How to Check if a Link Is Safe Before Clicking (2026 Guide)

Every day, billions of links travel through emails, text messages, social media, and chat apps. Some lead to legitimate websites, but a growing number lead to phishing pages, malware downloads, and scam platforms designed to steal your money or identity. Learning how to check if a link is safe before clicking has become one of the most important digital skills in 2026.

This guide walks you through ten reliable methods you can use in seconds, from quick visual checks to free scanning tools used by cybersecurity professionals. No technical background required.

Why Checking Links Before Clicking Matters

A malicious link can compromise your device, accounts, or finances in a single click. Phishing attacks accounted for more than 36% of all data breaches in recent years, and most start with a disguised URL sent through email, SMS ("smishing"), or social media DMs.

Attackers are getting better at mimicking real brands. A fake PayPal login page or a cloned banking site can look identical to the original. The link itself is often the only clue. Spending ten seconds to verify a URL can save you hours of account recovery, lost money, or identity theft cleanup.

Common Threats Hidden Behind Unsafe Links

Phishing pages that harvest usernames, passwords, and credit card details
Drive-by malware downloads that install spyware or ransomware automatically
Fake giveaway or crypto scams promising rewards in exchange for wallet access
Session hijacking links that steal authentication cookies
Tech support scams that lock your browser and demand payment

10 Ways to Check if a Link Is Safe Before Clicking

1. Hover Over the Link to Preview the URL

On a desktop, hover your mouse over any hyperlink without clicking. The real destination URL appears in the bottom-left corner of your browser or in a tooltip. If the visible text says "paypal.com" but the hover preview shows "paypa1-secure-login.ru," that is a clear red flag.

On mobile, press and hold the link (without releasing) to see the full URL in a preview menu.

2. Inspect the Domain Carefully

Scammers rely on lookalike domains. Always read the domain from right to left, starting at the top-level domain (.com, .net, .org) and working back to find the real root domain.

For example, in https://account.google.com.verify-login.xyz, the actual domain is verify-login.xyz, not google.com. Everything to the left of the last dot before the TLD is a subdomain that anyone can create.

Watch for common tricks:

Character swaps: rn instead of m, 0 instead of o, l instead of i
Extra words: amazon-security.com, apple-id-support.net
Unusual TLDs: .zip, .top, .click, .xyz (not always bad, but worth extra scrutiny)
Punycode attacks using non-Latin characters that look like English letters

3. Use a Free URL Scanner

Several reputable services let you paste any link and get an instant safety report. They check the URL against databases of known phishing sites, malware hosts, and scam networks.

Scanner	What It Checks	Cost
VirusTotal	70+ antivirus engines and URL blocklists	Free
Google Safe Browsing	Google's phishing and malware database	Free
URLVoid	30+ reputation and blocklist services	Free
urlscan.io	Live sandbox scan, screenshots, DOM analysis	Free
PhishTank	Community-verified phishing database	Free

For maximum confidence, run the same URL through two or three of these tools. If any of them flag it, do not click.

4. Expand Shortened Links Before Clicking

Short links (bit.ly, t.co, tinyurl, and so on) hide the real destination. That is useful for clean marketing, but it also gives attackers cover. Before clicking any short link from an unknown source, expand it first.

Free expander tools include:

CheckShortURL.com — paste the short link and see the destination, page title, and screenshot
Unshorten.it — expands the URL and runs a basic safety check
ExpandURL.net — fast, no ads, shows redirect chain

Legitimate URL shorteners such as Lunyb focus on privacy, click analytics, and brand trust rather than cloaking destinations, but you should still verify any short link received from a sender you do not recognize. For an independent look at how a privacy-first shortener operates, see this honest review of Lunyb.

5. Check for HTTPS, But Do Not Trust It Alone

HTTPS (the padlock icon) means the connection between your browser and the site is encrypted. It does not mean the site itself is trustworthy. Over 80% of phishing sites now use HTTPS because free certificates are easy to obtain.

Use HTTPS as a baseline requirement, not a seal of approval. A site without HTTPS asking for login credentials should be avoided entirely. A site with HTTPS still needs the other checks on this list.

6. Look at the Link's Context

Where did the link come from? Context often reveals more than the URL itself.

An unexpected email claiming your account is suspended
A text message from a shipping company you did not order from
A DM from a friend saying "is this you in the video?"
A pop-up telling you that your device is infected
An invoice or receipt for something you never bought

These are classic social engineering hooks. If the message creates urgency, fear, or curiosity and pushes you to click immediately, slow down and verify through a separate channel.

7. Verify the Sender Through a Separate Channel

If your bank, employer, or a friend seems to be sending you a suspicious link, do not reply to that message to confirm. Open a new browser tab and type the official website address manually, or call the sender using a number you already know. Attackers often spoof email addresses and phone numbers, so confirmation in the same thread proves nothing.

