How to Check if a Link Is Safe Before Clicking: The 2026 Guide

Every day, billions of links travel through email, social media, and messaging apps. Most are harmless, but a small percentage lead to phishing pages, malware downloads, or scam sites designed to steal your data. Learning how to check if a link is safe before clicking is one of the most valuable digital skills you can build in 2026.

This guide walks you through the exact methods security professionals use to verify URLs, from quick visual checks to free scanning tools. By the end, you'll be able to inspect any link in under 30 seconds and confidently decide whether to click it.

Why Checking Links Matters More Than Ever

A malicious link is a URL that leads to a website designed to harm the visitor, whether through malware installation, credential theft, or financial fraud. According to recent industry reports, phishing attacks account for more than 80% of reported security incidents, and shortened or disguised links are a primary delivery method.

The problem is that dangerous links often look legitimate. Attackers use lookalike domains (like arnazon.com instead of amazon.com), free hosting subdomains, and URL shorteners to hide their true destination. A single careless click can compromise your email account, drain a bank balance, or infect an entire company network.

Common Places You Encounter Risky Links

• Phishing emails claiming to be from banks, delivery services, or streaming platforms
• SMS messages about "failed deliveries" or "account issues"
• Social media DMs with sensational headlines or fake giveaways
• Comment sections on YouTube, Reddit, and forums
• QR codes on posters, restaurant menus, and parking meters
• Ads on free streaming or download sites

10 Red Flags That Signal a Suspicious Link

Before running any technical checks, train your eyes to spot obvious warning signs. These red flags catch the majority of malicious URLs without any tools at all.

1. Misspelled domain names — paypa1.com, faceboook.com, or micros0ft.com.
2. Extra words in the domain — apple-support-login.com is not owned by Apple.
3. Unusual top-level domains — legitimate brands rarely use .zip, .top, .xyz, or .click for login pages.
4. IP addresses instead of domain names — a link like http://192.168.44.21/login should raise immediate suspicion.
5. Missing HTTPS — while HTTPS alone doesn't guarantee safety, its absence on a login page is a serious red flag.
6. Urgency or fear language — "Your account will be closed in 24 hours, click here."
7. Too-good-to-be-true offers — free iPhones, crypto giveaways, or lottery wins.
8. Shortened links from unknown senders — bit.ly, tinyurl, or unfamiliar shorteners in unsolicited messages.
9. Mismatched anchor text — the visible link says paypal.com but hovering shows a different URL.
10. Excessive subdomains — login.secure.verify.bank.example-site.ru is almost certainly a scam.

Step-by-Step: How to Check if a Link Is Safe

Follow this five-step process any time you receive a link you're unsure about. It takes less than a minute and catches the vast majority of threats.

Step 1: Hover Before You Click

On desktop, hover your mouse over the link without clicking. Your browser will display the real destination URL in the bottom-left corner. On mobile, press and hold the link (without releasing) to reveal a preview. If the destination doesn't match what the link claims to be, don't click.

Step 2: Expand Shortened URLs

Shortened links hide the true destination. To reveal where a short URL points, paste it into an unshortening tool like:

• CheckShortURL.com — shows the final destination and site preview
• Unshorten.it — expands links and rates their safety
• URLEX.org — displays the full redirect chain

Reputable shorteners like Lunyb also let you preview links transparently, and legitimate services generally include safety scanning behind the scenes.

Step 3: Run the URL Through a Scanner

Free online scanners compare URLs against threat intelligence databases used by antivirus companies and browsers. Paste the suspicious link (never click it) into one of these tools:

• VirusTotal (virustotal.com) — scans the URL with 90+ security engines
• Google Safe Browsing Transparency Report — Google's official database of unsafe sites
• URLVoid — cross-references 30+ blocklists and reputation services
• Sucuri SiteCheck — checks for malware, defacement, and blacklist status
• PhishTank — community database of confirmed phishing pages

Step 4: Inspect the Domain's Age and Reputation

Legitimate businesses have domains registered years ago. Freshly registered domains (under 90 days old) are heavily overrepresented in phishing campaigns. Check domain age using:

• WHOIS lookup (whois.domaintools.com) — reveals registration date and registrar
• ICANN Lookup — official domain registration data

If a site claiming to be your bank was registered last week, it isn't your bank.

Step 5: Use a Sandbox for High-Risk Links

If you absolutely must see what a link contains, open it in an isolated environment. Services like urlscan.io and Browserling load the page inside a remote sandbox and show you screenshots, network requests, and any redirect behavior — all without exposing your device.

Comparison of Free Link Safety Tools

Not all URL scanners work the same way. The table below compares the most popular free options so you can choose the right one for your situation.

