How to Check if a Link Is Safe Before Clicking It

A link's text can say anything; what matters is where it actually goes. A few seconds of checking before you click stops most phishing and malware links.

1. See the real address

• Computer: hover over the link without clicking. Chrome shows the real address in the bottom-left corner of the window.
• Phone: press and hold the link to see the address before opening it.
• Email: the display text "Click here to view your invoice" can point anywhere. Always check the underlying address.

2. Read the address properly

Focus on the main part just before the first single slash. In account.paypal.com.secure-check.net/login, the site is secure-check.net, not PayPal. Watch for:

• Swapped letters or numbers: amaz0n, rnicrosoft.
• Extra words: paypal-account-verify.com.
• Unusual endings, such as an unexpected country code.

See spotting fake websites.

3. Expand short links

Shortened links hide their destination. Many shortening services offer a preview page, and link expander sites show where a short link leads without visiting it. Be extra careful with short links in unexpected messages.

4. Scan the link

• Google Safe Browsing site status: paste an address into Google's Transparency Report to see whether it's flagged as dangerous.
• VirusTotal: checks a URL against dozens of security services at once.

A clean result isn't a guarantee. New phishing sites often aren't on any list for their first hours.

5. Think about the message

• Were you expecting it?
• Does it create urgency or fear?
• Is it asking you to sign in, pay or download something?

If in doubt, don't use the link. Go to the site yourself by typing its address or using a bookmark.

QR codes are links too

Your phone camera shows the address before opening a QR code. Check it the same way, especially on parking meters, flyers and emails, where fake codes get stuck over real ones.

Let Chrome protect you

• Turn on Enhanced protection in Settings → Privacy and security → Security.
• Keep Chrome updated so known exploits are patched. See drive-by downloads.
• Don't approve downloads or notification requests you didn't expect.

If you clicked a bad link

Close the page, don't enter any details, and delete any download. If you did sign in, change that password right away. Clipboard Guard stops pages from reading your clipboard, which helps if you copy passwords or codes. See checking for leaked passwords.