How to Check if a Link Is Safe Before Clicking (2026 Guide)

Every day, billions of links are shared through email, social media, messaging apps, and search results. Most are harmless, but a growing percentage lead to phishing pages, malware downloads, scam stores, or credential-stealing clones of legitimate sites. Learning how to check if a link is safe before you click it is one of the most important digital self-defense skills of 2026.

This guide walks you through the exact warning signs to look for, the free tools security professionals use to scan URLs, and the habits that keep you safe even when a link looks completely trustworthy.

Why Checking Links Before Clicking Matters

A single click on a malicious link can expose your passwords, install ransomware, drain your bank account, or hand over control of your social media accounts. According to industry phishing reports, more than 90% of successful cyberattacks begin with a link in a message, and attackers are now using AI to generate more convincing lures than ever.

The good news: almost every unsafe link leaves clues. If you know what to look for and which tools to use, you can verify a URL in under 30 seconds.

10 Warning Signs of an Unsafe Link

Before reaching for a scanner, train your eye to spot red flags. A suspicious link usually shows at least one of the following signals.

1. Misspelled domain names — "amaz0n.com", "paypa1-login.com", or "micros0ft-support.net".
2. Unusual top-level domains — legitimate brands rarely use obscure TLDs like .zip, .top, .xyz, or .click for login pages.
3. Extra subdomains — "paypal.com.secure-login.ru" is not PayPal; the real domain is always the one just before the TLD.
4. No HTTPS padlock — a missing padlock on a login or payment page is a deal-breaker.
5. Shortened URLs with no preview — bit.ly, t.co, or tinyurl links can hide anything.
6. Urgent or threatening language around the link ("Your account will be closed in 24 hours").
7. Mismatched display text — the visible text says "paypal.com" but hovering reveals a different URL.
8. Random character strings in the path (e.g., "/x8f2k9d/login.php").
9. Unexpected file downloads ending in .exe, .scr, .zip, or .iso.
10. Requests for credentials or payment on a page you reached from an unsolicited message.

How to Inspect a URL Manually

Manual inspection is your first line of defense and takes only a few seconds. Here is the process security analysts follow.

Step 1: Hover Before You Click

On desktop, hover your mouse over any link without clicking. The real destination appears in the bottom corner of your browser or email client. On mobile, press and hold the link to reveal a preview.

Step 2: Read the Domain Right-to-Left

The true owner of a URL is the part immediately to the left of the final slash and TLD. In https://login.microsoft.com.badsite.ru/verify, the actual domain is badsite.ru, not Microsoft.

Step 3: Check for HTTPS and the Certificate

Click the padlock icon in your browser to view the site's security certificate. A legitimate business site will usually show a certificate issued to the correct organization. HTTPS alone does not mean a site is safe — phishing pages use it too — but its absence on a sensitive page is a serious warning.

Step 4: Look at the Path and Parameters

Long, random-looking paths with many parameters (?id=xyz&token=abc123&redirect=...) are common in phishing kits. Open redirects that bounce you through a trusted domain to a shady one are another frequent trick.

Best Free Tools to Check if a Link Is Safe

When manual inspection is not enough, free online scanners can analyze a URL against dozens of threat databases in seconds. Here are the most reliable options in 2026.

Tool	What It Checks	Best For	Price
VirusTotal	Scans URL against 70+ antivirus and blocklist engines	Deep multi-engine analysis	Free
Google Safe Browsing	Google's phishing and malware database	Quick yes/no verdict	Free
URLVoid	Reputation across 30+ blocklists, domain age, server info	Investigating unknown sites	Free
PhishTank	Community-verified phishing database	Reported phishing URLs	Free
urlscan.io	Live sandbox visit, screenshots, network requests	Seeing a page without visiting it yourself	Free + paid tiers
Sucuri SiteCheck	Malware, defacement, blacklist status	Checking websites you own or visit often	Free

How to Use VirusTotal (Recommended First Step)

1. Go to virustotal.com.
2. Click the URL tab.
3. Paste the suspicious link and press Enter.
4. Review the results. If more than two or three engines flag it as malicious, do not visit the site.

How to Use urlscan.io for a Safe Preview

urlscan.io actually loads the page in an isolated environment and shows you screenshots, the domain tree, and every network request. This lets you see what a phishing page looks like without risking your own device.

How to Expand Shortened URLs Safely

Shortened links (bit.ly, t.co, tinyurl, buff.ly) hide the destination, which is convenient for sharing but dangerous when the sender is unknown. Before clicking any short link, expand it.

Free URL expanders include:

• CheckShortURL.com — shows the final destination plus safety ratings.
• Unshorten.it — expands and runs a basic reputation check.
• ExpandURL.net — simple, fast, no account needed.

Reputable link management platforms also prioritize user safety on the shortening side. Services like Lunyb scan destinations and block known malicious URLs before a short link is even created, which is one reason enterprise teams prefer established shorteners over anonymous free tools. If you are choosing a shortener for your own brand, our 2026 buyer's guide to the best URL shorteners compares the safety features of the leading platforms.