Tool	Best For	Scan Engines	Shows Screenshot	Price
VirusTotal	Comprehensive multi-engine scan	90+	No	Free
urlscan.io	Sandbox preview + network analysis	Multiple feeds	Yes	Free
Google Safe Browsing	Quick reputation check	Google's index	No	Free
URLVoid	Reputation from multiple blocklists	30+	No	Free
Sucuri SiteCheck	Malware and defacement detection	Sucuri engine	No	Free
PhishTank	Confirmed phishing lookups	Community-verified	No	Free

Pros and Cons of Automated Scanners

Pros:

• Instant results with no software installation
• Aggregate data from dozens of security vendors
• Free for personal use
• Safe — the scanner visits the URL, not you

Cons:

• Newly created phishing sites may not be in databases yet (zero-day risk)
• Some tools log the URLs you submit publicly — avoid submitting private links
• Cannot detect targeted attacks aimed at a single victim

How to Check Links on Mobile Devices

Mobile browsers make hovering impossible, and small screens hide URL details. Here's how to inspect links safely on iOS and Android.

iPhone and iPad

1. Press and hold the link until a preview card appears.
2. Read the full URL shown at the top of the preview.
3. If it looks suspicious, tap outside the preview to dismiss it — do not tap "Open."
4. To scan the URL, tap "Copy" and paste it into VirusTotal in a separate browser tab.

Android

1. Long-press the link to open the context menu.
2. Select "Preview link" (Chrome) or "Copy link address."
3. Paste into a scanner before opening.
4. Enable Google Play Protect and Chrome's "Safe Browsing — Enhanced protection" in settings.

Special Case: QR Codes

QR codes are just visual URLs, and "quishing" (QR phishing) has exploded in 2025 and 2026. Attackers place fake QR stickers over legitimate ones on parking meters, restaurant tables, and posters.

Before scanning a QR code:

• Check for physical tampering — stickers layered on top of printed codes are a red flag.
• Use a QR scanner app that previews the URL before opening it (most modern camera apps do this by default).
• Never enter payment or login credentials on a page reached only via a QR code without independently verifying the domain.

Browser Settings That Protect You Automatically

Modern browsers include built-in link scanning that catches known threats before pages load. Make sure these are enabled:

Chrome and Edge

Go to Settings → Privacy and security → Security and turn on Enhanced Protection (Chrome) or Microsoft Defender SmartScreen (Edge). These features check URLs in real time against Google's and Microsoft's threat feeds.

Firefox

Under Settings → Privacy & Security → Deceptive Content and Dangerous Software Protection, ensure all three checkboxes are enabled.

Safari

Go to Safari → Settings → Security and enable Warn when visiting a fraudulent website.

Additional Layers of Protection

Link checking is one layer of a broader security strategy. Combine it with these practices:

• Keep your operating system, browser, and antivirus updated — patched software blocks most drive-by exploits.
• Use encrypted DNS resolvers like Cloudflare (1.1.1.1) or Quad9 (9.9.9.9), which filter known malicious domains at the network level.
• Enable multi-factor authentication everywhere. Even if a phishing page steals your password, MFA blocks the attacker.
• Use a password manager — it will refuse to autofill on lookalike domains, giving you a subtle warning.
• Prefer trusted shorteners with built-in scanning and analytics. Services covered in our 2026 URL shorteners buyer's guide compare the safety features of the major providers.

What to Do If You Already Clicked a Suspicious Link

Mistakes happen. If you've clicked a link that turned out to be dangerous, act quickly:

1. Disconnect from the internet — turn off Wi-Fi and mobile data to stop data exfiltration.
2. Do not enter any credentials if a login page loaded — close the tab immediately.
3. Run a full antivirus scan using your device's security software.
4. Change passwords for any accounts you might have exposed, starting with email.
5. Enable MFA on affected accounts if you haven't already.
6. Monitor bank and credit card statements for at least 90 days.
7. Report the link to Google Safe Browsing, PhishTank, and the impersonated brand's abuse team.

Frequently Asked Questions

Is HTTPS a guarantee that a link is safe?

No. HTTPS only means the connection between your browser and the server is encrypted — it says nothing about who owns the site or whether it's malicious. Phishing pages routinely use free HTTPS certificates. Check the domain name itself, not just the padlock icon.

Can I check a link without opening it at all?

Yes. Copy the URL (right-click → Copy link address on desktop, long-press → Copy on mobile) and paste it into VirusTotal, urlscan.io, or Google Safe Browsing. These services visit the URL from their own infrastructure, so your device is never exposed.

Are shortened links always dangerous?

Not at all. URL shorteners are used by news sites, marketers, and businesses for legitimate reasons like tracking clicks and creating memorable links. The risk comes from context — a shortened link from a trusted source is usually fine, while one from an unsolicited message deserves scrutiny. Reputable shorteners like Lunyb include preview features and integrate safety scanning to reduce risk.

How can I tell if an email link is really from my bank?

Don't click. Open a new browser tab, type your bank's address manually (or use a saved bookmark), and log in there to check for any real notifications. Legitimate banks never require you to click an email link to "verify" your account.

What's the fastest safety check I can do?

Hover to reveal the true URL, read the domain from right to left (the part just before .com is the real owner), and paste it into VirusTotal if anything looks off. The whole process takes about 20 seconds and blocks the vast majority of phishing attempts.

Final Thoughts

Knowing how to check if a link is safe is no longer optional — it's a core digital literacy skill. The five-step process (hover, expand, scan, check age, sandbox) combined with the ten red flags will protect you from nearly every consumer-grade phishing and malware attempt you'll encounter in 2026.

Build the habit of pausing for two seconds before every click. That tiny delay is often the only thing standing between a normal day and a security incident. Combine link inspection with strong passwords, MFA, encrypted DNS, and a reputable link management platform, and you'll be operating well above the security baseline of the average internet user.