How to Check if a Link Is Safe Before Clicking (2026 Guide)

Every day, billions of links are shared across email, social media, and messaging apps — and a surprising number of them lead to phishing pages, malware downloads, or scam sites. Knowing how to check if a link is safe before you click is one of the most valuable digital self-defense skills you can learn in 2026.

This guide walks you through the exact methods security professionals use to verify suspicious URLs — including free online scanners, manual red-flag checks, and the smart habits that keep your devices and accounts protected.

Why Checking Links Before Clicking Matters

A single click on a malicious URL can trigger a drive-by malware download, redirect you to a fake login page that steals your credentials, or deliver ransomware to your device. According to recent industry reports, phishing links are responsible for over 36% of all data breaches globally.

The problem is that modern phishing links look increasingly legitimate. Attackers use lookalike domains, URL shorteners, Unicode characters, and even valid HTTPS certificates to trick users. That's why verifying a link should become as automatic as checking both ways before crossing the street.

Common Threats Hidden Behind Unsafe Links

• Phishing pages — fake login forms mimicking banks, Microsoft 365, or social platforms.
• Malware droppers — pages that silently install trojans or keyloggers.
• Ransomware infections — files disguised as invoices or shipping notices.
• Scam redirects — fake giveaways, crypto scams, or tech-support fraud.
• Session hijacking — links that steal authentication cookies.

How to Check if a Link Is Safe: 10 Proven Methods

Verifying a URL doesn't require advanced technical skills. Here are ten reliable techniques you can use in under a minute — from hovering previews to professional-grade scanners.

1. Hover Over the Link to Preview the Real URL

On desktop, hover your cursor over any hyperlink without clicking. The actual destination URL will appear in the bottom-left corner of your browser. If the visible anchor text says "paypal.com" but the preview shows "paypa1-secure.xyz", you've just caught a phishing attempt.

On mobile, press and hold the link until a preview menu appears with the full URL.

2. Use a Free Link Scanner

Paste the suspicious URL into a trusted online scanner. These tools check the link against dozens of threat databases and sandbox the page to detect malware. Top options include:

• VirusTotal (virustotal.com) — scans URLs against 70+ antivirus engines.
• Google Safe Browsing Transparency Report — Google's own blacklist check.
• URLVoid — reputation check from 30+ blocklists.
• PhishTank — community-reported phishing database.
• Sucuri SiteCheck — malware and blacklist scanner.

3. Expand Shortened URLs Before Clicking

Shortened links from bit.ly, t.co, tinyurl, or similar services hide the final destination. Before clicking, expand them using tools like CheckShortURL.com, Unshorten.it, or ExpandURL.net. These services reveal the full destination without exposing you to the page itself.

Reputable shortening platforms such as Lunyb also provide built-in link previews and malware scanning on the destination before redirecting users — a feature we discuss in our honest Lunyb review.

4. Inspect the Domain Carefully

Attackers rely on visual tricks. Look for:

• Misspellings: "arnazon.com" instead of "amazon.com".
• Extra words: "login-microsoft-support.com".
• Odd TLDs: ".zip", ".top", ".xyz", or ".click" used to mimic big brands.
• Subdomain tricks: "paypal.com.verify-login.ru" — the real domain here is "verify-login.ru".
• Unicode lookalikes: Cyrillic "а" replacing Latin "a".

5. Check for HTTPS — But Don't Trust It Blindly

HTTPS (the padlock icon) only means the connection is encrypted — not that the site is safe. Over 80% of phishing sites now use valid SSL certificates. HTTPS is necessary but not sufficient. Always combine it with the other checks in this list.

6. Look Up the Domain's Age with WHOIS

Phishing domains are usually brand new. Use who.is or whois.domaintools.com to check when a domain was registered. If a site claiming to be "Chase Bank Support" was registered three days ago, it's almost certainly a scam.

7. Search for Reviews and Mentions

Copy the domain into Google with quotes, e.g., "suspicious-site.com" scam. Legitimate businesses have reviews, press mentions, and Trustpilot profiles. Brand-new or scam domains typically return no results — or warnings from other users.

8. Use Browser Built-In Protection

Modern browsers block known malicious links automatically. Make sure the following features are enabled:

• Chrome: Enhanced Safe Browsing (Settings → Privacy and Security).
• Edge: SmartScreen Filter.
• Firefox: Phishing and Malware Protection.
• Safari: Fraudulent Website Warning.

9. Open Suspicious Links in a Sandbox

For high-risk links (e.g., unexpected invoices), open them in an isolated environment. Tools like urlscan.io and Browserling let you view the page remotely without touching your device. Security teams also use disposable virtual machines for this purpose.

10. Verify the Source Through a Second Channel

If a link arrived via email or DM claiming to be from your bank, boss, or a vendor — don't click. Instead, contact the sender through a known phone number or official app. This single habit stops the majority of business email compromise (BEC) attacks.

