'Is this link safe?' is one of the top 50 questions typed into Google every single day. The honest answer is: no single check catches everything, but stacking three takes ten seconds and stops almost every consumer-grade phishing attempt cold. Here are the five free methods, in order of speed.
Method 1 — Hover before you click
The oldest trick still wins. Hover over the link (long-press on mobile) and read the URL that appears in the corner of the browser or the tooltip. If the visible text says paypal.com but the URL is paypa1.secure-login.io, you have your answer.
Method 2 — Paste it into the GACS Safe Scanner
The fastest no-sign-up check. Paste the URL into /safe-scanner. GACS runs:
- A lookup against our 250k-entity public scam blacklist.
- WHOIS / domain-age check.
- SSL-certificate analysis.
- On-chain signal check if a wallet address is mentioned anywhere on the page.
- A heuristic content classifier looking for known scam patterns (recovery offers, fake-broker dashboards, drainer-wallet front-ends).
Result in ~4 seconds, free, no account. The GACS browser extension does the same check inline on every link you hover.
Method 3 — Google Transparency Report
Google's Safe Browsing site status tool checks whether the URL is on Google's malware/phishing blocklist. Catches the obvious stuff but lags 24–72 hours behind brand-new phishing.
Method 4 — VirusTotal
Good for files and harder URLs. Paste the link at virustotal.com and you get the verdict from ~90 different security vendors. Slower (~30 seconds) and overkill for everyday phishing checks, but great for unusual or targeted attacks.
Method 5 — The 'open in private window with no autofill' trick
If you absolutely must visit the page, open a fresh private/incognito window with no extensions, no autofill, no logged-in sessions. Even if the page is hostile it can't grab credentials it isn't offered. Close the window immediately when you're done.
What none of these catch
- Targeted spear-phishing with a brand-new domain, valid SSL, copied content, and zero prior reports — gone in 48 hours. The only defence is the hover check + a healthy 'why is this here?' instinct.
- OAuth phishing ('Sign in with Google to continue') where the destination is a real Google login but the *requesting app* is malicious. Always read the consent screen.
- Pages behind login walls that the scanner can't reach — paste the URL anyway; GACS still checks the domain reputation.
What to do if you already clicked
- Closed the tab immediately? You're almost certainly fine. Clear cookies for that domain.
- Entered a password? Change it now on every site that shares it; turn on app-based 2FA.
- Connected a crypto wallet? Move funds out via your hardware wallet immediately; revoke all token approvals at revoke.cash; treat the wallet as burned.
- Sent money? Open the Panic Guide and start the bank-recall workflow.
FAQ — link safety
- *Is a shortened URL (bit.ly / t.co) automatically unsafe?* No — they're used by every newsroom on earth — but they hide the destination. Expand them at unshorten.it before clicking.
- *Does HTTPS mean safe?* No. Scam sites use HTTPS. It only means the connection is encrypted.
- *Can I check a link my mum sent me without bothering her?* Yes. Send her this guide, or paste the link into /safe-scanner yourself.