Every day, millions of people click links in emails, text messages, and social media without knowing where they actually lead. Phishing attacks, malware downloads, and fake login pages are the most common entry points for cybercrime — and they almost always start with a link.
This guide covers seven practical methods to check if a link is safe before you click it, from free automated scanners to manual inspection techniques you can do in seconds.
Why Checking Links Matters
A single malicious link can lead to stolen passwords, ransomware infections, or unauthorized access to your bank account. Attackers use several techniques to make links look legitimate:
- URL shorteners that hide the real destination (bit.ly, tinyurl, etc.)
- Lookalike domains that mimic trusted brands (paypa1.com, g00gle.com)
- Subdomains that put a trusted brand name before a malicious domain (paypal.evil.com)
- HTTPS deception — a padlock icon does not mean a site is safe, only that it's encrypted
- Redirect chains that pass through several sites before reaching the malicious destination
7 Ways to Check If a Link is Safe
Use a free URL scanner
The fastest and most reliable method. Paste the link into ShieldScan and it checks it against 95+ antivirus engines, Google Safe Browsing, and phishing databases — without your browser ever visiting the page. You get a 0–100 risk score and a full breakdown in under 10 seconds.
Hover over the link before clicking
On desktop, hover your mouse over any link without clicking. The actual URL appears in the bottom-left corner of your browser. Check that the domain matches what you'd expect — for a PayPal email, the link should go to paypal.com, not paypal.secure-login.net or anything else.
Inspect the domain name carefully
Look at the domain itself — the part between https:// and the first /. Red flags include: numbers replacing letters (paypa1.com), extra words added (paypal-secure.com), or the brand name appearing as a subdomain (paypal.scammer.com). The real domain is always the part just before the TLD (.com, .net, etc.).
Expand shortened URLs first
Never click a shortened link without knowing where it goes. Paste shortened URLs into ShieldScan — it follows all redirects and checks the final destination. Alternatively, add a + to the end of a bit.ly link (bit.ly/xyz+) to see the preview page.
Check Google Safe Browsing
Google maintains a constantly-updated database of phishing and malware sites. You can check any URL at safebrowsing.google.com/safebrowsing/report_phish. ShieldScan does this automatically as part of every scan.
Look up the domain age
Phishing sites are almost always newly registered domains — often less than 30 days old. A brand new domain pretending to be your bank is a major red flag. ShieldScan shows domain age in every URL scan result. You can also check manually at who.is.
Use a browser extension
The ShieldScan browser extension adds a right-click "Scan with ShieldScan" option to every link. Right-click any suspicious link without clicking it to scan it instantly — without leaving the page you're on.
Check Any Link in 10 Seconds
Free. No signup. 95+ antivirus engines. Paste a link and get an instant verdict.
Scan a URL Now →Red Flags That Signal a Dangerous Link
Even before you scan a link, certain patterns are strong indicators of malicious intent:
- Urgency language — "Your account will be suspended," "Act now," "Verify immediately"
- Unexpected messages — A package delivery notification when you haven't ordered anything
- Mismatched sender — Email claims to be from PayPal but comes from a Gmail address
- No context — A link sent by a contact with no explanation ("Check this out!")
- HTTP instead of HTTPS — Legitimate sites almost always use HTTPS in 2026
- IP address instead of domain — A link like http://192.168.1.1/login is almost always malicious
How to Check a Link on Mobile
On a smartphone, hovering isn't an option. Here's how to inspect a link on mobile:
- Long-press the link — on both iOS and Android, holding a link shows a preview of the URL and a menu with options
- Copy the link — choose "Copy link address" from the long-press menu, then paste it into ShieldScan's mobile-friendly scanner
- Use ShieldScan directly — shieldscann.io is fully responsive and works on any phone browser
What Happens If You Click a Bad Link?
If you've already clicked a suspicious link, act quickly:
- Don't enter any information on the page — close it immediately
- Change your passwords for any accounts associated with the site that was impersonated
- Run an antivirus scan on your device to check for malware that may have been downloaded
- Enable two-factor authentication on critical accounts (bank, email, social media)
- Check your accounts for unauthorized activity over the next few days