How to Check Where a Link Goes Without Clicking It

At Talha Aslan and team, we deal with this question during site migrations, ad setups and suspicious email reviews. So we explain the method from two angles: the everyday user and the site owner. If you already have a suspicious address, you can trace it right away with our free redirect checker. Then use this guide to read the result.

At the end you will find a checklist, a table that compares the methods and a section on what to do if you already clicked. Our goal is not to sell you a tool. Instead, we want you to build a habit that takes a few seconds per link.

Why might a link not go where it says?

Every link has two separate parts. The first is the text you read on screen. The second is the address your browser actually opens when you click. These two parts are independent. In other words, text that says "Track your parcel" can point to an address that has nothing to do with any courier.

Moreover, the address itself may not be the final stop. When the server receives the first request, it can answer with a redirect that says "go to this other address instead." Short link services work exactly this way. Legitimate campaigns also pass through tracking addresses. Therefore a redirect alone is not a sign of bad intent. Still, clicking without knowing the destination is an unnecessary risk.

In short, you need to look at three layers:

• The visible text: the sentence you read in the email or message.
• The real address: the URL behind the link.
• The final stop: the page that opens after all redirects finish.

This guide shows how to open these three layers one by one, safely.

What is the fastest way to see where a link goes on a computer?

The fastest way is to hover your mouse pointer over the link and wait. Most desktop browsers then show the real address in a corner of the window. Google also recommends this in its Gmail help page: hover over links before you click them. If the address does not match the link description, it might lead to a phishing site.

However, the status text often cuts off long addresses. In that case, follow these steps:

1. Right click the link and choose the option to copy the link address.
2. Paste it into a plain text field such as a notes app, not into the address bar.
3. Read the address from start to end and focus on the part before the first single slash.
4. If you see a short link or an unfamiliar middle address, check the redirect chain next.

The reason for the notes app is simple. If you paste into the address bar and hit Enter by mistake, you open the page. In a plain text field, the address is only text. So you can study it calmly without sending a single request.

How do you check where a link goes on a phone without opening it?

Phones have no mouse pointer, so hovering does not work. Instead, you press and hold the link. Most apps then open a menu with an option to copy the link address. Some phones also print the address itself above the menu.

There is one important detail here. Some browsers show a small preview of the page on a long press, and the device may load the page in the background to build that preview. That is why you should not rely on the preview for a suspicious link. Copy the address instead.

Next, paste the copied address into a notes app and read it. If the phone screen is too small, keep the address as plain text rather than forwarding it around. Finally, if you see a short link or a string of random letters, open the chain in a redirect checker. Keep the same habit in messaging apps too, especially for messages about parcels, banks or prizes.

Where should you look to read a URL correctly?

The most important part of an address is the domain name. It tells you which website the page really belongs to. To find it, skip the https:// at the start and read up to the first single slash. In most cases, the last two parts on the right of that segment show who owns the site.

Example scenario: the address is "yourbank.example.com/login". Here "yourbank" is only a subdomain. The real domain is example.com. So the page sits under the control of whoever owns example.com, even if the word bank appears in it. Scammers target exactly this reading habit, because the eye reads left to right and stops as soon as it sees a familiar word.

The rest of the address gives clues as well:

• Path: the part after the slash. Words like "login" or "verify" prove nothing on their own.
• Parameters: the part after the question mark. They are normal for ad tracking, but be careful if they carry another full address.
• Protocol: an address that starts with plain http, without encryption, is a serious warning sign for any login page.

If you want to know how parameters work, see our guide to URL parameters.

How can you see the target behind a short link?

A short link service turns a long address into one with only a few characters. When you click, the service sends you on to the real address. This is useful in marketing. That said, the same feature hides the real target, which also makes it useful for scammers.

There are two ways to see where a short link goes. The first is the service's own preview feature. Some services open a page that shows the target when you add a certain marker to the end of the address. However, this differs from service to service, and many services do not offer it. So the second way is more reliable: you paste the short link into a redirect checker. The checker reads the redirect response from the service and lists the target for you.

