How to check if a link is safe before you click it

Most phishing still needs one thing from you: a click. The good news is that a link tells you a lot before you open it, if you know where to look. This guide shows how to preview a link on a computer and a phone, how to read the real domain, which tricks hide it, how to read links your company's security tools have rewritten, and how to check a link without visiting it.

How do you preview a link without clicking it?

Start by seeing where the link really goes. The words or button you see can say anything.

• On a computer: Microsoft's advice is to "hover your mouse over, but don't click the link. Look at the address that pops up when you hover over the link" (Microsoft Support). In most mail apps and browsers it appears at the bottom of the window or in a small tooltip.
• On Android: Microsoft says to "long-press the link to get a properties page that will reveal the true destination of the link."
• On iPhone and iPad: Microsoft suggests what Apple calls a "Light, long-press." A preview card shows the address. Don't tap the preview itself.

If the preview doesn't match what the text claims, stop there. A button that says "View invoice in QuickBooks" but points to an unrelated domain is enough of an answer.

How do you read the real domain in a link?

A web address has several parts, and only one of them tells you who owns the site.

The rule: find the first single slash after the //, then read the host name right to left. The registered domain is the last two labels, or three for country endings such as .co.uk. Everything to its left is a subdomain, and the domain's owner can make subdomains say anything they like.

Tricks that hide the real domain

Subdomain stuffing. microsoft.com.account-verify.example belongs to account-verify.example. The familiar brand on the left is decoration. The same trick appears as paypal-secure.example or microsoft365-support.example: a brand name plus a word, on a domain the brand doesn't own.

The @ trick. Anything before an @ in the host part is treated as a user name and ignored. RFC 3986, section 7.6 gives a classic example: ftp://cnn.example.com&story=breaking_news@10.0.0.1/top_story.htm "might lead a human user to assume that the host is 'cnn.example.com', whereas it is actually '10.0.0.1'." If you see an @ before the first single slash, distrust the link.

Raw IP addresses. A link to http://203.0.113.45/login has no domain at all. Real companies don't send customers to bare IP addresses.

Lookalike spelling. One changed character: rnicrosoft.com for microsoft.com, a zero for an "o", or an extra hyphen. Our guide to lookalike domain phishing covers the patterns attackers use.

Mismatched link text. The link's visible text can itself look like a web address, such as https://www.yourbank.com, while the real target is somewhere else. Always preview; never trust visible text.

Punycode and homograph domains

Domain names can contain non-Latin characters. Behind the scenes, these internationalized names are stored in an ASCII form that starts with xn--, often called punycode. The Chromium project's IDN documentation explains the risk: "the Latin "a" looks a lot like the Cyrillic "а"," so someone can register a name that looks identical to a famous one.

Browsers defend against this. Chrome decides for each part of a host name whether to show Unicode or punycode. If a label mixes scripts, for example Latin with Cyrillic, or looks confusable, Chrome shows the xn-- form instead. So in Chrome, micrоsoft.example written with a Cyrillic "о" would appear as xn--micrsoft-qbh.example.

Two practical rules follow:

1. If a link from an email shows xn-- anywhere in the host name and you weren't expecting a non-English domain, treat it as hostile.
2. A mail app may not apply the same checks as Chrome, so its link preview could show the lookalike Unicode form. When in doubt, don't use the link; type the address you know.

What about shortened links and QR codes?

URL shorteners turn a long address into something like short.example/x7Kq2. They have legitimate uses, but they hide the destination, which is why CISA lists "untrusted shortened URLs" as a warning sign. A preview tells you only that the link goes to the shortener.

• Treat a shortened link in an unexpected email as unverified.
• Some shortening services offer a preview page that shows the destination before redirecting. Use it only if you know the service, and still check the destination domain.
• Admins on Google Workspace can turn on Identify links behind shortened URLs in Gmail's safety settings; see our guide to Google Workspace advanced phishing and malware protection.

QR codes hide the link in an image and move the click to your phone. The same checks apply once you scan, but the safer habit is not to scan codes in unexpected emails at all. Our guide to QR code phishing explains why.

How do you read links rewritten by Safe Links or a gateway?

In many businesses, every link in incoming mail is rewritten so it can be checked again when someone clicks. That changes what you see when you preview.

