Webmaster & Network·4 min read

Checking Suspicious Short Links Before You Click

Shortened links hide their destination by design, which is convenient in a social post and dangerous in an inbox. Checking suspicious short links before you tap them takes about five seconds with an expander and removes most of the guesswork from the decision. Instead of trusting that bit.ly address from an unknown sender, you can watch the entire redirect chain unfold on screen, hop by hop, and judge the final domain with your own eyes. Here's the routine, the traps people still fall into, and what each status code along the way is telling you.

Open the tool All insights

Why checking suspicious short links beats gut feeling

The whole attack is the hidden destination.

Phishing crews use shorteners for one reason: the visible link carries no information about where it goes. Your instincts about a URL, the domain, the path, the odd subdomain, have nothing to work with when all you can see is six random characters. Attackers also exploit the fact that reputable shortener domains sail through spam filters that would flag the raw destination.

Expanding the link restores the information asymmetry in your favor. You see the true endpoint, and every intermediate stop, while the sender learns nothing about you. Given that the check costs seconds, the only real question is remembering to do it.

What expanding a link actually does behind the scenes

A server clicks so you don't have to.

When you paste an address into the URL Expander, our server requests it and follows each Location header the responses return, recording every stop until something answers with a final page. The result is a numbered list of hops with status codes, ending in the true destination. You get the preview before you click, and your browser never contacts any of the servers involved.

That last part is the security win. No page loads on your device, no JavaScript executes, and the shortener logs a request from our infrastructure rather than your IP and browser fingerprint.

A worked example: unshortening a two-hop chain

Marketing links rarely travel alone.

Input: a promotional link like https://bit.ly/3xAmpl3 gives a chain of three entries. Hop 1 answers 301 and forwards to a click-tracking domain such as track.emailplatform-metrics.com. Hop 2 answers 302 and forwards again, this time to https://shop.example.com/deal. The final entry shows 200, meaning a real page lives there, and the highlighted card at the top reads shop.example.com as the destination.

Reading it takes seconds: two intermediaries saw the click, the landing page is the retailer you expected, and nothing en route looks improvised. Had the final domain been shop-example-deals.xyz instead, that same ten-second read would have been the whole defense.

Redirect chains behind short urls, read hop by hop

Each hop is a fact about who's involved.

The redirect chains behind short urls tell you more than the destination. A 301 hop is a permanent forward, typical of the shortener itself; a 302 is temporary, common for trackers that vary the target per campaign. A long chain through several analytics domains means several companies log each click. A chain ending in 404 or 500 means the link is simply dead, which is routine for short links more than a few years old.

Pay particular attention to the second-to-last hop. Legitimate campaigns route through recognizable marketing platforms; phishing chains often pass through freshly registered domains with random names, and that pattern is visible at a glance in the hop list.

Mistakes people make when vetting shortened links

Expanding a link helps only if you read the output carefully:

Skimming the final domain. Lookalikes such as paypa1.com or arnazon.com survive a glance; read the destination character by character.
Treating a 200 as an endorsement. The status only means a page exists, and phishing pages return 200 like everything else.
Judging by the link's display text. The words in an email are unrelated to the underlying href; only the expanded chain is evidence.
Clicking first and checking after. Once the page loads, scripts have already run; the entire value of the habit is in the order.

Habits that make link inspection automatic

First, set a personal rule tied to context: any short link that arrives by email, SMS, or DM from outside your contacts gets expanded before it gets clicked. In-feed links on platforms you trust are lower stakes; unsolicited messages are the attack surface.

Second, when the chain reveals a tracker sandwich, copy the final URL from the last hop and visit that directly, skipping the intermediaries and their logging. Third, expand your own published short links occasionally; a hop you didn't create appearing in the chain is an early warning that something upstream, like a domain redirect, has changed.

URL Expander or Redirect Chain Checker: two jobs, one trace

Both tools follow redirects, but they answer different questions. The Redirect Chain Checker in the SEO category is for auditing your own site: hunting chained 301s that waste crawl budget and checking that old URLs land where they should. The URL Expander answers a personal safety question about a link someone sent you, with unshortening as the whole point.

Two neighbors round out the workflow. The HTTP Status Codes reference explains any unfamiliar code a hop returns, and the URL Shortener is the mirror image, creating short links whose chains you can then verify here end to end.