How to Check if a Link Is Safe Before You Click

To check a link safely, do two things before you click: read the real destination, and, if anything feels off, scan it with a free tool like VirusTotal or urlscan.io that opens the page on their servers instead of yours. The single most important skill is finding the registrable domain — the part of the address a scammer cannot fake — because everything else in a URL is decoration they control.

Find the real domain, the only part that cannot be faked#

A web address has one meaningful anchor: the registrable domain, sometimes called the root domain or eTLD+1. It is the name plus its ending (the top-level domain like .com, .net, .org) sitting immediately to the left of the first single slash. Everything to the left of that is a subdomain the owner invented, and everything to the right of the slash is a path they also invented. Only the registrable domain is bought and registered, so it is the one label an attacker cannot forge.

Read the address from right to left#

Most people read left to right, stop at the first familiar word, and get caught. Train yourself to read a URL backwards from the first single slash:

1. Ignore https:// and any www. at the start.
2. Find the first single / after the domain. Everything after it is the path — ignore it for now.
3. Just before that slash, take the last two labels: the name and its TLD.

Worked examples:

• https://shop.example.com/orders -> registrable domain is example.com. shop is a subdomain of the same owner. Safe if you trust example.com.
• https://example.com.login-secure.net/verify -> registrable domain is login-secure.net. The example.com is a fake subdomain bolted onto someone else's site. Not example.com at all.
• https://paypal.com.account-check.xyz/login -> registrable domain is account-check.xyz. A classic phishing pattern.

One wrinkle: country domains like .co.uk, .com.au, or .gov.uk use two labels for the ending, so the BBC's real domain is bbc.co.uk, not co.uk. Browsers use a shared Public Suffix List to work this out, and so should you — when the ending looks like a country pair, take three labels instead of two.

Watch for look-alike letters#

Attackers register domains that look identical at a glance: rn instead of m, a capital I instead of a lowercase l, or a 0 for an O. Worse are homograph attacks, where a Cyrillic or Greek letter replaces a Latin one — an а that is not the a on your keyboard. Modern browsers defend against this by showing mixed-script domains in Punycode, so a faked аpple.com appears in the address bar as something like xn--pple-43d.com. If you ever see an xn-- prefix on a domain that should be an ordinary English word, that is a red flag, not a glitch.

Preview a link before you commit#

You never have to visit a page to see where it points.

• Desktop: hover your mouse over the link without clicking. The true destination appears in the status bar at the bottom-left of Chrome, Edge, Firefox, or Safari.
• iPhone/iPad: press and hold (long-press) the link. A preview card slides up with the full URL at the top.
• Android: long-press the link and choose to copy or preview the address before opening.

The reason this matters: the blue text you see and the actual link are two separate things. A message can display www.yourbank.com while the underlying link goes to bank-secure-login.ru. The display text is written by whoever sent it; the hover or long-press shows the real href. Always trust the preview, never the wording.

Deal with shortened and hidden links#

Shorteners like bit.ly, t.co, tinyurl.com, and ow.ly collapse a long address into a few characters and, in doing so, hide the destination. Many are innocent, but they strip away your ability to read the domain, so treat an unexpected short link with extra care.

You can expand most of them without visiting:

• For a Bitly link, add a + to the end (bit.ly/abc123+) to open Bitly's own preview page showing the target and click stats.
• Paste any short link into a free expander such as unshorten.it or checkshorturl.com to reveal the final address.
• Or paste it straight into a scanner (below), which will both expand and inspect it.

Scan a suspicious link with free tools#

When reading the domain is not enough, three free services check a link on their infrastructure, not yours:

• VirusTotal (virustotal.com) — paste a URL under the URL tab and it checks the address against roughly 90 security vendors and blocklists at once. Green across the board is reassuring; even a couple of "malicious" flags is a reason to walk away.
• urlscan.io — visits the page in a sandbox and returns a screenshot, the list of domains it contacted, and whether it is impersonating a known brand. You get to see the page without it ever touching your device.
• Google Safe Browsing Site Status (transparencyreport.google.com/safe-browsing/search) — tells you whether Google currently lists a site as dangerous. This is the same database that powers the red warning screens in Chrome and Safari.

For everyday protection, turn on Enhanced Protection in Chrome under Settings > Privacy and security > Security, which checks links in real time rather than against a cached list.

What the padlock really means#

The padlock icon and https:// only tell you that traffic to the site is encrypted — that no one between you and the server can read it. It says nothing about whether the site is honest. Because certificates are now free through services like Let's Encrypt, the large majority of phishing sites use HTTPS and show a padlock too. Treat the padlock as "this connection is private," never as "this site is safe." A criminal's checkout page can be perfectly encrypted while it steals your card.

Common mistakes people make#

• Trusting the padlock as proof of safety. It only means encrypted, not legitimate.
• Reading the domain left to right and relaxing at the first trusted word, missing that paypal.com is only a subdomain of evil-site.com.
• Believing the link text. The visible words are chosen by the sender; only the hover preview shows the real target.
• Assuming a short link from a friend is fine. Hijacked accounts send links that look in-character. Confirm through another channel if it feels off.
• Panicking at urgency. "Your account will be closed in 24 hours" is engineered to make you skip every check above. Slow down; that pressure is the tell.

A safer default habit#

For anything involving money, passwords, or logins, do not click the link at all. Reach the company the way you already know: open its official app, or type the address you have used before, or use a saved bookmark. If a page ever asks you to sign in, glance at the address bar and confirm the registrable domain before you type a single character.

FAQ#

Is it dangerous just to open a link, or only to enter details?#

Simply loading a page is usually low-risk on an updated browser and phone; the real danger is what you type or download once there. Keep your browser and operating system current, since updates quietly block many known malicious sites. If you land somewhere wrong, close the tab before entering anything and no harm is typically done.

Does HTTPS mean a website is trustworthy?#

No. HTTPS and the padlock only mean the connection is encrypted, and free certificates mean most phishing sites have them too. Judge safety by the registrable domain and a scan, not by the lock icon.

How do I see where a shortened link goes without opening it?#

Add a + to the end of a Bitly link to see its preview page, or paste any short URL into an expander like unshorten.it or a scanner like VirusTotal. These reveal the final destination without loading it on your device.

I already clicked and entered my password — what now?#

Change that password immediately on the genuine site, and change it anywhere else you reused it, ideally enabling two-factor authentication. If you entered card details, call your bank using the number printed on your card and report the site so others are warned.