Microsoft Defender for Office 365 Safe Links

Microsoft says scanned URLs are "rewritten or wrapped" using a prefix like https://nam01.safelinks.protection.outlook.com (Microsoft Learn). When you click, Safe Links checks the URL before opening the site and shows a warning page if it's known to be malicious. In Outlook, Microsoft says that when a user hovers over a URL, "a pop-up dialog displays the original URL, indicating it was scanned by Safe Links."

If you see the raw wrapped address in another app, the original destination is inside it, URL-encoded, in the url= parameter. Decode it in your head: %3A%2F%2F is :// and %2F is /. Then apply the same domain check as before.

Two things to remember:

• A wrapped link isn't a verdict. It means the link will be checked at click time, not that it's safe. Microsoft gives the example of a link that "was legitimate on delivery, but was later weaponized."
• Never trust a Safe Links prefix you can't place. Attackers know users trust these prefixes. Microsoft's own documentation notes that "default Microsoft warning pages are often used by attackers," which is why it suggests organization branding on the real ones.

For admins, our guide to Safe Links and Safe Attachments covers the settings that matter.

Other gateways and filters

Other email filters rewrite links in a similar way, with their own prefix and an encoded original URL. The same rules apply: find the original domain inside the wrapper, and treat the wrapper as a time-of-click check, not a guarantee. If links in your company's mail look like a security service you don't recognize, ask IT what your filter's rewritten links look like, so you can spot a fake.

How can you check a link without visiting it?

If the preview leaves you unsure, there are safer ways to check than clicking.

1. Go around the link. This is the advice every agency gives. The FTC says to contact the company "using a phone number or website you know is real — not the information in the email" (FTC). Microsoft suggests going to the organization's site "from your own saved favorite, or via a web search." CISA says to type the address yourself. If the message was real, whatever it wants you to see will be there when you sign in normally.
2. Copy, don't click. Right-click or long-press and copy the link address. The UK's NCSC, in its scam-website reporting guidance, says: "Do not click on the suspicious link. Carefully copy and paste it, or write it down on paper first if that feels safer" (NCSC).
3. Check its reputation. Paste the copied address into a URL reputation service. Google's Safe Browsing lists of "unsafe web resources" cover phishing and malware sites, and Google's Transparency Report has a public site-status search built on them. A clean result only means the site isn't on a list yet. New phishing sites often aren't.
4. Check the sender. Paste the message headers into our Email Header Analyzer, which runs in your browser, to see where the message really came from and whether SPF, DKIM and DMARC passed.
5. Ask. At work, forward it to IT or use the report button. In the UK, the NCSC accepts reports of suspicious websites and emails.

What shouldn't you do with a suspicious link?

Some well-meant habits make things worse.

• Don't "test" it. Opening a link to see what happens is the click the attacker wanted. A page can start a download, show a convincing sign-in form, or confirm that your address is live and worth targeting again.
• Don't rely on a private or incognito window. It doesn't sandbox the page. It only forgets your history afterward.
• Don't sign in after following an email link, even if the page looks perfect. Close it and open the service yourself.
• Don't forward a suspicious link to colleagues to ask whether it's safe. Forward the whole message to IT or use the report button, so the person checking sees the headers too.
• Don't trust the padlock. HTTPS means the connection is encrypted, not that the site is honest.
• Don't click "unsubscribe" in an obvious scam. CISA lists this explicitly. See is it safe to unsubscribe from spam.

A 6-step link check

Use this whenever an email asks you to click.

1. Was I expecting this message and this link?
2. Hover or long-press. Does the preview match what the text claims?
3. Find the first single slash. Is the registered domain the organization's real domain?
4. Any @ before the slash, an IP address, xn--, a shortener or a misspelling?
5. Is the link asking me to sign in, pay or download something? If so, go to the site myself instead.
6. Still unsure? Copy the address, check its reputation, and report the message.

If you've already clicked and typed a password, don't wait. Follow what to do after clicking a phishing link and tell IT straight away.

Next steps

• Share the 6-step check with your team, alongside our guide on how to spot a phishing email.
• Agree one way to report suspicious messages; our guide to reporting phishing emails covers Outlook, Gmail and Apple Mail.
• Find out whether your email filter rewrites links and what the rewritten links look like, so staff can recognize the real thing.
• Fewer bad links in inboxes means fewer judgment calls. iBlockSpam filters phishing and spoofing at the MX level, before mail reaches any mailbox; see how it works.

Browse our other phishing and threat guides.