How to Check if a Link Is Safe Before Clicking: Complete 2026 Guide

Every day, billions of links are shared through email, social media, SMS, and messaging apps. Most are harmless, but a growing percentage lead to phishing pages, malware downloads, scam stores, or credential-stealing sites. Knowing how to check if a link is safe before you click is now one of the most valuable digital skills you can have, whether you're protecting your personal accounts or your company's data.

This guide walks you through the fastest manual checks, the best free online link scanners, and the warning signs that experienced security analysts look for. By the end, you'll have a repeatable process for vetting any suspicious URL in under 60 seconds.

What Does "Safe Link" Actually Mean?

A safe link is a URL that leads to its advertised destination without exposing your device, data, or identity to harm. In practice, that means the link does not install malware, does not impersonate a trusted brand to steal credentials, does not redirect through tracking chains designed to profile you, and does not trigger drive-by downloads or browser exploits.

Unsafe links generally fall into one of five categories: phishing pages, malware delivery URLs, scam or fraud sites, exploit kits, and spam redirects. The techniques below will help you identify all five.

10 Ways to Check if a Link Is Safe Before Clicking

Use this layered approach. No single check is perfect, but combining three or four will catch nearly every malicious URL you encounter.

1. Hover before you click. On desktop, hovering your mouse over a link reveals the true destination in the bottom-left corner of your browser. On mobile, long-press the link to preview the URL without opening it.
2. Inspect the domain carefully. Look at the exact spelling of the root domain. Attackers register lookalikes such as paypa1.com, micros0ft-login.com, or amaz0n-support.net.
3. Expand shortened URLs. Use an unshortener to see where a tiny link really goes before clicking.
4. Run it through a link scanner. Free tools like VirusTotal, Google Safe Browsing, and URLVoid aggregate dozens of threat databases.
5. Check the SSL certificate. Click the padlock icon to confirm the certificate is issued to the brand you expect, not a random third party.
6. Look up the domain age. Phishing domains are usually less than 30 days old. A WHOIS lookup takes 10 seconds and reveals a lot.
7. Watch for urgency and emotion. Links wrapped in "Act now," "Your account will be suspended," or "You've won" messaging are a top phishing indicator.
8. Verify through a second channel. If the link claims to be from your bank, close the message and log in through the official app or by typing the URL manually.
9. Scan the landing page in a sandbox. Services like URLScan.io and Browserling open the page in an isolated browser so you see screenshots and network activity without risk.
10. Trust your browser warnings. If Chrome, Edge, Firefox, or Safari shows a red interstitial, do not click through. These warnings have a very low false-positive rate.

Best Free Tools to Check if a Link Is Safe

These scanners cover 95% of real-world threats and require no account.

Tool	Best For	What It Checks	Cost
VirusTotal	Overall link and file scanning	70+ antivirus engines and blocklists	Free
Google Safe Browsing	Known phishing and malware URLs	Google's threat database	Free
URLScan.io	Seeing the actual landing page safely	Screenshot, DOM, network requests	Free
URLVoid	Reputation across multiple services	30+ blocklist databases	Free
PhishTank	Community-reported phishing	Verified phishing URL database	Free
Sucuri SiteCheck	Website malware and blocklist status	Malware signatures, defacements	Free

How to Use VirusTotal in 15 Seconds

1. Go to virustotal.com.
2. Click the "URL" tab.
3. Paste the suspicious link and press Enter.
4. Review the detection ratio. Anything above 0/70 deserves caution; 3 or more detections usually confirms malice.

How to Check Shortened Links (bit.ly, t.co, tinyurl)

Shortened URLs are convenient, but they hide the final destination, making them a favorite tool for scammers. Fortunately, trustworthy shorteners offer transparency, and free unshortening tools let you preview any link.

Methods to Reveal a Shortened Link

• Add a preview character. For bit.ly links, add a + to the end (e.g., bit.ly/abc123+) to see the destination and click stats.
• Use an unshortener service. CheckShortURL, Unshorten.it, and ExpandURL.net all reveal the final URL instantly.
• Paste into URLScan.io. This follows every redirect and shows the complete chain.
• Choose transparent shorteners. Reputable providers like Lunyb and others reviewed in our 2026 buyer's guide use HTTPS, scan destinations for malware, and provide click analytics so recipients can verify trust before clicking.

Red Flags That a Link Is Dangerous

Even without a scanner, you can spot most malicious links by looking for these warning signs.

Domain and URL Red Flags

• Misspelled or substituted characters (rn instead of m, zero instead of O, numeral 1 instead of lowercase L).
• A legitimate brand name as a subdomain of an unrelated domain, such as apple.com.secure-login.tk.
• Unusual top-level domains for a known brand (.tk, .xyz, .top, .click for a supposed bank link).
• Excessive hyphens or random strings of letters and numbers in the domain.
• IP addresses instead of domain names (e.g., http://192.168.44.21/login).
• No HTTPS, or an HTTPS certificate issued to a different entity.

Context Red Flags

• Unexpected messages from banks, couriers, tax authorities, or streaming services.
• Pressure tactics: countdowns, threatened account closure, legal action.
• Offers that are too good to be true (free iPhones, giveaways, crypto doubling).
• Attachments or links sent from a contact who "never messages you like this."
• Grammar errors, awkward phrasing, or mismatched sender name and email domain.

