How to Check if a Link Is Safe Before Clicking: The Complete 2026 Guide

Every day, billions of links are shared across email, social media, and messaging apps — and a growing percentage of them lead somewhere they shouldn't. Phishing kits, malware droppers, and credential harvesters are cheaper and more convincing than ever, which means learning how to check if a link is safe is no longer a technical skill reserved for IT teams. It's a survival skill for anyone with an inbox.

This guide walks you through every reliable method to verify a URL before you click it, the red flags that should stop you cold, and the tools professionals use to unmask shortened or suspicious links.

Why Checking Links Before Clicking Matters

A single click on a malicious link can install spyware, hand over your login credentials, or lock your files behind ransomware. Unlike downloading a file — where most operating systems warn you — clicking a link often triggers exploits silently in the background.

According to industry reporting, phishing remains the number one initial access vector for cyberattacks, and more than 90% of successful breaches begin with a user clicking something they shouldn't have. The good news: nearly all of those clicks are avoidable with a 15-second verification habit.

What Attackers Are Trying to Do

• Steal credentials via fake login pages that mimic Google, Microsoft, or your bank.
• Install malware through drive-by downloads or browser exploits.
• Collect personal data for identity theft or targeted follow-up scams.
• Hijack sessions using stolen cookies or tokens.
• Redirect to scam pages selling counterfeit goods or fake investment schemes.

10 Ways to Check if a Link Is Safe Before Clicking

Below are the most effective methods, ordered from fastest to most thorough. You don't need all ten — combining two or three will catch the vast majority of malicious links.

1. Hover Over the Link to Preview the Real URL

On desktop, hover your mouse over any hyperlink (without clicking). Your browser or email client will show the actual destination URL in the bottom-left corner. On mobile, press and hold the link until a preview appears.

Compare the visible link text to the real URL. If the text says paypal.com but the real link points to paypa1-security.ru, that mismatch is a dead giveaway.

2. Inspect the Domain Carefully

Attackers rely on lookalike domains. Read the domain from right to left, starting at the top-level domain (TLD):

1. Identify the TLD (.com, .org, .ru, etc.).
2. Look at the word immediately before it — that's the true root domain.
3. Everything before that root is a subdomain and can be faked.

For example, in login.microsoft.support-team.xyz, the real domain is support-team.xyz, not Microsoft. Common tricks include swapped characters (rn for m), added hyphens, and unusual TLDs like .zip, .top, or .click.

3. Use a URL Scanner

Free online scanners analyze links against threat intelligence databases without you visiting the site. The most reliable include:

• VirusTotal — checks the URL against 70+ antivirus and blocklist engines.
• URLVoid — cross-references dozens of reputation services.
• Google Safe Browsing Transparency Report — shows if Google has flagged the site.
• PhishTank — community-maintained database of known phishing URLs.
• urlscan.io — renders the page in a sandbox and shows what it actually does.

Paste the suspicious link into any of these and you'll get a verdict in seconds.

4. Expand Shortened Links Before Clicking

Short links (bit.ly, t.co, tinyurl, and others) hide the destination. Before clicking one from an unknown sender, expand it using an unshortening service such as CheckShortURL, Unshorten.It, or ExpandURL. Reputable shorteners like Lunyb also let recipients preview the destination when link previews are enabled by the creator.

If you're the one sharing links, choosing a trustworthy shortener matters. Our 2026 buyer's guide to URL shorteners compares the safest options and their built-in security features.

5. Check the HTTPS Certificate — But Don't Trust It Alone

The padlock icon means the connection is encrypted, not that the site is legitimate. Phishing sites routinely use free SSL certificates. Still, the absence of HTTPS on a login page is a strong red flag. Click the padlock to view the certificate and confirm the domain name matches the site you expected.

6. Look Up the Domain's Age and Registration

Legitimate businesses usually have domains registered for years. Phishing domains are often days or weeks old. Use a WHOIS lookup tool (like whois.domaintools.com) to check:

• Registration date — anything under 90 days deserves extra scrutiny.
• Registrar country — mismatches with the claimed business location are suspicious.
• Privacy protection — legitimate businesses often disclose ownership; total anonymity is not proof of malice but adds context.

7. Use Browser Built-in Protection

Modern browsers already block known malicious sites. Make sure these features are enabled:

• Chrome: Settings → Privacy and security → Safe Browsing → Enhanced protection.
• Firefox: Settings → Privacy & Security → Deceptive Content and Dangerous Software Protection.
• Edge: Settings → Privacy → Microsoft Defender SmartScreen.
• Safari: Preferences → Security → Warn when visiting a fraudulent website.

8. Sandbox the Link in an Isolated Environment

If you absolutely need to see what a link does but don't trust it, open it in a disposable environment:

1. urlscan.io or Browserling — remote browsers that render the page for you.
2. Windows Sandbox — a throwaway Windows session built into Windows 10/11 Pro.
3. A virtual machine with no saved credentials and no access to your main network.

This is the professional's approach when analyzing suspicious emails.

9. Check the Link's Reputation on Search Engines

Copy the domain (not the full link — never paste tracking parameters) and search for it along with terms like "scam," "phishing," or "review." If others have been burned, you'll usually find warnings on Reddit, Trustpilot, or scam-tracking sites within the first page of results.

10. Use Encrypted DNS and Filtering Services

Services like Cloudflare 1.1.1.1 for Families, NextDNS, and Quad9 block known malicious domains at the DNS level — meaning the link fails to resolve before your browser even connects. This adds a passive safety net across every device on your network without requiring you to remember to check each link manually.

