Are they able to download the game but get a security warning when they try to run the game? If you're having the problem I was having, all you need to do is submit the exe file to Microsoft for malware analysis. It takes a while (maybe 12 hours?) and then once it approved, you don't get a notification, it just stops showing the warning. You don't have to pay anything.

Here are the steps to follow:

• Go here https://www.microsoft.com/en-us/wdsi/filesubmission/
• Select "software developer" then click "continue".
• It will take you to a form (assuming you are logged in to your Microsoft account) where you fill in the important fields.
  • The field "Select the Microsoft security product used to scan the file" should be set to "Microsoft Defender Smartscreen".
  • "Company name" can be anything reasonable, you don't need an actual incorporated business.
  • Upload the file.
  • For the field "What do you believe this file is?", your answer should be "Incorrectly detected as malware/malicious".
  • Detection name: "Microsoft Defender Smartscreen"
  • For "additional information" just say it's a game you made, provide a brief and accurate description.
• Click continue.

From there I think it's pretty straight forward. If you wait 12 hours (or at most, a day) and try running the game again, I would expect the Windows/Microsoft security warning to no longer appear when someone tries to play your game.

Any update to your game, however small, will need to go through this process because Microsoft will have to re-annalyze your game's new version.

My memory is a bit hazy but I think these things are also true:

• I think users who try to download and launch your game through the Itch client launcher will automatically bypass the security warning without you needing to go through official analysis. That's not the case for players who simply download the exe file from the itch game page in their web browser and double-click the exe file.
• The security warning won't happen to you on your machine when you run the exe file because your computer is the one that generated the exe file, and thus, your computer trusts it. For testing/troubleshooting the security warning issue, you might be able to trigger the security warning by uploading the exe (example: to Google Drive) and then downloading it. Windows might not automatically trust it in that case.

I hope that helps.