How to Check a Link on Mobile (iPhone and Android)

Mobile browsers hide more of the URL by default, which is exactly why phishing works so well on phones. Use these mobile-specific checks.

iPhone and iPad

1. Long-press the link until a preview card appears. Read the full URL before tapping "Open."
2. In Safari, tap the address bar to see the complete URL, not just the domain.
3. Enable "Fraudulent Website Warning" under Settings > Safari.
4. Copy the link and paste it into VirusTotal via your mobile browser if anything looks off.

Android

1. Long-press the link and choose "Copy link address" to inspect it in a notes app before opening.
2. Keep Google Play Protect enabled for app-related link scanning.
3. Use Chrome's Safe Browsing in Enhanced mode (Settings > Privacy and security > Safe Browsing).
4. Install a reputable mobile security app if you receive many SMS links.

How to Check Links in Email

Email remains the number-one delivery channel for malicious links. These habits will catch nearly every phishing attempt.

1. Check the sender's full email address, not just the display name. Amazon Support <noreply@amaz0n-help.ru> is obviously fake once you expand it.
2. Hover over every link in the email body before clicking.
3. Compare link text to actual destination. If the visible text says paypal.com but the href points to bit.ly/xyz or an unknown domain, it's a phish.
4. Open attachments in a sandbox or scan them with VirusTotal first.
5. When in doubt, go direct. Open a new browser tab and type the company's URL yourself rather than clicking.

How to Check Links on Social Media and Messaging Apps

WhatsApp, Telegram, Instagram DMs, and X (Twitter) are flooded with shortened and cloaked URLs. The rules are similar but with a few platform-specific tips.

• On WhatsApp and Telegram, tap and hold a link to copy it, then paste into an unshortener before opening.
• On X, hover over t.co links on desktop to see the expanded destination in the status bar.
• On Instagram, swipe-up and link-sticker destinations can be previewed by tapping the three-dot menu on some devices.
• Treat any crypto, giveaway, or "check out my photos" link from a known contact with extreme suspicion. Account takeovers are rampant.

What to Do If You Already Clicked a Suspicious Link

Clicking a malicious link is not always catastrophic, but you should act quickly.

1. Disconnect from the internet if you suspect a download started. Turn off Wi-Fi and mobile data.
2. Do not enter any credentials on the page that loaded. Close it immediately.
3. Run a full antivirus scan with your built-in security tool (Windows Defender, XProtect) or a trusted third-party scanner.
4. Change passwords for any account you may have exposed, starting with email and banking. Enable two-factor authentication everywhere.
5. Monitor your accounts for the next 30 days for unauthorized logins, transactions, or password-reset emails you didn't request.
6. Report the link to Google Safe Browsing, PhishTank, or the impersonated brand's abuse address so others are protected.

How Trusted URL Shorteners Protect You

Not all shortened links are dangerous. Modern shorteners actually add safety layers that raw URLs lack. Reputable providers scan destinations against malware databases, enforce HTTPS, offer click analytics, and let link creators disable or edit a URL if abuse is reported.

For example, Lunyb runs automated safety checks on destinations, uses secure redirects, and gives creators dashboards to monitor click patterns, so suspicious traffic can be shut down quickly. When evaluating a provider for your own links, compare transparency features and security practices in our best URL shorteners guide or our Rebrandly review. Choosing a trustworthy shortener protects both you and the people who click your links.

Building a 60-Second Link-Safety Habit

The most effective defense is turning the checks above into a reflex. Here's a simple routine you can apply to any link.

1. Hover or long-press to preview the URL (5 seconds).
2. Read the root domain carefully for lookalike characters (10 seconds).
3. If shortened, expand it (15 seconds).
4. If anything is off, paste into VirusTotal or URLScan.io (30 seconds).
5. If still unsure, go directly to the official site in a new tab instead.

Teach this five-step habit to family members, especially older relatives and teenagers, who are the most frequently targeted groups. It costs nothing and prevents the vast majority of real-world attacks.

Frequently Asked Questions

Is it dangerous to just click a link without entering any information?

Usually no, but not always. Most phishing pages require you to enter credentials to do harm. However, drive-by downloads, zero-day browser exploits, and tracking scripts can execute the moment a page loads. Keeping your browser and operating system fully updated eliminates the majority of this risk.

Does HTTPS mean a link is safe?

No. HTTPS only means the connection between you and the website is encrypted. Over 80% of phishing sites now use valid HTTPS certificates because they're free to obtain. Always verify the domain itself, not just the padlock.

What is the single best free tool to check a link?

VirusTotal is the best all-around choice because it checks a URL against 70+ security vendors at once. For seeing what a page actually looks like without visiting it, URLScan.io is unmatched.

Are QR codes safer than links?

No, they're often more dangerous because you cannot read the destination before scanning. Use a QR scanner app that previews the URL before opening it, and apply the same checks you would to any other link.

How can I tell if a shortened link is safe before clicking it?

Expand it first using a service like CheckShortURL, Unshorten.it, or URLScan.io. For bit.ly links specifically, add a + character to the end of the URL to see the destination and click statistics. Then run the expanded URL through VirusTotal.