Comparison: Top Free URL Safety Checkers (2026)

Tool	What It Checks	Best For	Price
VirusTotal	70+ antivirus engines, reputation data	Comprehensive malware scanning	Free
Google Safe Browsing	Google's phishing/malware blacklist	Quick credibility check	Free
URLVoid	30+ reputation and blocklist sources	Domain reputation history	Free
urlscan.io	Live sandbox rendering, network requests	Technical analysis of suspicious pages	Free / Paid tiers
PhishTank	Community-reported phishing URLs	Reported scam verification	Free
Sucuri SiteCheck	Malware, defacement, blacklists	Checking compromised websites	Free

Red Flags: Signs a Link Is Probably Unsafe

Even without running a scan, these warning signs should make you pause before clicking.

In the URL Itself

1. IP addresses used instead of domain names (e.g., http://192.168.44.12/login).
2. Excessive hyphens, numbers, or random strings.
3. Mismatched brand names and domains.
4. Unusual country-code TLDs for a supposedly local business.
5. "@" symbols inside the URL (used to obscure the real host).

In the Context Around the Link

1. Urgency: "Your account will be closed in 24 hours!"
2. Unexpected attachments or shipping notifications.
3. Generic greetings like "Dear Customer".
4. Poor grammar or awkward phrasing.
5. Requests for passwords, OTP codes, or payment information.
6. Prizes, refunds, or inheritance promises.

How to Check Links on Mobile Devices

Mobile phishing ("smishing") is rising rapidly because small screens hide URL details. Here's how to stay safe on phones.

On iPhone

• Long-press any link to see a preview card showing the real URL and page.
• Enable Settings → Safari → Fraudulent Website Warning.
• Use the built-in Messages filtering to block unknown senders.

On Android

• Long-press links in Gmail, Chrome, or WhatsApp to preview.
• Enable Google Play Protect and Chrome's Safe Browsing.
• Consider a reputable mobile security app for real-time link scanning.

Special Case: Checking Links in Email

Email remains the #1 phishing delivery channel. Follow these rules:

1. Check the sender's full email address, not just the display name. "Microsoft Support <support@mlcrosft-help.ru>" is clearly fake.
2. Verify SPF, DKIM, and DMARC alignment — most webmail clients show a warning if these fail.
3. Never log in through an emailed link. Open a new tab and type the official URL manually.
4. Report suspicious emails using your mail provider's "Report phishing" button.

How Safe URL Shorteners Protect Users

Not all shortened links are dangerous. Trusted shortening services add safety layers that benefit both creators and recipients:

• Destination scanning at creation time to block malware domains.
• Link previews so users can see where they're going before clicking.
• Password-protected and expiring links for sensitive sharing.
• Analytics without personal tracking for privacy-conscious users.

Privacy-focused platforms like Lunyb build these protections in by default. If you're comparing shortening tools, our Rebrandly vs Lunyb comparison breaks down how each handles link safety and user tracking.

Building Long-Term Safe-Clicking Habits

Tools help, but habits are what keep you safe over time. Adopt these five practices:

1. Pause before every click from an unknown sender.
2. Use a password manager — it won't autofill on fake lookalike domains, which is a built-in phishing detector.
3. Enable two-factor authentication on every important account so a stolen password isn't enough.
4. Keep your browser and OS updated to patch known exploit paths.
5. Train your family and team — phishing often targets the least-prepared member.

What to Do If You Already Clicked a Suspicious Link

If you clicked something you shouldn't have, don't panic — act quickly.

1. Disconnect from the internet to prevent further data transmission.
2. Run a full antivirus or anti-malware scan.
3. Change passwords for any accounts you may have entered on the fake page — starting with email and banking.
4. Enable 2FA if you haven't already.
5. Monitor your accounts for unauthorized activity for the next 30–90 days.
6. Report the incident to your IT team, bank, or local cybercrime authority.

Frequently Asked Questions

Is it safe to click a link just to see where it goes?

No. Some malicious pages exploit browser vulnerabilities on load, meaning you can be compromised without entering any data. Always preview or scan a link first using tools like VirusTotal or urlscan.io.

Does the padlock icon mean a website is safe?

Not necessarily. The padlock only confirms that the connection is encrypted via HTTPS. Phishing sites routinely obtain free SSL certificates, so you should combine the padlock check with domain inspection and a URL scan.

Are shortened links always dangerous?

No. Shortened links from reputable services (including Lunyb, Bitly, and TinyURL) are widely used for legitimate marketing and sharing. The risk comes from not knowing the destination — which is why expanding or previewing them before clicking is a smart habit.

What's the fastest way to check a link on my phone?

Long-press the link to preview the full URL. If anything looks off, copy the link and paste it into VirusTotal or Google Safe Browsing in your browser rather than opening it directly.

Can antivirus software block all unsafe links?

Modern antivirus and browser Safe Browsing features catch many known threats, but they can't block every zero-day phishing page. Human judgment — hovering, inspecting domains, and verifying senders — remains your strongest layer of defense.

Final Thoughts

Learning how to check if a link is safe is one of the highest-return security skills you can develop. With a 30-second habit of hovering, inspecting the domain, and scanning anything suspicious, you'll block the vast majority of phishing, malware, and scam attempts before they ever reach your device.

Combine smart habits with trustworthy tools — browser Safe Browsing, VirusTotal, urlscan.io, and privacy-respecting link platforms — and you'll click with confidence instead of crossed fingers.