How to Check if a Link Is Safe Before Clicking: Complete 2026 Guide

Every day, billions of links are shared across emails, text messages, social media, and chat apps. Most are harmless, but a growing percentage lead to phishing pages, malware downloads, scam stores, or credential-stealing sites. Knowing how to check if a link is safe before clicking is now a baseline digital survival skill, not an optional one.

This guide walks you through the exact techniques security professionals use to vet suspicious URLs, including free scanning tools, manual inspection methods, and the red flags that should make you close the tab immediately.

What Does It Mean for a Link to Be "Safe"?

A safe link is a URL that leads to the destination it claims to lead to, does not attempt to install malicious software, does not harvest credentials under false pretenses, and does not redirect through hostile infrastructure. In other words, safety covers both the destination and the journey.

A link can be unsafe in several ways:

• Phishing: The page impersonates a trusted brand to steal logins, card numbers, or personal data.
• Malware delivery: Clicking triggers a drive-by download or exploits a browser vulnerability.
• Scam commerce: Fake stores take payment but never ship, or clone legitimate retailers.
• Tracking and fingerprinting: The link exists purely to profile you across the web.
• Redirect chains: The visible URL is clean, but it bounces through several hostile domains before landing.

7 Warning Signs a Link Might Be Dangerous

Before touching any scanning tool, train your eye to spot obvious red flags. Most malicious links fail at least one of these visual tests.

1. Misspelled domains: arnazon.com, paypa1.com, or micros0ft-login.com are classic typosquats.
2. Excessive subdomains: login.secure.verify.account.random-site.ru hides the real domain at the end.
3. Mismatched anchor text: A hyperlink says "www.yourbank.com" but hovering reveals a totally different URL.
4. Urgency or threats: "Click within 24 hours or your account will be deleted."
5. Unusual top-level domains: Legitimate brands rarely use obscure TLDs like .zip, .top, or .xyz for login portals.
6. Shortened links from strangers: A raw bit.ly or tinyurl link in an unsolicited DM is a reason to pause.
7. No HTTPS padlock on login pages: Any site asking for credentials over plain HTTP is either compromised or malicious.

How to Check if a Link Is Safe: 6 Reliable Methods

If a link raises suspicion, run it through one or more of the following checks before clicking. None of these require advanced technical skills.

1. Hover Before You Click

On desktop, place your cursor over the link without clicking. The real destination appears in the bottom-left corner of your browser or email client. On mobile, long-press the link to reveal a preview of the URL. If the preview doesn't match what the text promises, don't tap.

2. Use a URL Scanner

Dedicated scanners check a link against databases of known phishing, malware, and scam domains. Paste the URL into one of these free services:

• VirusTotal (virustotal.com) — aggregates results from 70+ security vendors.
• Google Safe Browsing Transparency Report — checks if Google has flagged the site.
• URLVoid — cross-references dozens of blocklists.
• PhishTank — community-driven phishing database.
• Sucuri SiteCheck — scans for malware and blacklist status.

If two or more services flag the URL, treat it as hostile and move on.

3. Expand Shortened Links First

Short links hide the destination by design. Before clicking a shortened URL, expand it with a service like CheckShortURL, Unshorten.it, or ExpandURL. These tools reveal the final destination and often run a basic safety check at the same time.

Reputable shortening platforms also help here. Services such as Lunyb and other established providers reviewed in our best URL shorteners guide publish safety information and apply abuse filtering before links go live, which cuts down on malicious use of their domains.

4. Inspect the Domain Carefully

Read the URL from right to left. The real domain is the last chunk before the first single slash. In https://accounts.google.com.verify-login.ru/signin, the real domain is verify-login.ru, not Google. Scammers rely on people reading left to right and giving up partway.

5. Check Domain Age and Reputation

Phishing domains are typically registered days or weeks before use. Run the domain through a WHOIS lookup (such as whois.domaintools.com or who.is) to see when it was created. A "bank login" page on a domain registered three days ago is almost certainly a scam.

6. Open in a Sandbox

If you absolutely must visit a suspicious URL, use a sandboxed environment. Options include:

• urlscan.io — loads the page in a controlled browser and shows you screenshots plus network activity.
• Browserling or Browserscan — remote browsers that isolate the page from your device.
• A virtual machine on your own computer with no saved credentials.

Comparison: Free Link Safety Tools

Tool	What It Checks	Best For	Cost
VirusTotal	70+ antivirus and blocklist engines	Comprehensive second opinion	Free
Google Safe Browsing	Google's phishing/malware database	Checking well-known threats	Free
urlscan.io	Live sandbox rendering + network trace	Visual inspection without risk	Free (public scans)
PhishTank	Community phishing reports	Freshly reported phishing pages	Free
URLVoid	30+ blocklists and reputation scores	Reputation overview	Free
Sucuri SiteCheck	Website malware and blacklist status	Checking if a site is compromised	Free

How to Check Links on Mobile Devices

Mobile browsers hide URL bars quickly and shrink long domains, which plays into attackers' hands. Use these mobile-specific habits:

iOS (iPhone and iPad)

• Long-press any link in Safari, Messages, or Mail to see a preview card with the real URL.
• Enable Safari's "Fraudulent Website Warning" under Settings → Safari.
• Use the built-in Mail app's warnings about suspicious senders rather than dismissing them.

