Excel Macro Security: How to Protect Your VBA Projects

Last week a customer called in a panic. They had opened an Excel file from an unknown email and enabled macros. Now strange processes were running on the computer and the IT department was in the middle of isolating the system.

Macros are powerful tools – and precisely for that reason they can be dangerous in the wrong hands. VBA code can do almost anything on your computer: delete files, send emails, download programs, steal data.

But used correctly, macros are no more dangerous than any Excel formula. It is about understanding the risks and setting up the right protection.

Understand the risk

VBA code runs with the same permissions you have yourself on the computer. If you can delete files, a macro can do it. If you can read documents, a macro can do it. If you can send email, a macro can do it.

Common threats: – Macro virus: Code that spreads to other files – Data theft: Code that sends sensitive information out – Ransomware: Code that encrypts your files and demands a ransom – Destructive code: Code that deletes or destroys files – Spyware: Code that logs keystrokes or screenshots

These are not theoretical risks. They really happen, and Excel macros are a common attack vector.

Basic security settings

Excel has built-in security layers. Here is how to configure them correctly.

Security levels in Excel

Step 1: Go to File > Options

Step 2: Select Trust Center in the left-hand menu

Step 3: Click “Trust Center Settings”

Step 4: Select “Macro Settings” in the left-hand menu

You now see four options:

1. Disable all macros without notification – Highest security – No macros run at all – Not even your own macros work – Use if: You never work with macros

2. Disable all macros with notification (RECOMMENDED) – Macros are blocked by default – You get a warning and can choose to enable – A balance between security and usability – Use if: You work with macros regularly

3. Disable all macros except digitally signed macros – Only macros from trusted sources are allowed – Requires digital certificates – Use if: You have a company standard with signed macros

4. Enable all macros (not recommended) – No security at all – All macros run automatically – Never use except in an isolated test environment

Our recommendation: Use option 2 for most users, option 3 for corporate environments with IT infrastructure.

Trusted locations

You can specify folders where Excel automatically trusts macros. This is practical for your own development files.

Step 1: Trust Center > Trusted Locations

Step 2: Click “Add new location”

Step 3: Select a folder (e.g. C:)

Step 4: Tick “Subfolders of this location are also trusted” if you want

IMPORTANT: Only put files YOU created, or files from COMPLETELY trusted sources, in these folders. Everything in a trusted location runs without a security check.

Identify safe vs unsafe files

When you open a file with macros, a yellow warning bar appears: “Security Warning: Macros have been disabled.”

Questions to ask before you click “Enable Content”:

1. Do I know the sender? – Yes, it’s my colleague → Probably safe – No, unknown email → DO NOT ENABLE

2. Was I expecting this file? – Yes, I asked for the report → Probably safe – No, unexpected attachment → DO NOT ENABLE

3. Does the file name seem legitimate? – “Månadsrapport_Januari.xlsm” → Probably safe – “BRÅDSKANDE_faktura_betala_nu.xlsm” → Suspicious

4. Does the file come from a trusted source? – From the company intranet → Probably safe – From an unknown website → DO NOT ENABLE

Golden rule: At the slightest doubt, do NOT enable macros. Contact the sender through another channel (call, send a new email) and confirm that the file is genuine.

Review VBA code before you run it

If you have basic VBA knowledge, you can review the code before you enable it.

Step 1: Open the file WITHOUT enabling macros

Step 2: Press Alt + F11 to open the VBA editor

Step 3: Review all modules and the code

Red flags to look for:

' MISSTÄNKT: Köra externa program
Shell "cmd.exe /c ..."
CreateObject("WScript.Shell").Run

' MISSTÄNKT: Filoperationer på systemfiler
Kill "C:\Windows\..."
Name "C:\..." As "C:\..."

' MISSTÄNKT: Nätverksaktivitet
CreateObject("MSXML2.XMLHTTP")
CreateObject("Microsoft.XMLHTTP")

' MISSTÄNKT: Dölja aktivitet
Application.ScreenUpdating = False
Application.DisplayAlerts = False

' MISSTÄNKT: Självkopiering
ThisWorkbook.VBProject.VBComponents(...)

Legitimate but powerful:

' OK i rätt sammanhang: Outlook-integration
CreateObject("Outlook.Application")

' OK: Filoperationer i användarens mappar
Kill ThisWorkbook.Path & "\temp.txt"

' OK: Performance-optimering
Application.ScreenUpdating = False

If you see code you don’t understand or that seems to do strange things – do NOT enable macros. Contact an expert.

