, email, and browser protections as additional controls.
Local Machine
The Local Machine zone covers content on the computer and receives special treatment in Internet Explorer’s security architecture. It is primarily an advanced administrative concern. Local content and locked-down-zone policies should not be made more permissive casually.
How to add a site safely
For a narrowly scoped compatibility exception:
- Open
inetcpl.cpl. - Select Security → Trusted sites → Sites.
- Enter the narrowest appropriate hostname or protocol-qualified entry.
- Select Add, then Close → OK.
- Reload the page or restart the affected browser-based application.
Consider whether https://app.example.com is sufficient instead of example.com. Treat HTTP and HTTPS mappings separately when the application uses different protocols. Include a parent domain only if all relevant subdomains are controlled and approved.
For an internal application, Local Intranet may be the correct destination, but do not select it merely because the application is important. Assign the site according to its actual ownership, network identity, and required behavior.
How to remove a site or undo a change
- Open Internet Options → Security.
- Select the zone and choose Sites.
- Select the entry and choose Remove.
- Apply the change, then restart or reload the affected application.
To restore a zone template, select the zone and choose Default level, where available. This does not necessarily undo organization-enforced settings. Group Policy or device-management synchronization can restore managed values.
If an entry cannot be removed, or the Sites controls are unavailable, the device may be managed. Do not fight the policy with local registry edits; ask the administrator to review the assignment and its business justification.
Rank #4
- speed
- native
- simple
- light
Individual settings that matter
The zone slider is only a template. The important individual controls can include:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- ActiveX: Whether controls can run, download, initialize, or be scripted. ActiveX permissions are zone-specific and can be restricted to approved publishers or domains.
- Active scripting: Whether legacy script content can run.
- File and font downloads: Whether the site can download those content types.
- Cross-domain data access: Whether content can access data across security boundaries.
- Zone elevation and navigation: Whether content can move between zones or navigate across security contexts.
- Protected Mode: A separate defense-in-depth feature that reduces the locations Internet Explorer content can write to in the registry and file system when exploited content is running.
- SmartScreen-related controls: Applicable Windows and browser protections that should not be treated as interchangeable with zone settings.
Protected Mode does not make an overly permissive Trusted Sites entry harmless. A site can receive additional capabilities from its zone even when other protections remain enabled.
Group Policy and enterprise management
In Group Policy Editor, relevant administrative templates are generally under:
Computer Configuration
→ Administrative Templates
→ Windows Components
→ Internet Explorer
→ Internet Control Panel
→ Security PageZone-specific settings appear under the relevant Internet, Intranet, Trusted Sites, or Restricted Sites zone. Depending on the organization’s configuration, administrators can control ActiveX, scripting, downloads, Protected Mode, cross-domain access, zone elevation, and related security behavior.
Important controls include:
- Security Zones: Do not allow users to add/delete sites.
- Security Zones: Use only machine settings.
- Turn on Protected Mode.
- Zone-specific ActiveX, scripting, download, navigation, and cross-domain policies.
- AllowSiteToZoneAssignmentList for centrally assigning sites.
Settings are commonly stored per user under:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZonesCommon zone subkeys are 0 Local Machine, 1 Local Intranet, 2 Trusted Sites, 3 Internet, and 4 Restricted Sites. Zone mappings are commonly under:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMapMachine-wide policy locations may be under:
HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftWindowsCurrentVersionInternet SettingsRegistry editing is an administrator-level troubleshooting method, not the normal configuration path. Export the relevant key first, understand whether Group Policy or MDM owns the value, and avoid overwriting managed settings.
Best Value
- Easily control web videos and music with Alexa or your Fire TV remote
- Watch videos from any website on the best screen in your home
- Bookmark sites and save passwords to quickly access your favorite content
Internet Explorer zones in Microsoft Edge IE mode
IE mode supplies a compatibility rendering environment inside Edge for legacy sites. The Enterprise Mode Site List determines which sites open in IE mode; it does not automatically make those sites Trusted Sites.
A legacy application can therefore fail even when the zone entry looks correct. Check:
- Whether the page is actually in IE mode rather than ordinary Edge mode.
