How to check if a link is safe
A link can show one address and take you to another. Before you open it, find out where it really ends up, and whether any warning list knows that address.
Short answer. Do not tap the link in the message. Paste it into a link checker that follows every step to the final page and asks the warning lists about it, then read the final address yourself. If the message claims to come from a company you deal with, go to the company's site by typing its address or using its app. Run the checks on an address or a message.
Before you click
- See the real address. On a computer, rest the pointer on the link and read the address that appears at the bottom of the window. On a phone, press and hold the link. Get Cyber Safe, the Government of Canada's advice service, says to "Hover over hyperlinks carefully" (Get Cyber Safe, read 29 October 2026).
- Read the registered name. It is the part just before the ending: in northbank.com.account-check.net, the site is account-check.net, not Northbank (a made-up bank). Our guide to look-alike addresses has more examples.
- Ask whether you expected it. An unexpected link about a parcel, a fine, a refund or an account problem is the most common start of a scam.
Where a link really goes
Many links pass through other addresses before they reach a page. Link shorteners (bit.ly and others), email newsletters and adverts all do this, for normal reasons: they count clicks. Scammers use the same steps to hide the final address, or to send phones and computers to different pages.
So the address in a message tells you little. What matters is the last address in the chain. Our checker opens the link from our server, follows up to 10 steps, and lists each one, so you can read the final address without opening it on your own device.
What a server cannot see. Some sites show one page to a server and another to a phone. A chain that ends on a harmless-looking page is not proof the link is safe on your phone.
Warning lists (blocklists)
Link checkers ask lists of known dangerous addresses. The largest is Google's, which Chrome uses for its Safe Browsing warnings and which other companies use through Google Web Risk. Our checker asks Google Web Risk about the link and about its final address.
A listing is strong evidence. No listing is weak evidence. Google says Chrome's standard protection warns about sites "that have been identified as dangerous" (Google, read 29 October 2026), so it covers known threats. Scam sites often live only a few days, and many are never listed at all, especially fake shops that take money and send nothing.
Lists of harmful downloads
Some lists track only links that spread harmful software, such as fake app downloads and booby-trapped documents. URLhaus, run by abuse.ch, is one. Our test copy asks it; the public site does not yet, while we ask abuse.ch whether its terms allow it.
These lists are good at one thing: a link to a file that installs something harmful. They say little about fake shops or pages that ask for your password.
If you already clicked
Act on what happened:
- You only looked. Close the page. Do not enter anything, and do not call any number it shows.
- You entered a password. Change it now on the real site, and on any other account that uses the same password. Turn on two-step sign-in.
- You entered card or bank details, or paid. Call your bank or card provider at once, on the number on your card.
- You downloaded and opened a file or app. Remove it, then run a full scan with your device's built-in security or your security software.
Then report the link. Who to tell, by country.
Where a product helps
Here a product can genuinely help, within limits.
- Security software with web protection blocks addresses on its own lists in every browser on the device, and scans files you download. Like every list, it misses sites that are too new to be known.
- A password manager fills in your password only on the address it saved. The UK's National Cyber Security Centre says this "helps protect you from phishing attacks as the password will only autofill on the correct website" (NCSC, read 29 October 2026). If it does not offer your password, look again at the address.
Free first: Chrome's Enhanced protection warns about "potentially dangerous sites, downloads, and extensions", including new threats (Google, read 29 October 2026), and phones and browsers include password managers.
About this guide
Our checks that this guide explains: Where the link goes, Google Web Risk, URLhaus. Each quote was read on the source's own page on the date shown. Legit Signals has no affiliate links: no company pays to be named here.
Last reviewed: 29 October 2026. Spotted an error? Tell us