Check if a Link Is Safe

Before you click a link, download a file, or add a URL to your website, it pays to know whether that link is safe. A link safety check tells you if a URL leads to malware, phishing, or a site on a known blocklist. This guide explains how to check any link for free, how to read the results, and what to do when a link, including one on your own site, comes back flagged.

What checking if a link is safe actually means

When a tool tells you a link is safe or unsafe, it is comparing that URL against databases of known threats and, in some cases, actively scanning the page. Safe generally means the URL is not currently listed for hosting malware, attempting to steal credentials through phishing, or distributing unwanted software. Unsafe means at least one of those signals was found.

It helps to understand what sits behind a URL. A link is just an address pointing at a resource, and the server responds with an HTTP status. A working page returns 200, a missing one returns 404, as documented by MDN's reference on the 404 status code. A safety checker goes beyond that status to judge the reputation and content of the destination.

Free tools to check if a link is safe

1. Google Safe Browsing site status: paste any URL into Google's Safe Browsing site status tool and it reports whether Google currently considers the site dangerous. This is the same protection built into Chrome and other browsers.
2. VirusTotal: enter a URL and it checks the address against dozens of antivirus engines and blocklists at once, then shows how many flagged it. It is free and gives a broad second opinion.
3. Your browser's built in protection: modern browsers warn you before loading a known dangerous page. Keeping the browser updated is itself a free safety layer.

Run a suspicious link through two of these rather than one. If Safe Browsing is clean but several engines on VirusTotal flag it, treat the link with caution. Our link safety checker guide and virus link checker guide cover these workflows in more depth.

How to read the results

A clean result is reassuring but not absolute. Blocklists update after a threat is discovered, so a brand new malicious page can be live for a short time before it is listed. Conversely, a flagged result is a strong warning: do not proceed unless you have a clear reason to believe it is a false positive, such as a legitimate site that was briefly compromised and has since been cleaned.

Warning signs to watch for by eye

Tools help, but your own judgment is the first line of defense. Be suspicious when you see:

• Lookalike domains that swap or add characters to imitate a known brand.
• Links inside unexpected emails or messages urging urgent action.
• Shortened URLs that hide the real destination. Expand them before clicking.
• Pages asking for passwords or payment details that you reached from a link rather than by typing the address yourself.
• A padlock that is missing, though note that HTTPS alone does not prove a site is honest, only that the connection is encrypted.

On desktop, hover over a link to preview its true destination in the status bar before clicking. That single habit prevents a large share of phishing mistakes.

What to do if a link on your own site is flagged

If a safety tool flags one of your own pages, act quickly, because the warning scares away visitors and can suppress your search visibility. Work through this order:

1. Confirm the problem: check Google Search Console's Security Issues report, which tells you if Google detected hacked content, malware, or social engineering on your site.
2. Find the malicious code: scan your files and database for injected scripts, unfamiliar redirects, or new admin accounts. Compromises often hide in recently modified files.
3. Clean and patch: remove the malicious content, update your platform and plugins, and change all passwords. Fixing the symptom without closing the entry point invites reinfection.
4. Request a review: once clean, use Search Console to request a security review. Google rechecks the site and, when satisfied, removes the warning.

While you are auditing, also check for ordinary problems that hurt trust and rankings, such as broken links and dead pages. Our broken link checker guide and URL checker guide help you keep the rest of your links healthy.

Safe habits that prevent problems

Extend the same care to the links you publish. Linking out to a site that later turns malicious reflects on you, so periodically re check the external links in your important pages. A general link checker makes that routine quick.

Frequently asked questions

How can I check if a link is safe for free?

Paste the URL into Google Safe Browsing site status to see if Google considers it dangerous, and into VirusTotal to check it against dozens of antivirus engines and blocklists at once. Using both gives a broad, free assessment before you click.

Does a clean result mean the link is completely safe?

Not permanently. A clean result means no known threat was found at that moment. Blocklists update only after a threat is discovered, and legitimate sites can be hacked later, so treat a clean check as reassuring but stay cautious with unfamiliar or unexpected links.

Is a link with HTTPS and a padlock always safe?

No. HTTPS only means the connection is encrypted, not that the site is honest. Phishing pages can use HTTPS too. Always check the actual domain for lookalike spelling and never enter credentials on a page you reached from an unexpected message.

My website was flagged as unsafe. How do I fix it?

Check Search Console's Security Issues report to confirm the problem, then find and remove the malicious code, update your software, and change all passwords to close the entry point. Once the site is clean, request a security review in Search Console to remove the warning.

How do I safely check a shortened link?

Do not click it blind. Expand the shortened URL first using a link expander or by pasting it into a safety scanner that reveals the final destination, then run that destination through Safe Browsing or VirusTotal before deciding whether to visit.