- Whether Edge has downloaded and applied the Enterprise Mode Site List.
- Whether the exact hostname and protocol have the intended zone mapping.
- Whether Windows and Edge policies agree.
- Whether the required ActiveX control or add-on is installed and compatible.
- Whether the certificate chain and publisher trust are valid.
Microsoft’s IE mode add-on troubleshooting guidance specifically uses inetcpl.cpl and distinguishes certificate trust, add-on configuration, and zone settings. IE mode can behave differently from standalone IE because rendering, site-list delivery, certificates, policies, and integration are separate variables.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Practical troubleshooting playbooks
The intranet site is classified as Internet
- Compare the hostname actually used with the expected internal hostname.
- Test short and fully qualified names separately.
- Check DNS, proxy, and automatic intranet-detection changes.
- Inspect the ZoneMap assignment and policy list.
- Assign the exact host through policy where appropriate rather than broadly lowering the Internet zone.
The site appears in Trusted Sites but still fails
- Confirm the exact hostname, including subdomains.
- Check whether the failing script, frame, control, or API uses another hostname.
- Check whether HTTP and HTTPS are mapped differently.
- Inspect the individual zone setting required by the application.
- Check Group Policy and machine-only settings.
- Confirm that IE mode is active.
- Separate certificate, authentication, ActiveX, and rendering failures from zone failures.
ActiveX is blocked
Do not enable ActiveX broadly in the Internet zone. Restrict the application to a dedicated legacy workflow, use the narrowest approved hostname scope, require signed controls and trusted certificates, and plan to replace the ActiveX-dependent system. Microsoft’s policy documentation covers the relevant zone-specific ActiveX controls.
A certificate warning appears
Trusted Sites is not a safe certificate-error bypass. Investigate the certificate chain, hostname mismatch, expiration, TLS configuration, and enterprise certificate deployment. For managed legacy add-ons, distribute required certificates through the organization’s approved certificate-management process.
The user cannot edit the Sites list
Check for the policy that prevents users from adding or deleting sites, hidden Security controls, machine-only settings, Group Policy, and MDM management. A local administrator may still be unable to change a centrally enforced configuration.
A fix works in IE but not Edge IE mode
Confirm that IE mode is active, the site list has been downloaded and applied, the same zone mapping is present, the required control is compatible, and both Edge and Windows policies are configured. See Microsoft’s IE mode FAQ for site-list behavior.
Free tools Windows power users keep installed
One-click scans. No signup required.
Zone changes do not take effect
Restart the affected application, wait for policy refresh, check the user profile under which the application runs, verify the loaded hostname, and look for cross-zone resources. A higher-precedence policy can override the local value.
Security recommendations
- Keep the Internet zone at its default or approved organizational level.
- Use Trusted Sites only for documented, vetted exceptions.
- Prefer protocol- and hostname-specific mappings.
- Do not trust an entire parent domain unless every relevant subdomain is controlled.
- Do not use Trusted Sites to bypass certificate warnings.
- Avoid broad ActiveX enablement and require signed, trusted controls where legacy use is unavoidable.
- Review and remove obsolete exceptions periodically.
- Keep Windows, Edge, certificates, endpoint controls, and identity systems maintained.
- Plan to modernize or replace applications that depend on IE, ActiveX, or obsolete authentication.
Administrator audit checklist
- Export the current site-assignment policy and identify every Trusted Sites entry.
- Record the business owner, purpose, protocol, hostname scope, and review date for each exception.
- Check for parent-domain entries that unintentionally cover many subdomains.
- Compare user-level and machine-level zone settings.
- Review Group Policy and MDM precedence.
- Verify Protected Mode and individual ActiveX, scripting, download, and cross-domain settings.
- Confirm that the Enterprise Mode Site List contains only sites that require IE mode.
- Remove mappings for retired applications and vendors.
Bottom line
Internet Explorer security zones remain a useful legacy control for Windows applications and Edge IE mode, but they are not a modern web-security solution. Identify the exact site and behavior involved, assign the narrowest practical zone exception, check policy and certificates, and avoid lowering the Internet zone or broadly enabling ActiveX to solve a single compatibility problem.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