Browser Features That Protect You Automatically

Modern browsers block a huge number of threats before you even see them. Make sure these settings are turned on.

Chrome and Edge

• Enable Enhanced Safe Browsing in Privacy & Security settings.
• Turn on HTTPS-First Mode.
• Keep Google Safe Browsing active (on by default).

Firefox

• Enable Deceptive Content and Dangerous Software Protection.
• Turn on HTTPS-Only Mode in all windows.
• Consider privacy-focused forks like LibreWolf for extra hardening.

Safari

• Enable Fraudulent Website Warning.
• Keep Intelligent Tracking Prevention on.

Extra Layers of Protection

Beyond scanners and browser settings, these habits dramatically lower your risk.

Use Encrypted DNS

Services like Cloudflare (1.1.1.1), Quad9 (9.9.9.9), and NextDNS filter known malicious domains at the network level. If a link resolves to a flagged domain, the connection is blocked before your browser ever loads it. Encrypted DNS also protects your lookups from being read by your network provider.

Keep Software Updated

Many malware payloads exploit old browser or operating system vulnerabilities. Automatic updates close those doors.

Use a Password Manager

Password managers only auto-fill credentials on the exact domain they were saved for. If you land on "paypa1.com" and your manager refuses to fill the login form, that is a huge red flag.

Enable Multi-Factor Authentication

Even if you accidentally give away a password to a phishing site, MFA (ideally using an authenticator app or hardware key) stops attackers from logging in.

Use a Separate Browser Profile for Sensitive Activity

Keep banking and work logins in one browser profile and casual browsing in another. This reduces the chance that a compromised tab can interact with sensitive sessions.

How to Check a Link on Mobile

Phones make link inspection harder because hovering is not possible, but you still have options.

1. Long-press the link to see a preview of the full URL before opening.
2. Copy the link and paste it into VirusTotal or urlscan.io in your browser.
3. Use mobile security apps from reputable vendors (Bitdefender, Malwarebytes, ESET) that scan links in real time.
4. Avoid clicking links in SMS from unknown numbers — "smishing" is one of the fastest-growing attack vectors.

Red Flags Specific to Email Links

Email is still the top delivery channel for phishing. Before clicking any link in a message, ask:

• Does the sender's domain exactly match the brand they claim to represent?
• Is the greeting generic ("Dear Customer") when the real company usually uses your name?
• Is there pressure to act immediately?
• Does the link text match where the link actually points?
• Were you expecting this message?

When in doubt, do not click. Open a new browser tab and type the company's real address yourself, then log in and check for any legitimate notifications.

What to Do If You Already Clicked a Suspicious Link

If you clicked before checking, stay calm and act quickly.

1. Disconnect from the internet if you suspect a download started.
2. Do not enter any credentials on the page that opened.
3. Close the tab immediately.
4. Run a full antivirus scan using Windows Defender, Malwarebytes, or your preferred tool.
5. Change passwords for any accounts you may have logged into recently, starting with email and banking.
6. Enable MFA everywhere if you have not already.
7. Monitor accounts for unauthorized activity for the next several weeks.
8. Report the link to Google Safe Browsing, PhishTank, or your IT team.

Quick Link-Safety Checklist

Save this checklist and run through it whenever you are unsure about a link.

• ✅ Hover and read the real destination.
• ✅ Check spelling of the domain and TLD.
• ✅ Confirm HTTPS is present on login or payment pages.
• ✅ Expand shortened URLs before clicking.
• ✅ Scan with VirusTotal or urlscan.io if anything feels off.
• ✅ Never enter credentials from a link in an unsolicited message.
• ✅ Trust your instincts — if it feels wrong, close the tab.

Frequently Asked Questions

Is it safe to click a link just to see where it goes?

No. Some malicious links trigger drive-by downloads or browser exploits the moment the page loads, before you interact with anything. Always preview with a scanner like urlscan.io or VirusTotal instead of visiting unknown URLs directly.

Does HTTPS mean a website is safe?

Not on its own. HTTPS only means the connection between your browser and the site is encrypted — it says nothing about the site's intentions. Many modern phishing pages have valid HTTPS certificates. Treat HTTPS as a baseline, not a guarantee.

Are shortened URLs always dangerous?

No. Short links from reputable services and known senders are fine. The risk comes from not being able to see the destination. When a short link arrives from an unknown source, expand it first with a tool like CheckShortURL or paste it into VirusTotal.

What is the fastest way to check if a link is safe?

Copy the URL, open virustotal.com, paste it into the URL tab, and read the verdict. The entire check takes about 15 seconds and queries dozens of security engines at once.

Can antivirus software block malicious links?

Yes. Most modern antivirus and internet security suites include real-time URL filtering that blocks known phishing and malware domains before the page loads. Combined with browser Safe Browsing features and encrypted DNS, this gives you strong layered protection.

Final Thoughts

Checking whether a link is safe is a 30-second habit that can save you from hours — or years — of damage control. Combine a trained eye for red flags, a quick scanner like VirusTotal, browser-level protections, and encrypted DNS, and you will block the vast majority of threats before they reach you. The internet rewards curiosity, but it rewards caution even more.