Protect your own VBA code

If you develop macros, you often want to protect them from being changed by others or from being viewed by unauthorised people.

Password-protect the VBA project

Step 1: Open the VBA editor (Alt + F11)

Step 2: Go to Tools > VBAProject Properties

Step 3: Go to the “Protection” tab

Step 4: Tick “Lock project for viewing”

Step 5: Enter a password (twice)

Step 6: Click OK and save the file

Now nobody can open the VBA editor without the password.

IMPORTANT: – Don’t forget the password – there is no “reset” function – This protection is not military-strength but stops most users – Document the password securely for company files

Digitally sign your macros

Digital signing of macros is recommended for corporate environments.

Benefits: – Users can verify that the macro comes from you – The macro has not been changed since signing – Can be configured to be allowed automatically in the company

How to do it:

Step 1: Get a digital certificate – For testing: Use SelfCert.exe (comes with Office) – For companies: Buy a certificate from a certificate authority

Step 2: In the VBA editor, go to Tools > Digital Signature

Step 3: Select your certificate

Step 4: Click OK

Now the macro is signed. When someone opens the file they can see that it is signed by you and verify that it has not been changed.

Best practices for safe macro use

For users

1. Keep Excel updated Security updates fix known vulnerabilities. Install updates regularly.

2. Use antivirus Modern antivirus scans Excel files and can detect known malicious code.

3. Back up regularly If something goes wrong you will at least have a backup. Preferably automate this (see our article on automation).

4. Isolate testing Never test unknown macros on your main computer. Use a virtual machine or a test device.

5. Train the team Make sure everyone who works with Excel understands the risks and knows how to identify threats.

For developers

1. Comment your code Make it clear what the code does. This helps others to review it.

2. Avoid unnecessarily powerful functions If you don’t need Shell commands or file system access, don’t use them.

3. Add confirmations For destructive operations (deleting data, sending email), ask the user first:

If MsgBox("Detta raderar all data. Fortsätt?", vbYesNo) = vbNo Then
    Exit Sub
End If

4. Log activity For business-critical macros, log what happens:

Open ThisWorkbook.Path & "\log.txt" For Append As #1
Print #1, Now & " - Rapport genererad av " & Environ("USERNAME")
Close #1

5. Test thoroughly Always test on sample data before you run on production data. Bugs can be just as harmful as intentionally malicious code.

IT policy for companies

If you are responsible for IT or decide on security policy, we recommend:

1. Centralised macro administration – Sign all company macros with a company certificate – Configure Group Policy to allow only signed macros – Maintain a catalogue of approved macros

2. User training – Annual security training that includes macro risks – Clear instructions for what to do with suspicious files – A reporting procedure for security incidents

3. Monitoring – Log when macros are enabled (if possible) – Keep an eye on abnormal activity – Regular security review

4. Restrictions – Consider blocking macros completely for users who don’t need them – Use trusted locations only for centrally approved files – Restrict sharing of .xlsm files by email

What to do if something goes wrong

If you accidentally enabled macros in a suspicious file:

Step 1: Isolate – Unplug the network cable or turn off WiFi immediately – This prevents malicious code from communicating outward or spreading

Step 2: Close Excel – Ctrl + Alt + Delete > Task Manager – End all Excel processes

Step 3: Scan the system – Run a full antivirus scan – Preferably use an online tool such as second opinion

Step 4: Inform IT – If it is a company computer, contact the IT department immediately – They may need to isolate your computer from the network

Step 5: Change passwords – If the file potentially had access to sensitive information, change the relevant passwords – Especially important if you have passwords saved in the browser

Step 6: Monitor – Keep an eye on unusual activity on your account – Check that no unexpected emails have been sent from your address

Summary

Macro security is about balance. Too much security and you can’t work efficiently. Too little and you risk serious security problems.

Follow these basic rules: – Use the security setting “Disable with notification” – Enable only macros from known and trusted sources – Review code if you have the knowledge – Password-protect and sign your own macros – Train the team in safe handling – Keep systems and antivirus updated

With these routines you can benefit from the power of macros without exposing yourself to unnecessary risks.

Need help with secure macro development?

At Excel Department we follow strict security standards in all VBA development. We sign all code, document carefully and train users in safe handling.

Contact us for a consultation on secure Excel automation for your company.

---

Written by Lukas Lilja, Excel Department. We help companies build secure, efficient Excel solutions that work without compromising security.