webthreatdefence is using 8.3% of CPU. how to reduce it?

First identify whether the CPU is being consumed by Web Threat Defense Service itself or by Microsoft Defender Antivirus, because the supported remediation differs and deleting junk files will not address either condition.

1. Identify the exact executable

1. Press Ctrl+Shift+Esc to open Task Manager.
2. Select Details, right-click the column header, choose Select columns, and enable Command line.
3. Find the entry consuming approximately 8.3% CPU:
   • If it is MsMpEng.exe / Antimalware Service Executable, continue with the Defender analysis below.
   • If it is svchost.exe, right-click it and select Go to service(s). Check whether Windows highlights webthreatdefsvc.
4. Observe it for several minutes while the computer is idle. Task Manager’s Processes, Details, and Services pages are intended to identify resource-heavy processes and their associated services.^1^

Do not end or permanently disable the service. Web Threat Defense is part of Enhanced Phishing Protection in Microsoft Defender SmartScreen, which provides warnings for malicious sites, password reuse, and unsafe password storage.^2^

2. If MsMpEng.exe is using the CPU

Defender can run scans after security-intelligence updates, and sustained activity can also result from repeatedly scanning particular files, processes, large archives, network folders, or unsigned binaries.^3^

Use Defender’s Performance Analyzer to find the actual scan target:

1. Open Windows PowerShell as administrator.
2. Run the commands below.
3. Leave the computer in the state where the CPU problem occurs for two or three minutes.
4. Press Enter to stop recording, then review the reported paths, files, and processes.

New-MpPerformanceRecording -RecordTo "$env:USERPROFILE\Desktop\DefenderCPU.etl"

Get-MpPerformanceReport `
  -Path "$env:USERPROFILE\Desktop\DefenderCPU.etl" `
  -TopFiles 10 `
  -TopProcesses 10

The analyzer supports Windows 10 and Windows 11 and reports files, extensions, paths, and processes that have the greatest scan impact.^4^

Act on the result rather than adding broad exclusions:

• Update or remove an obsolete application if its files dominate the report.
• Move large .iso, .vhd, or .vhdx files out of redirected, OneDrive, or network-backed profile folders if they are repeatedly scanned.
• If another antivirus, EDR, VPN, or security product appears in the report, check that vendor for a documented Defender compatibility configuration.
• Avoid excluding entire user, Downloads, or Windows folders; that reduces protection.

3. If webthreatdefsvc itself remains busy

Since cleanup and subsequent updates did not help, repair the Windows component store and protected system files:

1. Search for Command Prompt.
2. Select Run as administrator.
3. Run DISM first, wait for it to finish, and then run SFC:

DISM.exe /Online /Cleanup-image /Restorehealth
sfc /scannow

4. Restart Windows and check Task Manager again.

DISM supplies repair files, while System File Checker checks protected Windows files and replaces damaged copies.^5^

If CPU consumption continues after repair and the executable is definitely svchost.exe hosting webthreatdefsvc, collect a short Windows Performance Recorder trace while the issue is occurring. Microsoft recommends limiting this advanced trace to approximately three to five minutes; it can then be supplied to Microsoft Support to identify the busy thread or component.^6^

References

1. Windows 11
2. WebThreatDefense Policy CSP | Microsoft Learn
3. Troubleshoot performance issues - Microsoft Defender for Endpoint
4. Performance analyzer for Microsoft Defender Antivirus
5. Using System File Checker in Windows | Microsoft Support
6. Troubleshoot Microsoft Defender Antivirus performance issues with WPRUI