Windows Firewall prompts: should you allow the app?

When Windows Firewall asks whether to allow an app, it is asking about an exception for network traffic that can reach that program. The prompt does not certify that the software is safe.

Allow access only when you recognise the app, understand which feature needs incoming connections, and can choose a network profile that fits where you will use it. If you only need the app to connect to a website or game server, try blocking the prompt first.

On a normally configured Windows PC, unsolicited incoming connections are blocked by default while outgoing connections are allowed unless another rule blocks them. So joining an online game is not automatically a reason to accept an inbound exception. Hosting a local game session or sharing files with other devices can be different. Microsoft's Windows Firewall rules guidance explains both the default behavior and why an app may prompt for an inbound rule.

This is a documentation-based guide to Windows 11's built-in firewall. A work or school policy, a custom firewall rule, or third-party security software can change what happens on a particular PC; Microsoft notes that organizational policy may prevent changes in its Windows Security firewall settings guide .

What the Private and Public boxes control

The choices in the prompt are network profiles. Checking Private or Public means that the app's exception can apply while Windows classifies the current connection under that profile. It does not change the profile of your Wi-Fi or Ethernet connection.

This distinction matters. If you allow an app only on Private but Windows currently labels your connection Public, that exception will not apply on that connection. Checking both boxes may make the app reachable on more networks than you intended.

Windows 11 sets new connections to Public by default, which Microsoft recommends for most networks. A PC on a Public profile is hidden from other devices on that network. A Private profile makes the PC discoverable and supports features such as file and printer sharing. Use Private only when you trust the devices on that network and need those features; ordinary web browsing does not require it. Microsoft's Windows network settings guide explains the profiles and where to change them.

Decide whether the app needs an exception

Use the app's purpose to make the choice:

• You do not recognise the app, did not just open it, or cannot confirm where it came from: choose Cancel or block access. Check the publisher's official download or support page before doing anything else. Do not approve an unfamiliar program just because Windows displayed a prompt.
• You recognise the app, but only need it to connect out to an online service: block the prompt for now, then test that feature. Windows normally allows outgoing connections by default, so the inbound exception may not be necessary.
• You need other devices on your local network to connect to the app: for example, you are hosting a LAN game or using a local sharing feature. Allow the app only on the profile that matches a network whose connected devices you trust. Test the feature you needed.
• You think it needs access while you are on a Public network: leave Public unchecked unless the app's official instructions explain why it needs to accept incoming connections there. Public networks can include devices you do not control.

An allow rule is not a general trust decision. It gives a program permission to receive matching traffic under the selected profile. If the same app has several entries, confirm the program name and publisher before changing a rule.

Check how Windows classifies your current network

Before changing a profile, check the active connection:

1. Open Settings → Network & internet.
2. For Wi-Fi, select Wi-Fi, then the connected network. For a wired connection, select Ethernet.
3. Read Network profile type.

Keep Public when you do not trust the other devices or do not need your PC to be discoverable. Change to Private only when you trust the devices on that specific network and need local discovery or sharing. Changing a network to Private affects other Windows firewall rules too, not only the app in the prompt.

If the app is allowed on Private but the active connection is Public, decide whether the network should really be Private before broadening the app rule. Do not select Public simply to make the warning go away.

Review or revoke an app's access later

You can change the allowed-app list without turning off the firewall:

1. Open Windows Security → Firewall & network protection.
2. Select Allow an app through firewall, then Change settings. Windows may ask for administrator confirmation.
3. Find the app and clear the Private or Public box for any profile where it does not need incoming access. Clear both to remove its allowed-app exception, then select OK.
4. Test the feature again. If it stops working, check the app publisher's instructions and the active network profile before restoring access.

Microsoft's instructions for allowing or removing apps recommend allowing an app only when needed and removing exceptions that are no longer required. The same guidance describes opening a port as riskier than adding an app-specific exception. Avoid opening ports or switching off the firewall as a shortcut; use an exact rule only when the app's publisher or your administrator explains why it is required.

A managed work or school PC may not let you change these settings. If Windows reports that the setting is controlled by your organisation, ask its administrator rather than trying to work around the policy.

The safe default is straightforward: block prompts you cannot explain, test whether the app actually needs incoming access, and allow a known app only on the narrowest profile that supports the feature you need.