Also keep in mind that a short link can redirect more than once. One short link can point to another short link, which then points to an ad tracking address. We compare the features of popular services in our URL shortener comparison. Here the focus stays on one question: where an existing short link really ends up.

What is a redirect chain, and why should you follow it to the end?

A redirect chain is the sequence of middle addresses a link passes through before it reaches the final page. For example, address A sends you to B, and B sends you to C. You only see A, but the page that opens is C. That is why looking at the first link in the chain alone can mislead you.

Servers redirect with a status code and a Location header in the HTTP response. The HTTP standard, RFC 9110, says the server should put the new address in that header, and the browser can use it for automatic redirection. Following the chain therefore means reading that header at every step and moving on to the next address.

Following the chain to the end has two benefits. First, you see the real destination. Second, you notice whether an unknown, constantly changing or unencrypted address sits in the middle. The topic matters for site owners too, because needlessly long chains slow pages down and make crawling harder. For the technical side, our article on what a redirect chain is and how to fix it covers the site owner's view in detail.

How do you use a redirect checker to see where a link goes, step by step?

A redirect checker sends a request to the address on your behalf and lists the server's answer at every step. In our tool, each hop is a fresh request from our server, it follows up to 10 hops, and your browser cache never affects the result. Most importantly, your own browser never opens the suspicious page during the check.

Here are the steps:

1. Copy the suspicious link's address as described above. Do not click it.
2. Open the redirect checker and paste the address into the URL field.
3. Choose the single URL mode and start the check.
4. Read the status code and address of each row in order.
5. Check the domain in the final address row with the URL reading method above.
6. If the final address is not the official domain of the organization you expect, do not open the link.

Example scenario: you enter a short address, and the tool shows 301, then 302, then 200. This means a page opened after two redirects. You make the real decision by looking at the domain in the last row. The codes themselves do not mean safe or dangerous.

What do the status codes in the result tell you?

The three digit number in each row shows the type of answer the server gave. Codes that start with 3 are redirects. Codes that start with 2 mean success, while 4 and 5 mean an error. The table below summarizes the most common codes, based on the definitions in RFC 9110 and Google's documentation on redirects.

For the search engine side of permanent and temporary redirects, see our article on 301 vs 302, 307 and 308. For link safety, the destination matters much more than the code type.

Which redirects can a redirect checker not see?

Every tool has limits, and knowing them is part of reading the result correctly. Server side checkers read redirects in the HTTP response. However, some pages redirect from inside the page itself, with a meta refresh tag or with JavaScript. Our tool does not show these in page redirects either, because it does not run the page like a browser.

Google also advises against JavaScript redirects where possible in its documentation on redirects, because rendering may fail for various reasons. So this method is not fully dependable even for search engines. Scammers, on the other hand, may prefer it for exactly that reason.

Keep these limits in mind when you read the result:

• The last row can show 200 while the page still holds another redirect inside.
• Some sites block automated requests or time out, so the result stays incomplete.
• Some redirects change by device, language or country, so your phone may reach another target.
• An address can lead to a clean page today and to somewhere else tomorrow.

Use the checker result as a first screen, not as a final verdict. If doubt remains, not opening the link is always the safest choice.

Which warning signs point to a phishing link?

Phishing is a scam that makes you feel you are on a familiar organization's site so you hand over a password, card or identity details. Google's Gmail guide stresses that scammers use emotion to make you act without thinking. So the first sign is often the message, not the address.

Look for these signs in the message and the address:

• Pressure to hurry, such as "verify within 24 hours or your account closes."
• A mismatched domain, with the brand in the subdomain and another name as the real domain.
• Letter tricks, where a familiar name has one letter changed, added or swapped for a lookalike.
• An @ sign in the address, or a part that starts with xn--.
• A raw IP address made of numbers instead of a domain name.
• Plain http without encryption on a login page.
• A sender name that does not match the sender's email address.

