Is That Short Link Safe? How to Check Before You Click

Someone sends you a link. It's seven random characters on a domain you half-recognise, and you have no idea where it goes. That's the whole problem with short links: the thing that makes them convenient is the thing that makes them useful to scammers.

You can check before you click, and it takes about ten seconds.

Method 1: add a plus or a preview flag

Several shorteners expose a preview if you modify the URL. The most widely known is appending a plus sign to a bit.ly link — bit.ly/example becomes bit.ly/example+ and shows a stats page with the destination instead of redirecting.

Support varies by provider and some have retired it, so treat this as a first try rather than a guarantee. If it redirects anyway, use one of the methods below.

Method 2: an unshortening service

Paste the short link into a link-expander and it follows the redirects for you, showing the final destination without your browser ever going there. Several free ones exist. It's the fastest general-purpose option because it works regardless of which shortener made the link.

Look for one that shows the whole chain, not just the final URL. A link that passes through four redirects before landing is itself a warning sign.

Method 3: check the headers yourself

If you're comfortable with a terminal, this is the most reliable method because nothing renders and no script runs:

curl -sI https://short.example/abc

The response includes a status code and a location header pointing at the next URL. You see exactly where it goes and nothing executes.

Method 4: long-press on mobile

On a phone, press and hold the link instead of tapping. Most apps show a preview with the URL. This only reveals the short URL, not the destination — but it's enough to spot a domain you don't recognise before you commit.

Warning signs worth knowing

Once you can see the destination, these are the things that should stop you:

• The domain nearly matches a real one. Character swaps and extra words — a hyphenated version of a bank's name, or a familiar brand with an odd suffix. This is the single most common trick.
• A login page you arrived at from a link. No legitimate service needs you to sign in via a link someone messaged you. Navigate to the site yourself instead.
• Urgency. Account suspended, payment failed, prize expiring. Urgency exists to stop you checking.
• A long redirect chain, especially one crossing several unrelated domains.
• No HTTPS, or a certificate warning.
• A file download you didn't ask for, particularly anything executable.
• A shortener domain you've never seen, combined with any of the above.

Context matters as much as the URL

A short link from a stranger, in an unexpected message, about money or accounts, deserves suspicion no matter how clean it looks. A short link from a colleague in a thread you're already having is usually fine.

Also remember that an account being real doesn't make the message real. Compromised accounts send scam links to their own contact lists, which is why a link from someone you know can still be hostile. If a message is out of character, ask them through another channel.

If you already clicked

Don't panic — visiting a page is usually not enough on its own. But:

• Enter nothing. No passwords, no card details, no codes.
• Close the tab rather than interacting with anything on it.
• If you did enter a password, change it immediately on the real site, and anywhere you reused it.
• If you entered card details, contact your bank.
• Run a scan if you downloaded anything.

For people who make short links

The trust problem cuts both ways. If you send short links to customers, help them believe you: use your own domain rather than a shared shortener, and use readable back-halves so the link looks intentional. A link ending in /invoice-march reads very differently from one ending in random characters — and that's the difference between a click and a delete.

Create links on your own domain — free, with readable custom back-halves.