Is this link safe? In about a minute, you can tell: read the real domain, expand any short link, and check the address in a reputation database before you click.
Quick summary: This guide is for anyone who gets links by email, text, social media, or QR code. The verdict: five quick checks beat any single tool, because no scanner catches everything. The key number: VirusTotal compares a link against over 70 antivirus scanners and URL/domain blocklisting services, and a clean result is still not a guarantee.
Is This Link Safe? Run These 5 Checks in Order
Work through them from the top and stop at the first red flag.
- Read the real domain before anything else.
- Expand short links and QR codes to see where they lead.
- Scan the link without opening it in a reputation tool.
- Confirm through another channel by opening the official site yourself.
- Treat a clean result as “no known threat,” not as proof.
Check 1: Read the Real Domain
The part that counts is the domain right before the first single slash. Everything to its left is decoration, and attackers count on you stopping at a familiar name.
| Link as shown | Real domain | What is going on |
|---|---|---|
https://accounts.google.com.verify-login.example/signin | verify-login. example | “google.com” is only a subdomain label |
https://paypa1.example/login | paypa1.example | A digit 1 replaces the letter l in a look-alike name |
https://short.example/Ab12Cd | short.example | A short link hides the real destination |
These domains are illustrations and use the reserved “.example” ending. CISA lists misspelled look-alikes such as “amazan.com” among common phishing signs.
On a computer, hover over the link and read the address that appears in the corner of the browser. On a phone, press and hold the link to preview its address
Check 2: Expand Short Links and QR Codes
A short link or QR code hides its destination, so expand it before you open it. CISA lists “untrusted shortened URLs” among common phishing signs.
Use a link expander that shows where the link ends up, then run Check 3 on the expanded address. For QR codes, your phone camera usually shows the web address before it opens the page, so read it with the same rules as Check 1.
Check 3: Scan the Link Without Opening It
Copy the link address instead of clicking it, then paste it into a reputation tool. Two free tools cover most cases:
- Google Safe Browsing Site Status shows whether a site currently contains content that Safe Browsing has determined to be dangerous. Chrome, Gmail, and Google Search use the same system to warn you.
- VirusTotal checks the address against over 70 antivirus scanners and URL/domain blocklisting services. When a contributor blocklists a URL, VirusTotal says it is reflected in verdicts immediately.
One privacy tip: VirusTotal says submission results are shared with the submitter and with examining partners. Never paste links that contain private tokens, such as password-reset or private file-sharing links.
I ran my own site, Sawahits, through both tools as a quick test.
Google Safe Browsing’s Site Status page returned “No unsafe content found.” Its own description says you can use it to see whether a website is “currently dangerous to visit,” which is exactly what it reports and no more.
Check 4: Confirm Through Another Channel
For anything involving an account, a payment, or a delivery, skip the link and open the official site yourself. Type the address or use a saved bookmark.
The FTC says, “Legitimate companies won’t email or text with a link to update your payment information.” If you have an account with the company, contact it through a phone number or website you know is real, not the details in the message.
Also confirm links from friends by call or chat, because hacked accounts send them too. And don’t rely on spelling: CISA notes that some phishing emails now have “perfect grammar and spelling.”
Check 5: Treat “Clean” as “No Known Threat”
A clean result means the tools found nothing yet, not that the page is safe.
My own test shows why. In VirusTotal’s Detection tab, one vendor, Sophos, marked my site as “Spam,” while the other vendors visible in my screenshot (Abusix, Acronis, BitDefender, and more) read “Clean.” Google’s Safe Browsing check found no unsafe content on the same address.
Two takeaways from one scan. A single flag among many clean verdicts can be a false positive, so verify through the official source before judging a link. And check the report’s date: the VirusTotal report I opened was timestamped 1 July 2026, with its last analysis listed as “3 months ago.” Click Reanalyze to get a current verdict.
| What you see | What to do |
|---|---|
| Several scanners flag the link | Don’t open it. Delete the message and report it |
| A single scanner flags it | It may be a false positive, but verify through the official site before opening |
| Clean, but the message was unexpected or urgent | Don’t click. Go to the site yourself |
| Clean, expected, and the domain matches the official one | Low risk. Open it and stay alert for login prompts |
If You Already Clicked
Close the page without typing anything, then secure your device and accounts. These steps follow the FTC’s guidance on phishing:
- Don’t enter anything. If a file downloaded, don’t open it. Delete it.
- Update your security software, run a scan, and remove anything it flags. For a free second opinion, our Microsoft Safety Scanner review explains what that tool can and can’t do.
- Change the password of any account you typed into, and turn on multi-factor authentication. The FTC says it “makes it harder for scammers to log in to your accounts if they do get your username and password.”
- If you shared financial or identity details, follow the FTC’s recovery steps (IdentityTheft.gov in the US) and contact your bank.
- Report it. The FTC says to forward phishing emails to reportphishing@apwg.org and texts to 7726 (SPAM). Outside the US, use your local authority.
Add a Safety Net for Links You Miss
Security software can block known phishing pages before they load. Our Bitdefender vs Norton 360 Deluxe comparison covers Bitdefender’s web attack prevention and Norton’s scam-protection tools.
Files are a separate risk. If a link leads to an APK, see how to verify the official download in our AdGuard Premium APK guide.
FAQ
How do I check if a link is safe without clicking it?
Is this link safe if it starts with https and shows a padlock?
Is a shortened link safe to open?
What should I do if I clicked a suspicious link?
Can a link scanner guarantee a link is safe?
Final Verdict
Use this routine for any unexpected link, short link, or QR code. Skip the tools and act at once if you already entered a password, using the steps above. The concrete reason: scanners only know what has been reported, so the domain check and the official-site check are what actually protect you.
