How to check if a link is safe before you click
2 min read · Updated October 15, 2026
Hover over the link (or long-press on mobile) to see the real destination, check the domain carefully for lookalike spellings and avoid shortened links from unknown senders. When a message asks you to log in, open the website yourself instead of clicking.
Read the domain, not the page name
The part of the address that matters is the registered domain, the section just before the first slash. A link to ‘yourbank.example.com’ belongs to ‘example.com’, not ‘yourbank’. Attackers register lookalike domains with small changes, such as swapped letters or extra words.
Quick checks
- ✓Hover or long-press to preview the destination.
- ✓Look for subtle typos, extra hyphens or unexpected endings.
- ✓Be careful with shortened links when you do not know the sender.
- ✓A padlock icon only means the connection is encrypted, not that the site is trustworthy.
Got a suspicious email about a leak?
Scammers love leaked data. See whether your address is genuinely in a known breach so you know how much of the message is real.
When to skip clicking altogether
For anything involving money, passwords or personal data, open the company’s site or app yourself. That one habit defeats most phishing links.
If you are still unsure
Ask the supposed sender through a different channel, or report the message and delete it. A genuine message can always be verified.
Frequently asked questions
Does HTTPS mean a site is safe?+
No. Many phishing sites use HTTPS. It only means the connection is encrypted.
Can I trust link-scanning websites?+
They can help but are not perfect. New malicious sites may not be flagged yet.
What about links in texts or chat apps?+
Apply the same checks. Smishing and chat scams are common.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.