How to Check if a Link Is Safe Before Clicking

To check if a link is safe before clicking, look at the real URL underneath it, read the domain from right to left, expand it if it's shortened, and run anything doubtful through a free scanner such as Google Safe Browsing or VirusTotal. One careless click on a bad link can land you on a fake shop, a phishing page, or a download you never wanted. The good news: almost every dangerous link gives itself away before you click — if you know where to look. Here is a practical routine you can run in under a minute.

Step 1: See the real URL first

Never judge a link by its clickable text. The words on screen can say anything; what matters is the address underneath.

• On a computer: hover your mouse over the link without clicking. The true destination appears in the bottom-left corner of your browser or in a small tooltip.
• On a phone: press and hold the link. A preview of the full URL pops up, usually with options to copy it. Copy it instead of opening it.
• In email: hover as above, and also check the sender's actual address, not just the display name. A message signed "Your Bank" sent from a random webmail address is answer enough.

Step 2: Read the domain the right way

Scammers count on people reading URLs left to right and stopping early. Read the domain — the part just before the first single slash — from right to left instead.

In paypal.com.secure-login.info, the real site is secure-login.info. "Paypal.com" is just a subdomain label anyone can create. The genuine domain is always the last two pieces before the first "/": paypal.com, amazon.co.uk, temu.com.

Lookalike tricks to watch for

• Swapped or extra letters: arnazon, tem-u, paypa1 (with a number one). Zoom in if the font makes letters hard to tell apart.
• Added words: amazon-support.com or temu-outlet.shop are not Amazon or Temu. Big brands sell from their main domain, not hyphenated spin-offs. If a link claims to be a well-known store, compare it against the official domain listed on that store's review page — for example HasTrust's Temu review shows the real address.
• Odd endings: a familiar brand on an unfamiliar ending like .top, .icu or .buzz deserves extra suspicion, especially combined with a huge discount.

Step 3: Expand shortened links

Short links (bit.ly, tinyurl, t.co and similar) hide the destination completely, which is why scammers love them in texts and social posts. Before clicking, paste the short link into a URL expander such as CheckShortURL or add a "+" to the end of most bit.ly links to see a preview page. Once you can see the real destination, run it through steps 1 and 2.

Step 4: Don't trust the padlock alone

The padlock icon (HTTPS) only means the connection is encrypted — it says nothing about who is on the other end. Most fake shops and phishing pages have padlocks too. Treat a missing padlock as a red flag, but never treat its presence as proof of safety.

Step 5: Test the link with free tools

When a link passes the eye test but you're still unsure, let a scanner look at it for you:

1. Google Safe Browsing: search for "Google transparency report site status", then paste the URL to see if Google has flagged it.
2. VirusTotal: paste the URL and dozens of security engines check it at once.
3. HasTrust: if the link came in a suspicious message, paste the whole message into the scam checker and it will assess the link and the wording together. If the link leads to an online store, you can look the shop up on HasTrust to see its trust signals and what other shoppers report.

Step 6: When in doubt, go direct

The single most reliable habit: don't click links in unexpected emails or texts at all. If "your bank", "the post office" or "your favourite shop" says there's a problem with your account or a package, close the message and type the official website address into your browser yourself, or open the company's app. If the alert is real, it will be waiting for you there. If you can't find it, call the number printed on your card or on previous official correspondence — never the number in the message.

How to see if a website or link is safe (and legit)

To see if a website or link is safe, check where it really goes, then check whether security scanners or other people have flagged it. Hover or long-press to reveal the true address, read the domain right to left, and expand any short link first.

Next, paste the address into Google Safe Browsing or VirusTotal, as described in step 5. A clean result is reassuring, but it only means nobody has flagged the site yet — brand-new scam pages often pass these checks.

"Safe to open" and "legit to buy from" are not the same thing. A page can be free of malware and still be a store that takes payment and never ships, so if the link leads to a shop, carry on with the checks in the next section before you pay.

If you're already on the site, the same checks still work. Look at the address bar rather than the page itself, read the domain right to left, and copy the address into a scanner before you type in any login or payment details.

How to check if a website is legit

To check if a website is legit, verify three things before you pay: the real domain (steps 1 and 2 above), a genuine way to reach the company, and what other people say about it. A legitimate shop makes it easy to find out who runs it; a dubious one makes it hard.

• Contact details: look for a real company name, a physical address and a working email or phone number. A "contact" page that offers only a web form — or nothing at all — is a bad sign.
• Prices and pressure: discounts far below every other store, countdown timers and "only 2 left" on every product are classic pressure tactics designed to stop you checking.
• Outside opinions: search the site's name together with the word "reviews", and look the shop up on HasTrust to see its trust signals and what other shoppers report.
• Payment options: prefer shops offering payment methods with buyer protection. A store that only accepts bank transfers, gift cards or crypto leaves you no route to get money back.

If what you have is a link rather than a site, the same routine applies: expand it if it's shortened, read the domain right to left, scan it with the tools in step 5, and only then judge the store behind it.

Checking a specific shop — is a site like mangoly.shop legit, and where are the reviews?

The fastest way to check a specific store — mangoly.shop or any other name you've just come across — is to look its exact domain up on HasTrust and read what other shoppers have reported, alongside the checks above. No single signal proves a shop is honest or dishonest, so weigh several together.

• Read the whole domain: unfamiliar names on endings like .shop deserve the full right-to-left reading from step 2, especially when paired with steep discounts.
• Look for the basics: contact details, a return policy that names a real address, and product photos that aren't obviously copied from other sites.
• Check for reviews in more than one place: a store with no independent reviews anywhere is not automatically a scam, but it does mean you are shopping without a safety net — treat it accordingly.

When you search for reviews, use the exact domain, not just the shop's name. Similar-looking names can belong to completely different stores, so make sure the reviews you read are about the address you're actually on.

Be careful with reviews shown only on the shop's own pages, since the store controls what appears there. Reviews you find somewhere independent carry more weight. If you still can't find enough to feel sure, keep the first order small and pay with a method that offers buyer protection.

How to check if an email address is a scam

To check an email address, read the part after the @ exactly like a link domain: right to left, ignoring everything before the @. The name before the @ can say anything — "support", "billing", a plausible employee name — so only the domain tells you where the mail can really come from.

• Match the domain to the company: genuine companies write from their own domain. A message claiming to be a well-known brand but sent from free webmail or an unrelated domain is a strong signal something is off.
• Search the exact address: put the full address in quotes in a search engine and see if others have reported it. No results doesn't mean safe — new addresses cost scammers nothing to create.
• Test the whole message: paste the complete email, links included, into the scam checker, which weighs the sender, the links and the wording together.

Remember that sender addresses can also be spoofed, so even a correct-looking domain is not a guarantee. If the message asks for money, passwords or personal details, apply step 6: contact the company through its official website or app, never by replying.

Already clicked? Do this now

• Don't enter anything. Opening a page is usually not enough to harm you; typing a password or card number is. Close the tab.
• If you entered a password, change it immediately on the real site, and everywhere else you reused it. Turn on two-factor authentication.
• If you entered card details, contact your bank or card issuer straight away and ask them to block the card and watch for charges.
• If you downloaded a file, delete it without opening it and run a full antivirus scan.
• Report it: forward phishing emails to your email provider's report function and to the impersonated company; report scam texts to your carrier's spam-reporting number if one exists in your country.

Make it a habit

Hover, read the domain right to left, expand anything shortened, and scan anything doubtful. Those four moves catch the vast majority of malicious links. And before you buy from a store you reached through any link — even one that checks out — take a moment to verify the shop itself, because a clean URL can still belong to a store that never ships.