Sharing links safely

How to reduce phishing risk with shortened links and how to check a suspicious one.

Why shortened links carry risk

A short link hides its destination. That is precisely the feature, and precisely the problem. The judgement people normally apply — reading the domain before clicking — stops working, because every link looks like it belongs to the shortener rather than to whoever actually controls the page at the other end.

This makes shorteners attractive to phishing operations. The defence is not to avoid short links, which are genuinely useful, but to know how to inspect one and to understand what a responsible service does on its side.

How to check a link before opening it

Expand it without visiting. Several free services will show you where a short link resolves without loading the destination. Paste the link there rather than into your address bar.

Look at the final domain, not the path. Phishing pages routinely put a trusted brand name in the path or subdomain: example.com.login-verify.xyz is not example.com — the real domain is always the last two labels before the first slash.

Be sceptical of urgency. Nearly every phishing message combines a hidden link with time pressure: an account will be closed, a package cannot be delivered, a payment failed. Urgency exists to stop you checking.

Never enter credentials on a page you arrived at through a link. If a message claims to be from your bank, close it and type the bank's address yourself. This single habit defeats most credential phishing regardless of how convincing the page looks.

What a responsible shortener does

Not all of the burden belongs to the visitor. A service can reduce abuse structurally, and it is fair to expect it to.

• Restrict what can be shortened. This service accepts only public HTTPS addresses on standard ports. Private network addresses, loopback, embedded credentials and non-standard ports are refused, which blocks a whole family of attacks that use a shortener to reach internal systems.
• Use temporary redirects. A 302 is not cached, so when a link is closed it stops working immediately rather than surviving in browser caches.
• Expire abandoned links. A link nobody uses is a liability. Anonymous links here last days, and free-account links stay open only while they are genuinely being visited.
• Accept and act on reports. There is a reporting form on every page, reports reach a moderator, and the reporter gets a written answer when the case is closed.
• Keep an audit trail. Every moderation action is recorded with who did it and why, so decisions can be reviewed later.

If you are the one sharing

Tell people where the link goes. A short link next to the words "our spring catalogue on example.com" removes the ambiguity entirely and costs you nothing.

Do not shorten links that carry a session token, a password reset or anything else that grants access. Short codes are guessable in bulk, they end up in analytics and referrer headers, and they are frequently forwarded. Anything that acts as a key should travel as the full URL, to one person, through a channel you trust.

Prefer a service that lets you close a link afterwards. If you find out tomorrow that you shared the wrong page, being able to shut it down is worth more than any other feature.

Reporting abuse

If a link on this domain points somewhere harmful, use the abuse form linked in the footer of every page. Include the short code and a short description of what you found. Reports are reviewed by a person, the link is closed if warranted, and if you leave an email address you will receive an explanation of what was done.