How to check if a link is safe
Most scams, account takeovers and malware infections start with a single click on a link. The good news is that you can check almost any link in under a minute, without special tools, once you know where to look.
Written and reviewed by MaaSec volunteers · Last updated 1 November 2026
Is this link safe? Start by reading the address
What matters is the real domain: the part just before the first single slash, read from right to left. Everything before it can be made up by whoever created the link.
Only the first link goes to the (fictional) bank. In the second, "northbank.example" is just a subdomain that anyone who owns account-check.example can create. In the third, the bank's name is only part of the path.
How to check if a link is safe without clicking it
- 1Preview the real address. On a computer, hover the mouse over the link and look at the address shown at the bottom of the browser or email program. On a phone, press and hold the link until a preview appears, without letting it open.
- 2Find the real domain as explained above, and ask: is this the organisation it claims to be?
- 3Look for look-alike letters. Attackers register addresses that look almost right: "rn" instead of "m", the number 0 instead of the letter o, an extra letter, a hyphen, or a different ending such as .co instead of .com. Some use letters from other alphabets that look identical.
- 4Be careful with shortened links. Services that shorten links hide the real destination. If you don't trust the sender, don't open a shortened link; ask for the full address or go to the website yourself.
- 5When in doubt, don't click. Type the organisation's address yourself or use their app. A real bank, delivery company or tax office will show the same message when you log in normally.
Check if a link is safe with free URL checkers
Free tools can tell you whether a link is already known to be dangerous:
- Google Safe Browsing site status shows whether Google currently flags a site as unsafe.
- VirusTotal checks a URL against dozens of security vendors at once.
These tools only know about threats that have already been reported. A brand-new scam page can come back clean. Also, don't paste private links (password resets, invoices, shared documents) into public checkers: VirusTotal shares submitted URLs with security researchers.
Is this URL safe? Red flags around the link
Often the message around a link gives the game away before the link itself does:
- You weren't expecting it, or it comes from someone you don't usually hear from.
- It pushes you to act fast: "your account will be closed today", "final reminder".
- It asks you to log in, pay, confirm card details or download something.
- The link text says one thing but the preview shows a different address.
- Spelling, logo or tone feel slightly off for the organisation it claims to be.
Our guide on how to spot a phishing email covers these warning signs in more detail.
Links in text messages, chats and QR codes
Scam links don't only arrive by email. Text messages about parcels, tolls or bank alerts, messages in chat apps, and QR codes on posters or parking meters are all used the same way.
- On a phone, press and hold a link to see its address before opening it, and check the domain the same way as on a computer.
- Most phone cameras show the address inside a QR code before opening it. Read it before you tap.
- Be wary of QR codes stuck on top of another sign, or QR codes in emails asking you to log in or pay.
- Messages from an unknown number that claim to be a family member with a new phone are a common scam. Call the number you already have for them.
How to check if a site is secure (and what the padlock means)
The padlock and "https" in your browser only mean that the connection between you and the site is encrypted, so others on the network can't read it. They say nothing about who runs the site. Scam sites get padlocks for free too.
To judge whether a site is genuine, check the domain carefully, be wary of sites you reached from an unexpected message, and look for a real address and contact details. For shops, search for independent reviews of the site, not just the product.
What to do if you already clicked a suspicious link
- 1Don't enter anything. If you only opened the page and didn't type a password or download anything, the risk is usually low. Close the page.
- 2If you entered a password, change it right away on the real site, and anywhere else you use the same one. Turn on two-factor authentication.
- 3If you entered card or bank details, call your bank on the number on your card or their website, not one from the message.
- 4If you downloaded or opened a file, disconnect the device from the internet and run a full scan with your security software. At work, tell whoever handles your IT straight away.
- 5Report it, so others are protected too. See the reporting section in our phishing guide.