Android

• Long-press to preview; share the URL to a scanner app instead of opening it directly.
• Keep Google Play Protect enabled for real-time app and link scanning.
• Install a reputable mobile security app that includes web protection.

How to Check Links in Email

Email remains the number-one delivery channel for malicious links. Follow this short process for any message that asks you to click:

1. Verify the sender address, not just the display name. Apple Support <support@apple-id-verify.co> is not Apple.
2. Hover over every link to reveal the true destination.
3. Check the email headers if you're technical — look for failed SPF, DKIM, or DMARC results.
4. Never log in from an email link. Open a new tab and type the site's address manually.
5. Report and delete suspected phishing using your mail provider's built-in button.

What to Do If You've Already Clicked

Mistakes happen. If you clicked a link that now looks suspicious, act quickly:

1. Disconnect from the internet if you suspect a drive-by download, then run a full antivirus scan.
2. Don't enter any information on the page that opened. Close the tab.
3. Change passwords for any account you may have exposed, starting with email and banking.
4. Enable two-factor authentication on every important account if you haven't already.
5. Watch for unusual activity on bank statements, email login notifications, and account recovery alerts for the next 30 days.
6. Report the link to Google Safe Browsing, PhishTank, and the impersonated brand so others are protected.

Pros and Cons of Automated Link Scanners

Pros

• Catch known threats in seconds without exposing your device.
• Aggregate intelligence from many security vendors at once.
• Free for individual users and easy to use with no technical knowledge.
• Provide screenshots and network data so you can inspect without visiting.

Cons

• Brand-new phishing pages may not yet be in any database ("zero-hour" threats).
• Scanners can miss links that only serve malicious content to specific geographies or devices.
• False positives occasionally flag legitimate sites.
• Publicly submitted scans may be visible to others, which matters for sensitive URLs.

Building Long-Term Habits for Link Safety

Tools help, but habits save you. Adopt these practices permanently:

• Type important URLs manually for banking, government, and work logins.
• Use a password manager. It will refuse to autofill credentials on a lookalike domain, which is one of the strongest phishing defenses available.
• Keep your browser and OS updated. Many malicious links rely on known vulnerabilities that patches already fix.
• Enable encrypted DNS (DNS over HTTPS) in your browser to block some malicious domains at the network level.
• Use a privacy-respecting browser with built-in phishing and tracker protection.
• Choose trustworthy link shorteners. If you share links professionally, pick a provider with transparent abuse policies — our Rebrandly review and shortener comparison guide cover the main contenders.

Frequently Asked Questions

Is it dangerous just to click a link, or do I have to enter information?

Clicking alone can be enough. Drive-by downloads exploit browser or plugin vulnerabilities to install malware without any input from you. Keeping your browser, operating system, and extensions patched sharply reduces this risk, but the only guaranteed protection is not clicking in the first place.

Are shortened links always suspicious?

No. Shortened links are a normal part of marketing, social media, and SMS communication. The suspicion should come from context: who sent it, why, and whether you expected it. Expanding the link with a preview tool before clicking resolves most doubt. Reputable platforms like Lunyb also apply abuse filtering so their short domains carry a better baseline reputation.

Does HTTPS mean a link is safe?

No. HTTPS only means the connection is encrypted between your browser and the server. Phishing sites routinely use free HTTPS certificates to look legitimate. Always combine the padlock check with domain inspection and, when in doubt, a URL scanner.

What is the fastest way to check a link on my phone?

Long-press the link to preview the full URL, then copy and paste it into VirusTotal or Google Safe Browsing in your browser. The whole process takes under a minute and runs entirely on the web, so you don't need to install anything.

Can antivirus software block malicious links automatically?

Most modern security suites include web protection that blocks known malicious URLs before the page loads. This is a strong second line of defense, but it isn't perfect — zero-hour phishing pages routinely slip past for a few hours. Treat antivirus as a safety net, not a replacement for careful clicking.

Final Thoughts

Checking whether a link is safe takes less than a minute once the habit is built. Hover, inspect the domain, scan with a free tool, and expand short URLs before clicking. Combine those four moves with a password manager, up-to-date software, and healthy skepticism toward urgent messages, and you'll shut down the vast majority of threats that reach your inbox or feed. The internet rewards caution — and a one-minute check is far cheaper than a stolen account, drained bank balance, or compromised device.