No single sign is proof on its own. Yet when two of them appear together, you should not open the link. For an example of fake platform warnings, see our article on the fake Meta copyright violation message.

What does an @ sign or xn-- in an address mean?

The @ sign in an address comes from an old feature. The URI standard, RFC 3986, defines a user information part before the host, and that part ends with @. Your browser connects to whatever comes after the @. Its semantic attacks section describes exactly this risk. Attackers can build an address that makes a person believe it points to a trusted site, while it really points to a different server.

Example scenario: the address reads "https://yourbank@example.com/". Here "yourbank" is only user information, and the server you connect to is example.com. Some modern browsers warn about this pattern. Still, when you read an address yourself, always look to the right of the @ sign.

The xn-- prefix, in turn, is the technical spelling of internationalized domain names. Under the IDNA standard, domains with non ASCII letters turn into a code that starts with xn--. This is completely legitimate, because many real sites have special characters in their names. However, if you expect a familiar brand address and see a domain that starts with xn--, consider that it may be a lookalike built from similar looking letters. Then type the official address yourself.

Does the HTTPS padlock prove that a link is safe?

No. The padlock only tells you that the connection between your browser and the server uses encryption. It does not tell you who owns the server or whether their intent is good. Since certificates are easy to get today, many phishing pages also open with a padlock.

So treat HTTPS as a minimum requirement, not as a guarantee. A login page without encryption is something you must avoid, but encryption alone does not make a page trustworthy. If you want to see whom a certificate covers and for which domain, our SSL checker shows the details. We explain what a certificate actually does in our SSL certificate guide.

Another clue is the age of the domain. A domain registered a few days ago cannot be the official site of a long established organization. You can see this with our WHOIS lookup. That said, some extensions hide registration data, so a missing date is not a red flag by itself.

How do you check the address behind a QR code?

A QR code hides an address inside a square pattern, so you cannot read the target by looking at it. That makes the question of where a link goes even more important for QR codes. Fake codes stuck over real ones in parking lots, on restaurant tables or on flyers in mailboxes are typical examples of this risk.

A safe approach looks like this:

1. Scan the code with your phone camera, but do not tap the notification right away.
2. Read the address the camera shows. Most phones display the domain before opening it.
3. If the address is short or the domain is unfamiliar, copy it and check it in a redirect checker.
4. If it leads to a payment or login page, complete the task in the organization's official app instead.

In physical places, also check the sticker itself and look for a second layer on top of the code. For the name of this scam and its typical scenarios, see our guide on quishing and QR code scams.

What are the steps to check a suspicious link safely?

You can turn everything above into a routine that takes a few minutes. If you follow the same order for every suspicious link, decisions get easier and panic clicks become less likely.

1. First, judge the message. Did you expect it, and does it push you to hurry?
2. Copy the real address without clicking.
3. Read the address in a plain text field and find the domain.
4. If there is a short link or a middle address, see the final stop with a redirect checker.
5. Confirm that the final domain is the official one by typing the organization's site yourself.
6. Look up the domain on Google's Safe Browsing site status page.
7. If you are still unsure, do not open the link and contact the organization through an official channel.

Google Safe Browsing offers a status page that shows whether a site currently contains content it considers dangerous. However, a clean result does not prove that a site is safe, because a brand new phishing page may not be on the list yet. So use this step together with the others, never alone.

What should you do if you already clicked?

Stay calm first. A click alone usually does not mean you lost everything. The real risk comes from typing information into the page or from running a downloaded file. So your next steps depend on what you did.

1. Close the page right away and do not type anything into it.
2. If a file downloaded, do not open it. Delete it instead.
3. If you entered a password, change it at once by going to the official site yourself.
4. If you reuse that password elsewhere, change it on those accounts too.
5. Turn on two step verification if the account does not use it yet.
6. If you entered card details, call your bank on its official number.
7. Report the message with your email provider's phishing report option.

