How to tell if a link is safe

A practical checklist for checking link safety

Before opening a link:

The CISA phishing guidance advises users not to click suspicious links and to verify requests through known contact information.

Which part of a URL should you inspect?

Read the address from the beginning through the first slash after the domain. A trusted brand name placed before the real domain can be deceptive. For example, bank.login-security.example is controlled by the owner of login-security.example, not by the bank named earlier.

Attackers may use look-alike letters, punycode, subdomains, and URL parameters. Use the process in how to identify a fake URL when the address is difficult to interpret.

Do HTTPS and the padlock mean a link is safe?

HTTPS means the connection to the site is encrypted. It does not confirm who operates the site or whether its claims are honest. A phishing site can obtain a valid certificate and display a padlock.

Encryption protects information on the way to the destination. It cannot protect information voluntarily submitted to a criminal operating that destination.

How to check a link without clicking

Copy the address without opening it and review it as plain text. Search for the official organization independently, compare domains, and check whether the same alert appears inside the official account. A security service may identify known phishing or malware, but a clean result does not guarantee legitimacy.

For shortened links, reveal the destination before opening when possible. Read are shortened links safe? for the limits of URL expansion and analysis.

QR codes should be treated as links. Inspect the destination after scanning and before continuing. Be cautious when a code is printed on a removable sticker or asks the phone to install an app, certificate, or profile.

Common tricks used in malicious links

Look-alike domains replace or add a character, such as using a zero where the original name contains the letter “o.” Other addresses place the brand inside a subdomain, path, or parameter even though an unrelated domain controls the page. On a small screen, a long address may hide the important portion beyond the visible area.

Some links redirect through several services before reaching the final page. Redirects are common in legitimate marketing and authentication, so their presence is not proof of abuse. They do make the destination harder to evaluate, especially when combined with a shortened URL or QR code. If the message concerns an account, skip the redirect chain and open the account independently.

Encoded characters and internationalized domain names can also resemble familiar text. Modern browsers help display these addresses safely, but visual similarity should never replace checking the registered domain and the purpose of the request.

Evaluate what happens after the click

The destination’s behavior matters as much as its address. Stop if the page immediately asks for a password, payment, one-time code, identity document, browser notification permission, remote access, or a file that the original task did not require. A page that claims the session expired and asks the user to sign in again should be verified through the official service.

Browser security warnings should not be bypassed merely because the message appears urgent. Likewise, a page opening normally does not prove safety: newly created phishing sites may not yet be known to reputation systems.

Links received at work

For a work account, use the organization’s reporting button or security channel instead of testing the link personally. An unexpected shared document, invoice, voicemail, or benefits update may target company credentials. Confirm unusual requests with the sender through an established channel, especially if the message changes bank details or asks someone to ignore a normal approval process.

Can a link from a known person or company be unsafe?

Yes. A real account can be compromised, an employee can make a mistake, or an attacker can spoof sender information. Confirm unusual requests separately, especially when they involve credentials, money, remote access, or software installation.

Personal details in the message do not establish legitimacy. Information from public sources or prior breaches can be used to personalize phishing.

Official websites can also be impersonated

The FBI warned in 2025 that criminals were spoofing the official IC3 website. The agency recommends typing www.ic3.gov directly and avoiding sponsored results that imitate the complaint service.

A real .gov domain is restricted to U.S. government organizations, but text can be made to resemble .gov, and a link label can hide a different destination. Read the complete address.

What to do when a link remains uncertain

Do not open it. Contact the sender through a known channel, use the organization’s official app, or navigate from a trusted bookmark. Report the message to the platform and the organization being impersonated.

If you already opened it, follow what to do after clicking a fake link. The response depends on whether you entered credentials, downloaded a file, granted permission, or sent money.

Frequently asked questions about safe links