Are short links safe? How to check one before you click

Freelancers sit on both sides of this: clients send you short links, and you send short links to clients who may hesitate to click them. This page covers how to check one and how to make yours look trustworthy; it belongs to our sharing and presence guides.

How a short link works

When you open a short link, the shortener's server replies with a redirect, an HTTP response whose Location header holds the long address (RFC 9110), and your browser goes there. The short address tells you which shortener made it and nothing about the destination. That's convenient for legitimate links and useful for scammers, because the URL you read is not the URL you land on.

Red flags that a short link is phishing

• You didn't expect the message, or don't have an account with the sender. The FTC says that's a strong sign of a phishing scam.
• Urgency or pressure: "your account will be closed", "payment failed, update now".
• The link leads to a sign-in or payment page. Legitimate companies don't email or text a link asking you to update payment or account details out of the blue, per the FTC.
• The sender's address doesn't match the company or person it claims to be.
• A file-sharing or invoice link from a client, sent from an unusual address or at an odd hour. Check with the client through a channel you already use.

How to see where a short link goes

What to do if you clicked a bad link

1. Don't type anything into the page. Close it.
2. If you entered a password, change it on the real site (typed by hand, not from the email) and turn on two-factor authentication.
3. If you entered card or bank details, call your bank using the number on your card.
4. Report it: forward phishing emails to [email protected] and texts to 7726, and report the attempt at ReportFraud.ftc.gov, as the FTC recommends.
5. Tell the person whose name was used, if the message impersonated a client or colleague.

How to make the short links you send look trustworthy

• Say what the link is in the same message: "Here's the 4-minute walkthrough of the homepage: [link]".
• Send it from an address the client already knows, in a thread they expect.
• Use a short link on your own domain (go.yourname.com) so the address carries your name. See when a branded short domain is worth it.
• Don't send short links to sign-in or payment pages unless the client asked for them; send the full invoice or payment link from your invoicing tool.

Worked example

In SoloWOS

When you create short links with QR codes in SoloWOS, a few names that impersonation links rely on, such as paypal, stripe, google, apple and support, can't be used as slugs. If you turn a link off or it reaches its expiration date, visitors see a page saying the link was turned off by its owner, instead of being sent anywhere. Redirect checks with curl -I resolve without counting as clicks. Short links can also live on your own subdomain on Solo ($15/month) and Team, so clients see your name in the address. SoloWOS doesn't show a public preview page before redirecting. Comparing shorteners? See SoloWOS vs Bitly.