How to Check If a Link Is Safe
You cannot prove that a website is safe by looking at its URL alone, but you can catch many common warning signs before you click.
Find the actual hostname
In a URL, the hostname comes after https:// and before the next slash. Read it carefully. In paypal.com.security-check.example, the destination is not paypal.com; the actual hostname ends in security-check.example.
Text before an @ symbol is user information, not the destination. In trusted.example@actual.example, the actual hostname is actual.example.
Look for imitation and obfuscation
Watch for character swaps such as 0 for o, 1 for l, or rn for m. Punycode domains beginning with xn-- can be legitimate internationalized domains, but they deserve extra attention because Unicode characters may resemble familiar letters.
Long subdomain chains, raw IP addresses, unusual ports, heavy encoding, and nested redirect URLs can make a destination harder to understand.
Treat HTTPS correctly
HTTPS encrypts the connection between your browser and the website. That is useful, but scammers can obtain HTTPS certificates too. A padlock does not verify the site's identity, claims, or intentions.
Use an independent route
If a link claims to be from your bank, employer, delivery service, or another account provider, open the known app or type the official address yourself. Do not use the suspicious message's contact information to verify itself.
Check a suspicious link
Paste the URL into the local Link Checker to inspect its structure without visiting the website.
Check a Link