How to Check If a Link Is Safe Before You Click It, in 30 Seconds

Check If a Link Is Safe Before You Click It

Most online scams start with a link. Not a virus, not a hacker breaking into your computer, just a link that looks normal and leads somewhere bad. Learning how to check if a link is safe before you click it is one of the highest-value skills on the internet, because it stops phishing, fake shops, and malware downloads at the first step.

The good news is that you do not need special software. You need a 30-second habit, a few places to look, and the discipline to pause when something feels off. This guide gives you that habit, step by step, for links in email, messages, social media, and search results.

Step 1: Hover, Do Not Click

On a computer, hover your mouse over a link without clicking. Your browser will show the real destination in the bottom corner, or in a small preview near the cursor. On a phone, long-press the link (or tap and hold) to see a preview of the address. If the preview does not match what the message claims, stop.

Look at the domain, the part between the protocol and the first slash. For example, in https://support.example-bank.com/login, the domain is support.example-bank.com. Attackers love lookalike domains: examp1e-bank.com with a number 1 instead of a letter l, or example-bank-support.com, which is a completely different site. If the domain is not the one you know and trust, do not trust the link.

Also watch for URL shorteners like bit.ly or t.co. They hide the real destination by design. That does not automatically mean a shortened link is malicious, but it does mean you cannot judge it by looking. Use a link expander or, better, go to the site yourself by typing its address or using a bookmark you already trust.

Step 2: Check the Context, Not Just the Link

A safe-looking link in a suspicious message is still suspicious. Ask three questions before you click anything. Did you expect this message? Does it create urgency, like an account closure, a missed delivery, or a prize expiring today? Does it ask you to log in, pay, or download something?

Scammers rely on urgency to make you skip the check. A real bank, delivery company, or platform will rarely demand immediate action through a link in a message, and they will never ask for your full password or a one-time code by email. If a message pressures you, that pressure is itself a warning sign.

If you are unsure, do not use the link at all. Open the service yourself, through its app or by typing its address, and check for the same notification there. If there is no alert inside your real account, the message was almost certainly fake. Our guide to spotting fake QR codes covers a similar trick, where a code on a poster or a sticker leads to a phishing page.

Step 3: Use Free Tools to Inspect a Link

When a link still looks plausible but you are not sure, paste it into a free checker instead of opening it. VirusTotal's URL scanner checks a link against dozens of security vendors and shows whether anyone has flagged it. Google's Safe Browsing transparency report can also tell you if a site is on a known bad list.

These tools are not perfect. A brand-new scam site may not be flagged yet, and a flagged site may be a false positive. Treat a clean result as reassurance, not proof, and treat a flagged result as a hard stop. If two checkers disagree, trust the cautious one.

For files, the same rule applies. Do not download an attachment or a program from a link you have not verified, even if the message looks official. If a document is important, ask the sender to share it through a method you already trust, or check with them through a separate channel, like a phone number you already have.

Step 4: Make Your Setup Forgive Mistakes

Even careful people click a bad link sometimes. Your setup should limit the damage. Keep your browser and operating system updated, so known flaws are patched. Use a password manager, so you do not type passwords into fake login pages out of habit. Turn on two-factor authentication on important accounts, so a stolen password alone is not enough.

On your phone, check that you know how to check if your data was leaked after an incident, and keep an eye on accounts for strange activity in the days after a suspicious click. If you did enter a password on a fake site, change it immediately from the real site, and change it anywhere else you reused it.

A Habit Worth Keeping

Checking a link takes seconds once it becomes automatic: hover, read the domain, check the context, and go direct if anything feels off. Teach the same habit to family members, especially anyone who is less confident online. Most scams fail at this one step, because they need you to click before you think.

The internet will not get less tricky. Links will keep getting shorter, messages will keep getting more convincing, and AI will keep making fake emails harder to spot. A simple pause, and a quick check, is still the best defence most people have. Use it every time, and make it boring. Boring is safe.