How can I check if a link is safe before clicking it?
Check if a link is safe by pasting it into a URL scanner like urlscan.io or VirusTotal before clicking. These free tools inspect the site in an isolated browser and flag phishing, malware, and malicious redirects. Always expand shortened links first, read the real domain carefully, and never trust a padlock alone.
- Copy the suspicious link without clicking it, then paste it into urlscan.io and run a free scan.
- Review the screenshot, redirect chain, and contacted domains in the report for anything you do not recognize.
- Run the same link through VirusTotal to see how many of 70+ antivirus engines flag it.
- Expand shortened links with CheckShortURL.com or Unshorten.it, then scan the revealed destination URL before clicking.
- Read the registered domain carefully: the owner is the part just before .com, .net, or .org.
- Check Google Safe Browsing’s transparency report to see Google’s own verdict on the site’s safety.
What urlscan.io shows you
urlscan.io loads the URL in a sandboxed browser, so your device never touches the site. The report includes a screenshot of the page, the full redirect chain, every domain the page contacted, the network requests it made, and the page structure. If a link that claims to be your bank quietly loads scripts from three unrelated domains and redirects through a URL shortener, you will see it in seconds.
The service offers visibility levels for your scans: public, unlisted, and private. Use unlisted or private whenever the link could be sensitive. Public scanners can make submitted links visible to others, so never paste links containing private information, login tokens, or internal work URLs.
Other free tools worth knowing
VirusTotal is the quickest second opinion. Paste a link and it checks the URL against more than 70 antivirus engines and blocklist services, showing how many flagged it as malicious. A clean result from dozens of engines is reassuring, though brand-new phishing pages can slip through before anyone flags them. One caution: some phishing pages detect scanners and show them harmless content while showing real visitors the malicious page, a trick called cloaking. A clean scan result means no one has flagged it yet, not that it is definitely safe.
Privacy matters here too. Just like urlscan.io, VirusTotal shares submitted URLs with the security community, so never paste links containing private information, login tokens, or internal work URLs into either tool.
URLVoid aggregates reputation data from more than 30 blocklist services in one place. PhishTank takes a different approach: it is a community-driven database of known phishing URLs, which makes it useful for spotting reported fakes. Google Safe Browsing’s transparency report shows Google’s verdict on whether a site contains unsafe content such as phishing, malware, or unwanted software, though it only covers sites Google has already evaluated.
For shortened links, expand them before scanning. CheckShortURL.com, Unshorten.it, and ExpandURL.net all reveal the final destination of bit.ly, t.co, and tinyurl links without you ever clicking through.
How to read a suspicious URL
Scanners help, but your own eyes are the fastest filter. The real owner is the registered domain, the part just before the public suffix. For most .com addresses that means the chunk before .com: login.microsoft.com belongs to microsoft.com, which is fine, while microsoft.login-verify.com belongs to login-verify.com, which is dangerous. Watch out for multi-part endings like .co.uk, where the registered domain is example.co.uk, not just co.uk. And be extra careful on free hosting platforms like github.io or blogspot.com, where anyone can create a subdomain, so the brand name in the subdomain means nothing.
The same goes for the padlock. HTTPS only means your traffic to the site is encrypted, not that the site is trustworthy. Attackers get free certificates too, so a padlock tells you nothing about who runs the site. Judge the domain, never the padlock.
Watch out for QR code scams
Scammers know you cannot read a QR code with your eyes, which is why QR scams, sometimes called quishing, rose roughly fivefold in 2025. A sticker placed over a restaurant’s real QR code or a fake parking payment code can send you to a phishing page with zero warning signs. Treat every QR code like a link you cannot read: preview the destination your phone shows before opening it, and scan it with a URL checker if anything looks off.
If you already clicked
Do not panic. If you entered a password, change it immediately on the real site, and change it anywhere else you reused it. Turn on multi-factor authentication on the affected account. If you entered payment details, call your bank. If anything downloaded, do not open the file. Run a full antivirus scan on your device first. Run the link through urlscan.io afterward anyway, so you know exactly what the page was doing.
Thirty seconds of scanning beats weeks of cleanup. Most people skip this because it feels like overkill for one link, but the math is not close.