Red Flags That Should Stop You From Clicking

Even without tools, certain signals should trigger immediate suspicion.

In the Link Itself

• Misspelled brand names (amaz0n, faceb00k, gooogle).
• Excessive subdomains before the real domain.
• Unusual TLDs on official-looking pages (.zip, .mov, .click, .top).
• IP addresses instead of domain names (http://192.168.x.x/login).
• Punycode or non-Latin characters designed to look like normal letters.
• URL shorteners from unknown senders with no context.

In the Message Containing the Link

• Urgency ("Your account will be closed in 24 hours").
• Threats of legal action, fines, or account suspension.
• Unexpected attachments or invoices.
• Requests to "verify" credentials, payment details, or 2FA codes.
• Generic greetings ("Dear Customer") from companies that know your name.
• Sender email addresses that don't match the claimed brand.

Quick Comparison: Free Link Safety Tools

Tool	What It Checks	Best For	Speed
VirusTotal	70+ antivirus & blocklist engines	General URL scanning	Instant
urlscan.io	Live rendering, screenshots, network activity	Analyzing what a page actually does	10–30 seconds
Google Safe Browsing	Google's malware & phishing database	Confirming known threats	Instant
PhishTank	Community-verified phishing URLs	Email-based phishing checks	Instant
URLVoid	30+ reputation services	Domain reputation overview	Instant
CheckShortURL	Expands shortened links	Bit.ly, TinyURL, t.co, etc.	Instant

How to Check Links on Mobile Devices

Mobile makes link verification harder because there's no cursor to hover with, and small screens hide details. Use these techniques instead:

On iOS

1. Long-press the link to preview the destination URL and a page snapshot.
2. Use the Share sheet to copy the link, then paste it into a scanner like VirusTotal in another tab.
3. Enable Fraudulent Website Warning in Settings → Safari.

On Android

1. Long-press the link and choose Copy link address.
2. Paste it into a URL scanner before opening.
3. Turn on Safe Browsing in Chrome's privacy settings.
4. Consider a DNS filtering app (NextDNS, Cloudflare 1.1.1.1) for network-wide protection.

What to Do If You Already Clicked a Suspicious Link

Mistakes happen. If you've already clicked, act quickly:

1. Disconnect from the internet to stop any active data transfer.
2. Do not enter any credentials if a login page appeared — close the tab immediately.
3. Run a full antivirus scan using your current security tool plus a second-opinion scanner like Malwarebytes.
4. Change passwords for any accounts you might have exposed, starting with email and banking.
5. Enable two-factor authentication on every important account if you haven't already.
6. Monitor bank and credit card statements for the next 30–60 days.
7. Report the phishing link to Google Safe Browsing, PhishTank, and the impersonated brand.

How Legitimate Link Shorteners Protect You

Not all shortened links are dangerous — the technology itself is neutral. Reputable shorteners run scanning on every link created, block known malware destinations, and let recipients preview the final URL. When choosing a shortener for your own links, look for:

• Automatic malware and phishing scanning on submission.
• HTTPS enforcement on both the short and destination URLs.
• Optional preview pages so recipients can verify the destination.
• Analytics that don't expose personal data.
• A clear privacy policy and no history of abuse.

Platforms like Lunyb and established alternatives reviewed in our Rebrandly review build these protections in by default, which is why enterprise teams trust them over anonymous free shorteners that skip vetting.

Building a Personal Link-Checking Habit

The strongest defense isn't any single tool — it's a routine. Adopt this three-second checklist before clicking anything from an unexpected source:

1. Look at the real URL (hover or long-press).
2. Ask whether you were expecting this message.
3. Verify through a second channel if money, credentials, or personal data are involved.

That habit alone will neutralize the majority of phishing attempts you'll ever face.

Frequently Asked Questions

Is it dangerous to just click a link without entering any information?

It can be. While most modern browsers block outdated exploits, drive-by downloads and zero-day vulnerabilities do exist. A link can also fingerprint your device, log your IP, or redirect through tracking chains. The safest rule: if you can't verify the source, don't click.

Are all shortened links unsafe?

No. Shortened links from reputable services with built-in scanning are generally safe. The risk comes from the sender, not the shortener. Always expand shortened links from unknown senders using a tool like CheckShortURL or urlscan.io before opening.

Does the padlock icon mean a website is safe?

No. The padlock only means the connection is encrypted — anyone can obtain a free SSL certificate, including scammers. Use HTTPS as a baseline requirement but always verify the domain name and reputation separately.

What's the fastest way to check a link on my phone?

Long-press the link to see the destination URL, then copy it and paste into VirusTotal or Google Safe Browsing's transparency report. The whole process takes under 20 seconds and works on both iOS and Android.

Can antivirus software catch every malicious link?

No security product catches everything. Antivirus, browser protection, and DNS filtering each block a different slice of threats, and brand-new phishing sites often bypass them for hours before being flagged. Combining automated tools with your own habit of verifying links gives you the strongest defense.

Final Thoughts

Learning how to check if a link is safe takes minutes to master and pays off for the rest of your digital life. The tools are free, the habits are simple, and the alternative — a compromised account or drained bank balance — is far more expensive than a few seconds of caution. Bookmark two or three of the scanners mentioned above, enable your browser's built-in protection, and treat every unexpected link as guilty until proven innocent.