How to Tell If a Link Is Safe Before You Click It

October 18, 2026 • NOFYI Editorial Team

Links are everywhere: in messages, emails, search results, social posts, and documents. Most are harmless, but some lead to fake login pages, unwanted downloads, or sites that try to collect personal details. The good news is that you do not need to click a link to learn a lot about it. A short pause and a few checks can prevent most mistakes.

This guide shows a calm, repeatable way to judge a link before you click. It explains how to preview the destination, how to read the domain, how to treat shortened links, and what to do if a link still feels wrong. It is written for everyday browsing, not for security experts, and it does not require any special software.

Think of it as looking before you step. You are not trying to prove that a link is perfectly safe. You are trying to spot the signs that it is not what it claims to be, and to choose a safer way to reach the same place.

First, Pause and Consider the Context

Before you inspect a link, ask where it came from. Did you ask for it? Did it arrive from a person you know, from a service you use, or from a stranger? Was it sent with pressure, such as a warning that your account will close, a prize you did not enter, or an urgent payment request? Urgency is a common trick. It pushes you to click before you think.

Also ask whether the message matches what you expected. If a delivery message arrives for a parcel you did not order, or a bank message arrives about an account you do not have, the link is more likely to be misleading. In those cases, do not use the link to check. Use a method you already trust, such as typing the official address yourself or opening the official app.

Context alone does not prove a link is bad, but it sets the level of care. A link from an unexpected message deserves more checking than a link on a page you already trust.

How to Tell If a Link Is Safe Before You Click It

Follow these steps in order.

Hover to preview the destination. On a computer, move your mouse over the link without clicking. Your browser usually shows the full destination address in the bottom corner. Read it carefully. On a phone, a long press may show a preview or the address, depending on the app. Do not tap the link just to see where it goes; use the preview if your app offers one.
Read the domain, not just the words. The domain is the main part of the address, such as example.com in https://example.com/help. Ignore the words in the link text. A link that says Official Bank Login can still point to a completely different domain. Look at the domain in the preview, and ask whether it matches the organisation you expected.
Watch for lookalike domains. Some fake domains are close to real ones, with a swapped letter, an extra word, or a different ending, such as a support page that uses a lookalike name. Read the domain letter by letter. If it is close but not exact, treat it as suspicious. When in doubt, do not click. Type the address you know, or search for the organisation through a route you trust.
Check for HTTPS on pages that ask for details. A web address that starts with https:// uses an encrypted connection, while http:// does not. HTTPS is a basic expectation for login, payment, and account pages, but it does not prove that a site is honest. A fake site can also use HTTPS. Use it as one check, not as a guarantee.
Treat shortened links with extra care. Shorteners hide the full destination behind a short address. You cannot judge the domain from the short link alone. If a shortened link arrives unexpectedly, do not click it to find out where it goes. If you need the content, ask the sender for the full link, or reach the same page through the official site or app.
Look at what the link promises. A link that promises a prize, a refund, a free gift, or a secret document is more likely to be a lure. Legitimate services rarely send those kinds of links out of the blue. If the promise feels too good, or if the message creates fear, pause and verify through another route.
Use a safer route when you are unsure. Instead of clicking, open your browser, type the official address, and navigate from there. Or open the official app and check for the same message or notification inside it. This simple habit avoids most bad links, because you are not relying on the link at all.

If a link fails any of these checks, do not click it. A few seconds of caution is far easier than dealing with a compromised account or a misleading download.

Worked Example

Imagine Alex receives a message that says: Your account has a problem. Verify now to avoid closure. The message includes a button that says Verify Account.

Alex does not tap the button. First, Alex reads the context. Alex did not ask for an account check, and the message uses urgent language about closure. That is a reason to be careful.

Next, Alex hovers over the button on a computer. The preview shows a domain that is not the domain Alex normally uses for that service. The link text says Verify Account, but the preview domain is a long, unfamiliar address with extra words. The domain does not match the organisation in the message.

Alex then checks the safer route. Alex opens the official app directly and looks for any alert about the account. There is no alert. Alex also opens the official website by typing the address Alex already knows and signs in there. The account looks normal, with no warning.

Alex decides not to click the link. Instead, Alex reports the message using the reporting option in the messaging app, and deletes it. Alex did not need to prove that the link was harmful. The mismatch between the expected domain and the previewed domain was enough to stop.

Now consider a different outcome. If the preview domain had matched the official domain, and the message had appeared inside the official app as well, Alex could have had more confidence. Even then, Alex would still avoid entering sensitive details from a link in an unexpected message, and would prefer to go through the official app.

What to Do After You Click by Mistake

If you clicked a link and then realised it may have been suspicious, do not panic, but act quickly. Close the page. Do not enter any details, do not download anything, and do not grant permissions. If you entered a password, change it from the official site or app, not from the link. If you entered payment details, contact your bank or card provider through a number you already trust.

Also check your device for anything unexpected, such as a new download you did not ask for. If you downloaded a file from the link, do not open it. If you are unsure what happened, ask for help from someone you trust, or use the official support route for the service involved.

How to Report a Suspicious Link

Reporting helps protect other people, and it is usually quick. In a messaging app, use the Report option for the message or sender. In email, use the Report phishing or Report spam option if your email service offers one. If the link pretended to be from a company, you can forward it to that company through the reporting address listed on its official website.

When you report, do not click the link again to copy it if you can avoid it. Use the preview, the message details, or the reporting tool in the app. After reporting, delete the message so you do not click it later by accident.

Limitations

No checklist can prove that a link is completely safe. A real domain can be compromised, a page can look convincing, and a link can redirect through several addresses. Checking the domain reduces risk, but it does not remove it. That is why the safest habit is to reach important pages through a route you trust, rather than through a link in an unexpected message.

Shortened links are a special limitation. Because the destination is hidden, you cannot judge them by reading the address alone. Some tools can expand a shortened link, but they still require care, and they are not needed for everyday decisions. If a shortened link is unexpected, the simplest choice is not to click it.

Hover previews can also be misleading in some apps, because the preview may not show the full address, or the app may not offer a preview at all. In those cases, do not rely on the preview. Use the official app or type the address yourself.

Finally, this guide does not replace the security features of your browser, device, or email service. Those tools can warn you about known bad sites, but they do not catch everything. Your own pause and domain check is still an important layer.

FAQ

Does HTTPS mean a link is safe?
No. HTTPS means the connection is encrypted, but a fake site can also use HTTPS. Use HTTPS as one basic check, and still check the domain and the context before you click.

Can I trust a link because the link text looks official?
No. Link text can say anything. Always check the previewed destination address, not the words on the button or link. If the domain does not match the organisation, do not click.

What should I do with a shortened link?
Treat it with extra care, because the destination is hidden. If it arrived unexpectedly, do not click it to find out where it goes. Ask the sender for the full link, or reach the same page through the official site or app.

How do I report a suspicious link?
Use the Report option in your messaging or email app, or report it to the impersonated organisation through its official website. After reporting, delete the message so you do not click the link later by accident.

A safe link habit is simple: pause, preview, read the domain, and use a trusted route when anything feels off.