How to Check if a Link Is Safe Before You Click It

Read the real address, not the words on the link, then paste it into a link checker so it opens on someone else’s browser and not yours. If the message rushes you or asks for a password, a payment or a code, skip the link whatever the checker says. It takes about a minute.

Step 1: Read the address, not the words

The words on a link and the place it goes are two different things. A text can say “Track your parcel” while the address behind it belongs to someone else.

On a computer, move the pointer over the link and read the address that appears at the bottom of the window. On a phone, press and hold the link. Most phones show the full address in a menu before anything opens. If the address is hidden or shows only a short code, go to step 3.

Step 2: Find the part of the address that decides who owns it

Only one part of a web address tells you who controls the page: the name just before the ending (.com, .co.uk, .in) and just before the first single slash. Everything to the left of it can be set by whoever owns that name.

• In www.amazon.com/orders, the owner is amazon.com.
• In amazon.com.refund-help[.]net/orders, the owner is refund-help.net. Amazon’s name is only a decoration at the front.
• In paypa1-support[.]com, the owner is a different name that looks like PayPal. The “l” is a number 1.

If the owner name is not the company you expect, stop. A real company sends you to its own name, not to a copy.

Step 3: Expand short links before you open them

Short links hide the destination by design. Copy the link without opening it and paste it into a checker. It follows the redirects on its own browser and shows you where the link really ends up. Our guide to seeing where a short link goes covers the options one by one.

Step 4: Paste the link into a link checker

Open the ScamX link checker and paste the whole address. We open it in a real browser on our side, follow every redirect, and compare what we find with lists of known scam and phishing sites and with the signals that give new scam sites away, such as a domain registered days ago or a bank’s name on someone else’s domain.

Read what the result lists, not only the colour. Say a link claims to be your bank. The result shows the domain was registered four days ago, the page has a card form, and the bank’s logo sits on a name that is not the bank’s. That is a verdict you can act on. The word “suspicious” on its own is not.

Step 5: Look at the message around the link

The link is rarely the whole scam. The message gives it away more often. Ask these four questions, in this order.

1. Did I expect this message?
2. Does it hurry me with a deadline, a fine or a prize?
3. Does it ask for a password, a one-time code, a card number or a payment?
4. Could I reach the same page by typing the company’s address or opening its app myself?

If the answer to the first is no and to the second or third is yes, do not use the link. Open the company’s app or type its address yourself. Nothing beats this, because you never touch the link.

What a clean result does not prove

A checker can only report what it can see. A scam page that went live an hour ago may be on no list yet. In a 2025 peer-reviewed study of 286,237 phishing URLs from the APWG feed, Google’s Safe Browsing update lists flagged 18.4% of the sites, after 4.5 days on average. That test covered one blocklist and not Chrome’s live checks, but it shows why a list alone is not enough. The same study found a median phishing site lived 5.46 hours. Some scam sites show a harmless page to scanners and the real scam only to people on a phone. A link to a private document, such as a shared file, cannot be opened by a scanner, so it can be judged on its address alone.

If a link fails your own checks in steps 1, 2 and 5, a quiet tool does not rescue it.

If you already clicked

1. Close the page. Do not type anything into it.
2. If you entered a password, change it now, and change it anywhere you reused it. Turn on two-factor sign-in.
3. If you entered card or bank details, call your bank on the number printed on your card and ask them to block the card.
4. If a file downloaded, do not open it. Delete it and run your device’s built-in security scan.
5. Report the link so its host can be asked to take it down.

Frequently asked questions