8. Use Browser Built-In Protections

Modern browsers include real-time warning systems:

Google Chrome / Edge / Brave — Google Safe Browsing shows a full-page red warning for known malicious URLs
Firefox — uses the same Safe Browsing API plus its own phishing protection
Safari — Apple's Fraudulent Website Warning blocks known scam sites

Make sure these features are turned on in your browser's privacy settings. They are not perfect (new phishing sites can go undetected for hours), but they catch a huge percentage of known threats automatically.

9. Use Encrypted DNS and Network-Level Filtering

Setting your device or router to use a security-focused DNS resolver blocks malicious domains before your browser even loads them. Free options include:

Cloudflare 1.1.1.1 for Families (1.1.1.2) — blocks malware domains
Quad9 (9.9.9.9) — blocks phishing and malware using threat intelligence feeds
NextDNS — customizable blocklists with detailed logs

These resolvers also support DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT), which encrypts your lookups so your internet provider or local network cannot see or tamper with them.

10. Open Suspicious Links in a Sandbox

If you absolutely need to see what is behind a questionable link without risking your main device, open it in an isolated environment:

urlscan.io — loads the page in a remote sandbox and returns a screenshot, so you see the content without visiting it yourself
Browserling or Browser Sandbox — runs a disposable browser in the cloud
A separate virtual machine (VirtualBox, UTM) with no personal accounts logged in

This is how security researchers inspect suspicious URLs. For the average user, urlscan.io is usually enough.

Red Flags That Should Stop You Immediately

If a link shows any of the following signs, treat it as hostile until proven otherwise:

Misspellings in the domain or brand name
Random strings of letters and numbers before the TLD
IP addresses instead of domain names (e.g., http://192.168.44.22/login)
Excessive subdomains designed to confuse (secure.login.update.account.bank-name.ru)
Non-matching display text and actual URL
Requests for credentials, payment, or 2FA codes on a page you did not navigate to directly
Unusual file downloads (.exe, .scr, .zip, .iso, .hta) triggered by a link

What to Do if You Already Clicked a Suspicious Link

Disconnect from the internet if a download started, to stop it from completing or communicating
Do not enter any information on the page that opened
Close the tab and clear your browser cache and cookies
Run a full antivirus scan using Windows Defender, Malwarebytes, or your preferred tool
Change passwords for any account you may have exposed, starting with email and banking
Enable two-factor authentication on every important account if you have not already
Monitor your bank and card statements for the next 30 to 60 days
Report the link to Google Safe Browsing, PhishTank, or the brand being impersonated

How Businesses and Creators Can Build Link Trust

If you share links professionally, the burden is on you to look trustworthy. Readers have been trained to fear unfamiliar URLs, so transparent links convert better and build long-term credibility.

Use a branded domain or custom short domain instead of generic shorteners
Keep URLs readable — brand.link/spring-sale performs better than brand.link/x7f2qp
Avoid chaining multiple redirects, which scanners and spam filters penalize
Publish a privacy policy explaining what you collect from clicks
Pick a shortener that supports HTTPS by default, offers click analytics, and does not inject ads or interstitials

Privacy-respecting options such as Lunyb keep tracking minimal while still providing custom slugs, QR codes, and analytics. If you are weighing alternatives, this comparison of Rebrandly and Lunyb breaks down pricing and features side by side.

Frequently Asked Questions

Can I get hacked just by clicking a link?

In most cases, simply clicking a link only opens a webpage, and the real risk comes from what you do next (entering credentials, downloading a file, granting permissions). However, certain targeted zero-day exploits can compromise unpatched browsers on click alone. Keeping your browser and operating system updated eliminates the vast majority of this risk.

Is a link safe if it starts with HTTPS?

Not necessarily. HTTPS only means the connection is encrypted. More than 80% of phishing sites now use free HTTPS certificates. Treat the padlock as a minimum requirement, not proof of legitimacy.

Are all shortened links dangerous?

No. Shortened links are a normal part of marketing, social media, and SMS communication. The danger is that they hide the destination, so they are only as trustworthy as the sender. Expanding unknown short links with a free tool like CheckShortURL takes two seconds and removes the guesswork.

What is the best free tool to check a link?

For a quick reputation check, VirusTotal is the most comprehensive because it aggregates 70+ security engines. For a deeper look at what a page actually loads, urlscan.io opens the link in a sandbox and returns a screenshot. Using both gives you professional-grade coverage without installing anything.

How do I report a phishing or scam link?

Submit the URL to Google Safe Browsing (safebrowsing.google.com/safebrowsing/report_phish/), PhishTank (phishtank.org), and the Anti-Phishing Working Group (reportphishing@apwg.org). If the link impersonates a specific brand, forward the original message to that brand's official abuse address (for example, phishing@paypal.com or reportphishing@apple.com). Reporting helps protect everyone else who might receive the same message.

Final Thoughts

Checking a link before you click is a 10-second habit that prevents the overwhelming majority of online scams and malware infections. Combine a quick visual inspection with a free scanner, keep your browser protections on, and verify anything that creates urgency through a second channel. Do that consistently and you will stay ahead of nearly every phishing campaign targeting ordinary users in 2026.