An unfamiliar link can hide its destination behind a short URL, a misleading label, or several redirects. You can inspect the link without opening it in your normal browser, but no quick check can guarantee that the destination is safe or that it will stay the same.
Key Takeaways
- Copy the link address and inspect it as text before deciding what to do.
- A redirect checker or command-line request can show some redirect steps without opening the link in your browser. The check still sends the URL to a service or server and may trigger tracking.
- A familiar-looking domain, HTTPS, or a short URL does not prove a link is safe.
- Redirects can vary by location, device, time, or other conditions. Treat results as a snapshot, not a guarantee.
- Never submit password-reset links or other private, one-time URLs to public checking services.
First, inspect the link without visiting it
If the link is in an email or message, use the app’s Copy link address option rather than clicking it. Paste the result into a plain-text editor—not your browser’s address bar or a search box. On a phone, use the app’s copy-link option if available; avoid long-press actions that might open a preview.
Check the actual URL, not just the text shown on screen. For example, a message might display “Sign in to Example Bank” while the link address points somewhere unrelated. Read the hostname carefully: in https://login.example.com.attacker.example/path, the hostname is login.example.com.attacker.example, not example.com.
A shortened URL conceals its destination until it is expanded or requested. That alone does not make it malicious, but it gives you less information before you decide whether to proceed.
Inspect a redirect chain
A redirect checker can request a URL and report the HTTP redirects it receives. Use a service approved by your organization or one you trust, and submit only links that are safe to share. The service will receive the full URL and may contact the destination itself.
For a command-line check, curl can request one URL and print its response headers without automatically following HTTP redirects. This example uses a fictional address:
curl -sS -D - -o /dev/null --range 0-0 --max-time 10 'https://short.example/abc'
Look for the HTTP status line and a Location header, such as:
HTTP/1.1 302 Found
Location: https://news.example/story
If there is a Location header, that is the next URL in the observed HTTP redirect chain. You can inspect that address in the same way, one step at a time. Stop if a destination looks unexpected; do not open it just to see what happens.
This command makes a network request. It does not open the destination in your normal browser, but the server may still record the request or trigger tracking. The range request asks for a small portion of the response, but a server can ignore it; the time limit bounds how long curl waits, not every possible resource risk. A HEAD request (curl -sSI --max-time 10 'https://short.example/abc') may avoid downloading a response body, but some sites handle HEAD differently from a normal page request. If the response does not match what you expect, treat the result as inconclusive.
Understand what the result does—and does not—tell you
A redirect check reports what happened for that particular request. It may not match what happens when someone else opens the link. A site can send different destinations based on location, device, cookies, time, or other request details. Some pages also use JavaScript or HTML redirects that a simple HTTP-header check will not show.
Destinations can change after inspection, too. A link may be safe when checked and point somewhere else later. Scanners can also fail to reach a site, receive an error, or see a different path than a real browser. A clean-looking result is therefore not a safety verdict.
A familiar brand name in a URL is not enough to establish legitimacy. Inspect the hostname’s actual ending and spelling; attackers can use lookalike names or place a trusted-looking string in a longer hostname. HTTPS encrypts the connection to the named site, but it does not establish that the site itself is trustworthy.
Keep private links private
Do not paste password-reset links, account sign-in links, invitation links, or other private or one-time URLs into public redirect checkers, URL scanners, or online forums. Such URLs can contain tokens that grant access or identify your account. A checking service may store the submitted URL, and its request may consume a one-time link or notify the service that it was used.
If a suspicious link arrived at work, follow your organization’s reporting process or ask IT/security staff to inspect it. If you must check a sensitive link, use an approved internal process rather than sending it to an outside service.
Common Mistakes
- Trusting the visible link text: The text and the actual link address can differ. Copy and inspect the address.
- Assuming HTTPS means safe: HTTPS protects the connection; it does not certify the site’s intent.
- Trusting a short URL because it is popular: A shortener hides the destination and can redirect somewhere unexpected.
- Treating one scan as proof: The result is specific to one request and may not reflect other users or a later visit.
- Submitting a private URL to a public checker: The URL itself may contain sensitive access tokens.
- Following every redirect automatically: Each request can contact another server and may reveal information or trigger tracking. Inspect unfamiliar steps cautiously.
Best Practices
- Copy the address without opening it and inspect the hostname in plain text.
- For a public, non-sensitive link, use an approved checker or inspect HTTP redirects one step at a time.
- Treat errors, missing results, or differences between checks as inconclusive—not as evidence that the link is safe.
- If the link asks you to sign in, pay, download a file, or provide personal information, navigate to the organization’s known website or app independently instead.
- Report suspicious workplace messages through your company’s established process.
Conclusion
You can check where a link leads without opening it in your regular browser by inspecting its address and, for shareable URLs, examining its redirect responses. The result is only a snapshot, so keep private links private and use a known route to important accounts rather than trusting an unfamiliar link.