Is This Link Safe? How to Read a URL Before You Click

TrainingOctober 9, 2026

BasicsOnline safetyLevel Absolute beginnerHow-to · ~5 minExam CC · Security+

Every scam link has one job: get you to tap before you look. The good news is that a web address can't hide where it really goes from someone who knows which part to read. Here's how to read a link in five seconds, why the padlock doesn't mean what most people think, and what to do if you already typed a password into a fake page.

Steven once trusted a link because it "had the padlock." So does every scam site I've ever seen. The padlock means the line is private, not that the person on the other end is honest. — Nyx

Why it matters: most account takeovers start with one tap on a link in a text, email or DM. The page that opens can look exactly like your bank or your game account. The web address is the one part the scammer can't make match, so it's the one part worth learning to read.

Step 1: find the real domain (read right to left)

A web address has one part that decides who you're really talking to: the domain. Find it like this: look at the text between https:// and the first single slash. Then read that chunk from right to left. The last two pieces (sometimes three, like .co.uk) are the real owner. Everything to the left of them is just a label the owner made up.

https://login.yourbank.com/account → the real domain is yourbank.com. "login" is just a label they chose. ✅
https://yourbank.com.account-verify.net/login → read right to left: the real domain is account-verify.net. "yourbank.com" is a decoy label stuck on the front. ❌
https://yourbank-secure-login.com → the real domain is yourbank-secure-login.com, which anyone can register. It is not yourbank.com. ❌

That second example is the classic trick. The brand name appears in the link, so a quick glance says "looks fine." Reading right to left catches it every time.

Step 2: the padlock means private, not safe

The padlock (or https://) means the connection between you and the site is encrypted, so nobody on your Wi-Fi can read it. It says nothing about whether the site is honest. Certificates are free and automatic, so most phishing sites have the padlock too.

This confused so many people that Chrome replaced the padlock icon with a neutral settings icon in 2023. A padlock is the minimum, not a seal of approval.

Step 3: spot the lookalikes

Scam domains are built to pass a two-second glance. Watch for:

Swapped letters: rn pretending to be m, a zero for an o, a capital I for a lowercase l.
Extra words: -secure, -support, -verify, -login added to a brand name. Real companies rarely do this to their main site.
A different ending: .co or .net instead of .com, or a country ending the company doesn't use.
Odd characters: some scam domains use lookalike letters from other alphabets. Browsers often show these in a disguised form starting with xn--. If you see that in a link you didn't expect, stop.

Step 4: see the link before you tap it

On a computer: hover your mouse over the link (don't click). The real address shows in the bottom corner of the browser or email app.
On a phone: press and hold the link. A preview pops up showing the full address. Read it, then let go without opening it.
Short links (bit.ly and friends) hide the destination. For a bit.ly link, add a + to the end and paste it into your browser to see where it goes without visiting it.
QR codes are just links in disguise. Your phone camera shows the address before it opens. Read it with the same right-to-left rule.

Step 5: assume the login page could be a perfect copy

Copying a login page takes minutes, so a fake can look pixel-perfect: same logo, same colours, same "Forgot password?" link. Don't judge the page by how it looks. Judge it by the address bar, and use these two habits that beat even a perfect copy:

Go in through the front door. If a message says there's a problem with your account, don't use its link. Open the app, or type the address yourself, or use a bookmark. If the problem is real, you'll see it there.
Let your password manager be your alarm. A password manager fills your password only on the exact domain it was saved for. If it suddenly offers nothing on a "login page" you've used a hundred times, that silence is the warning. Don't paste the password in by hand.

New to password managers or not sure your password is strong enough? See strong passwords and passphrases.

Not sure? Check it without opening it

Paste the link (don't click it) into a free checker. VirusTotal runs it past dozens of security engines, and Google Safe Browsing site status tells you if Google has flagged it. A clean result isn't a guarantee (brand-new scam sites haven't been reported yet), but a red result is a definite no.

If you already typed a password into a fake page

It happens to careful people. Move fast and it's usually fine:

Change that password now on the real site (open it yourself, not from the message). If you used the same password anywhere else, change it there too.
Turn on two-step sign-in (MFA) if it isn't on already.
Check recent activity: most accounts have a "devices" or "recent sign-ins" page. Sign out anything you don't recognise.
If it was a bank or card, call the number on the back of your card and tell them.

The one-minute version

Read the domain right to left, up to the first single slash.
The padlock means private, not safe.
Watch for swapped letters, extra words, odd endings and xn--.
Hover or long-press to see before you tap.
For account warnings, go in through the app or a bookmark, never the link.
If your password manager won't fill it, don't type it.

Got the message as a text? How to spot a phishing text covers the message itself. Curious what happens after you press Enter? What happens when you type a URL walks through it step by step.

Right to left. Every time. Even when it's from "your bank." Especially when it's from "your bank." — Nyx

You don't need to memorise every trick, just the one place they can't fake. Read the domain, and you're ahead of most of the internet. — Nova