How to Check if a Link Is Safe Before Clicking: 7 Easy Checks.

A text pops up on your phone: "Your package couldn't be delivered. Click here to reschedule."

Or an email lands in your inbox: "Your account has been locked. Verify your information now."

The link is right there, and clicking it feels like the fastest way to fix the problem. But before you tap, ask one question: where does this link actually take me?

A link can look perfectly normal and lead somewhere you never expected. You don't need to be a cybersecurity expert to deal with that. A few simple checks can help you decide whether a link deserves your trust.

Quick Answer: How Do You Check if a Link Is Safe Before Clicking?

Look at where the link really goes, read the domain carefully, watch for lookalike addresses, be careful with shortened links, and remember that HTTPS doesn't prove a link is safe. If you're still unsure, a reputable link-checking tool can add more information. Then ask why the link was sent to you in the first place.

The main idea is this: don't judge a link by how it looks. Check where it leads and why you received it.

Step 1: Preview the Real Destination

Links often hide their destination behind friendly words. Take this one:

Click here to verify your account

Those words tell you nothing about where the link goes. The visible text and the actual address can be completely different.

You can usually look at the real destination without opening it:

On a computer, hover your mouse over the link. The address often appears in a corner of the browser window or in a small pop-up.

On many phones, pressing and holding a link brings up a preview or menu that shows the address. How this works depends on your device, app and software version.

Some email apps and browsers have their own link-preview features.

If you can inspect a link safely first, don't click just to find out where it goes. Seeing the destination gives you one more piece of information before you decide.

Step 2: Read the Domain Carefully.

The domain is the key part of a web address, and it's the part scammers hope you'll skim past.

Compare these two fictional examples:

support.example.com

example-security-check.com

In the first example, example.com is the website's domain and support is a subdomain. In the second, example-security-check.com is a completely different domain, even though it contains the word "example." In the second, the main domain is example-security-check.com, which is a completely separate website that happens to include the word "example." A simple way to start is to look at the domain name between the https:// and the first /. Then identify the actual website domain, rather than focusing on words that appear earlier in the address.

Things that deserve a second look:

unexpected extra words

odd characters or spellings

unusual domain endings

very long or confusing addresses

a domain that doesn't match the organization named in the message

None of these automatically means a link is a scam. Some legitimate businesses use uncommon domains. But a domain that doesn't make sense in context deserves more investigation.

Step 3: Look for Lookalike Domains

Some fake addresses are built to fool a quick glance. People who send phishing messages may try things like:

misspelled words

an added or missing letter

hyphens

extra words such as "verify," "secure," "support" or "login"

a different ending, like swapping .com for something else

Here's a made-up pair:

ExampleBank.com

Example-Bank-Security.com

The second one contains the familiar name, which is exactly why it can work. The part that looks familiar isn't necessarily the real domain.

So slow down. Don't just recognize the brand name. Read the whole address, one piece at a time. If you're expecting a message from your bank, go to the bank's website or app yourself instead of using the link.

Step 4: Be Careful With Shortened Links

Shortened links are compact web addresses, like short.example/abc123 (a fictional one). They're handy when space is limited, such as in text messages or social posts, and plenty of legitimate businesses and services use them.

The catch is that a shortened link hides the final destination. You can't tell where it leads just by looking.

A shortened link isn't automatically malicious. But if it shows up unexpectedly, especially from someone you don't know or in a message that's rushing you, extra caution makes sense. A reputable link-expansion or URL-checking service may help you see where a shortened link leads without opening the destination yourself. But choose the service carefully, and never paste a link containing sensitive or private information into a service you don't trust. Just be careful about which service you use, and avoid pasting in anything that contains personal information.

Step 5: Don't Treat HTTPS as Proof That a Link Is Safe

You may have heard to look for the padlock. It's useful, but it's often misunderstood.

HTTPS means the connection between your browser and a website is encrypted. It doesn't mean the sender is legitimate, that the site belongs to the company it claims to represent, or that the offer is real. A phishing website can use HTTPS too.

The padlock tells you about the connection, not about the intentions of whoever runs the site. For a fuller explanation, see [can a scam website have HTTPS?](

Step 6: Use Reputable Link-Checking Tools

When you're unsure, a reputable link-checking service can add another layer of information. Examples include services that check URLs against known phishing, malware, and security databases. Google Safe Browsing and VirusTotal are two examples you may come across.These tools may help flag:

known malicious addresses

phishing websites

destinations linked to malware

reputation information from security databases

But keep their limits in mind. A clean result doesn't guarantee a link is safe. New scam pages may not be known to any security service yet, so a tool can miss something that was created an hour ago.

Think of these tools the way a detective thinks of a lab report. They're useful evidence, but they don't replace your judgment. Use them to investigate, not to make the decision for you.

Step 7: Ask Why You Received the Link

This is one of the most useful checks, and it doesn't require any special tools.

Ask yourself:

Was I expecting this message?

Do I know the sender?

Does the message make sense?

Is it creating urgency?

Is it asking me to log in, pay, verify information or download something?

Think about common situations: an unexpected delivery notice, an account suspension warning, a password reset you didn't request, a prize announcement, a refund message, a bank security alert, a job offer, or a "you've won" note. None of these is automatically fake. But when a message pushes you toward a link you weren't expecting, that's your cue to be careful.

Context cuts both ways. A link from someone you know isn't automatically safe, because accounts can be compromised. And a message that claims to be from a real company may still not be. When in doubt, skip the link and go to the official website or app directly. For a closer look at suspicious messages, read [how to tell if a text message is a scam].

What to Do If You Already Clicked

First, take a breath. Clicking a link doesn't automatically mean your device or accounts have been compromised. What you do next depends on what happened after the click.

If you clicked but didn't enter anything:

Close the page.

Don't download anything or interact with it further.

If something odd happened, such as unexpected pop-ups or a download starting on its own, run a security scan with software you trust.

If you entered a password:

Change it right away, going to the real website or app yourself instead of using the link.

Change it anywhere else you've used the same password.

Turn on multi-factor authentication where it's available.

If you entered financial information:

Contact your bank, card issuer or payment provider promptly.

Watch the account for activity you don't recognize.

Ask what fraud or dispute procedures apply to you, since these vary by country and provider.

If you downloaded something:

Don't open it.

Run security software you trust.

If you think your device may be compromised, consider getting help from a qualified professional.

If the message was clearly phishing:

Keep the message or link in case you need it to report the problem.

Report it through the platform it came from or the appropriate organization in your country. 

In the United States, for example, the FTC takes scam reports at ReportFraud.ftc.gov.

If the message was clearly phishing:

Keep the message or link in case you need it to report the problem. Report it through the platform it came from or the appropriate organization in your country. In the United States, for example, the FTC accepts scam reports at ReportFraud.ftc.gov. For suspicious text messages, the FTC also recommends forwarding unwanted texts to 7726 (SPAM)