We want to be honest here. These steps lower the risk, but no method guarantees a full reversal. Also, never give money or passwords to strangers who promise to "recover your account." Such offers are often a second layer of the same scam.

Why should you check the sender before you trust a link in an email?

Knowing where a link goes often starts with knowing who sent it. Google's Gmail guide recommends checking that the sender name matches the email address and looking at whether the message is authenticated. After all, the display name, just like link text, can be anything the sender wants.

For example, the display name may be a bank's name, while the sender address uses a domain that has nothing to do with that bank. In that case, do not trust the link inside. Moreover, real organizations do not ask for your password by email. Google states clearly that its own emails will not ask you for the password of the account you are signed in to.

In short, the sender address and the link address should tell the same story. If both show the official domain, move on to the next step. If either one differs, report the message without opening the link.

How can a team turn link checks into a shared habit?

At a company, one careless click can reach shared accounts and customer data. So it makes sense to turn link checks into a team rule instead of leaving them to personal skill. In our own work, we also treat asking a colleague before opening a suspicious link as normal behavior.

You can set up a simple routine for your team:

• Forward suspicious messages to one shared channel, so nobody decides alone.
• Always open links about invoices, payments and password resets from the official site.
• Show new hires the address reading method from this guide in their first week.
• Encourage people who clicked by mistake to report it fast instead of blaming them.

The last point matters most. A person who feels ashamed hides the incident, and a hidden incident grows.

How can site owners make their own links look trustworthy?

As users learn to inspect links, your own links need to pass that inspection too. A campaign full of needless middle addresses and unknown short links raises doubt, even when it is legitimate. That is why we suggest these habits to site owners:

• Share links on your own domain where possible, and keep campaign addresses on your site.
• Shorten redirect chains and point A straight to C.
• Use 301 or 308 for permanent moves, and 302 or 307 for temporary ones.
• Keep tracking parameters readable and avoid piling up extra ones.
• Check regularly that the http and www versions of your site end at one address.

According to Google's documentation on HTTP status codes, Google's crawlers follow up to 10 redirect hops by default. They also process the content of the final target, not of the redirecting URL. In other words, long chains strain both user trust and crawling. The four versions mode in our checker lets you test the http, https, www and non www versions of your site at once.

Which method works best in which situation?

Each method has strengths and weak spots. The table below sums up when to use which one.

In practice, using these methods in order works best. The first two take seconds. The rest only come into play when doubt remains.

Example scenario: how do you inspect a link in a parcel text?

Imagine a text message that says "Your parcel could not be delivered, update your address." A short link sits at the end. Let us walk through the steps together in this example scenario.

First, you judge the message. Are you waiting for an order, and which company does the message name? Then you long press the link and copy the address. Because it is a short link, the domain alone tells you nothing. So you paste the address into the redirect checker.

Suppose the tool shows that the short link first goes to a middle address and then to something like "parcel-tracking.example.com". By the domain rule, the real domain is example.com, which is not the official address of any known courier. So you decide without opening the link: you delete the message, report it to your carrier if needed, and check your parcel in the courier's official app.

The main lesson of this scenario is simple. The whole process takes less than a minute, and at no point do you need to open the suspicious page in your own browser.

In short: the habit of checking every link

Knowing where a link goes is not a technical specialty. It is a habit that takes a few seconds. You look at the real address, not the visible text. You read the domain from the right. If there is a short link or a redirect, you see the final stop with a checker. And when you cannot be sure, you do not open it.

At Talha Aslan and team, we care about users and site owners building this habit together. A culture of safe links also helps legitimate sites earn trust more easily. Whenever you want to check the redirects on your own site or a link you doubt, come back to the steps above.

Core guide: What Is Digital Marketing? Its types, examples and how it is done, on one page with an interactive film that travels through the brain.