Webmaster & Network·4 min read

Checking Suspicious Short Links Before You Click

Short links hide their destination by design, which is handy in a social post and risky in an inbox. Checking a suspicious link before you tap it takes about five seconds with an expander and removes most of the guesswork. Instead of trusting a bit.ly address from an unknown sender, you can watch the whole redirect chain on screen, hop by hop, and judge the final domain yourself. Here is the routine, the traps people still fall into, and what each status code along the way is telling you.

Open the free URL Expander All insights

Why expanding a short link beats gut feeling

The whole trick is the hidden destination.

Scammers use shorteners for one reason: the visible link says nothing about where it goes. Your instincts about a URL, the domain, the path, the odd subdomain, have nothing to work with when all you see is a few random characters. Well-known shortener domains also pass spam filters that might flag the raw destination.

Expanding the link gives that information back to you. You see the real endpoint and every stop on the way, while the sender learns nothing about you. The check costs seconds, so the only real challenge is remembering to do it.

What expanding a link actually does

A server follows it so you do not have to.

Paste the address into URL Expander and press Expand. Our server requests it and follows each redirect, up to 10 hops, recording every stop until a final page answers. You get the final destination, the number of redirects, whether it uses HTTPS, and a numbered chain with each hop's status code. Our server also reads the destination page's title and description, so you can see what the page claims to be without opening it, and safety hints flag signs such as a domain registered only days ago.

Your browser never loads the page, so nothing on it can run on your device. The shortening service sees a request from our server rather than your IP address and browser, though some services may still count it as a click. If a chain is still redirecting after 10 hops, the tool warns that it may be a loop.

A worked example: a two-hop marketing link

Marketing links rarely travel alone.

Expand a promotional link like https://bit.ly/3xAmpl3 and the chain has three entries. Hop 1 answers 301 and forwards to a click-tracking domain such as track.emailplatform-metrics.com. Hop 2 answers 302 and forwards to https://shop.example.com/deal?utm_source=email&fbclid=abc. The final entry shows 200, meaning a real page lives there. The destination preview shows the shop's page title, and a Clean link box offers the same address with the utm and fbclid tags removed.

Reading it takes seconds. Two intermediaries saw the click, the landing page is the retailer you expected, and the title matches what the message promised. Had the final domain been shop-example-deals.xyz instead, that same quick read would have been your whole defence.

Reading the redirect chain hop by hop

Each hop tells you who is involved.

The chain tells you more than the destination. A 301 hop is a permanent forward, typical of the shortener itself. A 302 or 307 is temporary, common for trackers that vary the target per campaign. A long chain through several analytics domains means several companies log each click. A chain ending in 404 or 500 means the link is dead, which is routine for short links more than a few years old. Links posted on X are wrapped in t.co, so a shared bit.ly link shows two redirects before the real page.

Pay attention to the hop just before the destination. Legitimate campaigns route through recognisable marketing platforms, while phishing chains often pass through unfamiliar domains with random names. The chain itself covers HTTP redirects. If the destination sends visitors on with a meta refresh or a simple JavaScript redirect, the tool points it out and offers to expand that next link as well.

Mistakes people make when vetting short links

Expanding a link helps only if you read the result carefully:

Skimming the final domain. Lookalikes such as paypa1.com or arnazon.com survive a glance, so read the destination character by character.
Treating a 200 as approval. The status only means a page exists, and phishing pages return 200 like everything else.
Trusting the page title alone. A title is easy to fake. Use it to check the page matches the message, not to prove the site is genuine.
Judging by the link text. The words in an email have nothing to do with the real link behind them. Only the expanded chain is evidence.
Clicking first and checking after. Once the page loads, its scripts have already run. The value of the habit is in the order.

Habits that make link checking automatic

First, set a rule tied to context. Any short link that arrives by email, SMS or direct message from outside your contacts gets expanded before it gets clicked. Links in feeds on platforms you trust are lower stakes. Unsolicited messages are where the risk sits.

Second, when the chain passes through trackers, copy the address from the Clean link box and open that directly, skipping the intermediaries and their logging. It also gives you a tidy URL to share or bookmark. Third, expand your own published short links now and then. A hop you did not create appearing in the chain is an early warning that something upstream has changed.

URL Expander or Redirect Checker

Two jobs, one trace.

Both tools follow redirects, but they answer different questions. Redirect Checker, in the SEO tools, is for auditing your own site: finding chained 301s, stray 302s and extra HTTPS or www hops, and checking that old URLs land where they should. URL Expander answers a personal safety question about a link someone sent you.

Two neighbours complete the workflow. The HTTP Status Codes List explains any unfamiliar code a hop returns, and URL Shortener is the mirror image, creating short links you can then check here end to end.