You get an email with an attachment called invoice.pdf. You double-click it, and instead of a document, a virus installs itself. The problem: the real file name was invoice.pdf.exe, but Windows 11 had hidden the “.exe” part. You never saw it coming.

This one missing setting costs individuals and small businesses across the Mauricie region hours of headaches, and sometimes much worse. The good news is it takes about ten seconds to fix. Here’s how to show file extensions in Windows 11, why it’s a basic security habit, and how to use it to spot a booby-trapped file before it does any damage.

1. What is a file extension?

A file extension is the short set of letters after the dot, at the end of a file name. It tells Windows what type of file it is and which program should open it. You run into them every day, even if you don’t always notice:

• .docx or .doc: a Word document
• .xlsx: an Excel workbook
• .pdf: a PDF document
• .jpg or .png: an image
• .exe, .msi, .bat: a program that runs on your computer

Those last three are the ones that carry risk. An image file or a PDF just displays content, while an executable file can install software, change your system, or launch ransomware. Being able to tell the two apart at a glance is already a layer of protection.

2. Why Windows 11 hides them by default

For the sake of simplicity, Microsoft hides the extensions of known file types right out of the box. The idea is to keep the interface cleaner for everyday users. The catch is that attackers figured out a long time ago how to take advantage of this setting.

When the extension is hidden, a file called contract.pdf.exe simply shows up as contract.pdf. Slap on a fake PDF icon, and the attacker has you convinced it’s a harmless document. You double-click without thinking twice, and the malicious program runs. It’s one of the oldest and most effective tricks in the book for spreading malware by email.

Showing extensions won’t protect you 100 percent, but it removes the element of surprise. A file ending in “.exe” when you were told it’s an invoice is an immediate red flag.

3. Show extensions in 3 clicks

The fastest way is straight through File Explorer. This works on any Windows 11 machine, at home or in the office.

• Open File Explorer (the folder icon in your taskbar, or Windows key + E).
• In the bar at the top, click View.
• Hover over Show in the dropdown, then check File name extensions.

It’s instant: all your files now show their full extension. The setting is global, so it applies to every window and stays on after a restart. To turn it off later, just retrace the same steps and uncheck the box.

4. The alternative method: Folder Options

If you manage several computers, or you’d rather use the older settings window, there’s a second route that also works on Windows 10.

• In File Explorer, click the three dots in the toolbar, then Options.
• Go to the View tab.
• In the list of advanced settings, uncheck “Hide extensions for known file types.”
• Click Apply, then OK.

This window comes in handy for businesses, since the same panel also lets you show hidden files and system folders. Microsoft documents all of these display settings, which is useful if you want to standardize the configuration across your team’s computers.

5. Spotting a booby-trapped file using extensions

Once extensions are visible, make it a habit to check the end of the file name before opening anything that arrives by email, USB drive, or download. Here are the signs that should make you pause:

• A double extension like “.pdf.exe,” “.docx.scr,” or “.jpg.bat.” No legitimate document works that way.
• An executable extension (.exe, .msi, .bat, .cmd, .scr, .js) attached to an email claiming to be an invoice, a delivery slip, or a payment notice.
• A compressed file (.zip, .rar) that, once opened, contains an executable instead of the promised document.

When in doubt, don’t double-click. Delete the email or have your IT team check the file first. If your business wants to strengthen these habits and filter dangerous attachments before they ever reach your inbox, our managed IT services cover email protection and employee training. This simple habit pairs well with the guidance from the Canadian Centre for Cyber Security on spotting phishing emails and malware.

6. Best practices for your business

Showing extensions is a great starting point, but it should be part of a broader routine to really cut down on risk across your computers:

• Standardize the setting on every computer in the company, ideally through group policy or your remote management tool.
• Train your staff to check the extension before opening any attachment, especially in departments that handle a lot of invoices.
• Keep antivirus software up to date along with email filtering, to block dangerous files before they reach anyone.
• Keep recent, tested backups, your best insurance if malware slips through anyway.

In Trois-Rivieres and across the Mauricie region, most of the incidents we see at small businesses start with a single click on the wrong file. A clean configuration and good habits cut most of these attacks off before they start.

Frequently asked questions

How do I see a file’s extension in Windows 11?

Open File Explorer, click “View” at the top, then “Show” and check “File name extensions.” All your extensions become visible right away, across every folder.

Is it risky to show file extensions?

No, quite the opposite. Showing extensions doesn’t change any files and doesn’t weaken your system in any way. It’s actually recommended for security, since it helps you spot executable files disguised as documents.

Why does Windows hide extensions by default?

Microsoft hides them to simplify the display for everyday users. The downside is that this setting makes it easier for attackers to disguise programs as fake PDFs or images. Showing them is a smart habit to build.

Secure your computers with an IT partner in the Mauricie region

Showing file extensions takes ten seconds, but truly protecting a small business takes a complete approach: computer configuration, email filtering, backups, and training. If you’d like to put all of this in place without having to think about it, check out our managed IT services for small businesses or contact our team in Trois-Rivieres. We’ll take care of securing your devices so your employees can work with peace of mind.