# Link safety checker

> To check if a link is safe, read the real domain before you click: hover over it or long-press on a phone, and find the part just before the first single slash. If that domain is not the one you expect, do not open it. You can also run a free check of how securely the destination site is set up.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: link safety checker.

## Run the check

- In the browser: https://linksafetychecker.com/ (results shown on the page)
- API: POST https://api.vigilbase.com/tools/v1/agent/tools/security-headers/execute with {"target":"example.com"}

## How to read a link

In https://login.example.com.secure-verify.net/account, the real domain is secure-verify.net, not example.com. Everything before it is a subdomain the owner of secure-verify.net chose. Phishing links rely on people reading only the start.

## Common link tricks

- Lookalike domains with swapped letters (rn for m) or extra words.
- Shortened links that hide the destination. Expand them with a preview service before you open them.
- Links in messages that create urgency: a parcel on hold, an account locked, an invoice overdue.
- QR codes that lead to login pages. Treat them like links in an email.

## What this check does

The Vigilbase check scans the destination site's security setup: HTTPS, headers, exposed files and server configuration. It is not a phishing blocklist. A newly created phishing page can pass basic checks, so the domain test above matters most.

## FAQ

### Is it safe to open a link just to check it?

Opening a phishing page is usually not harmful by itself; entering details or downloading files is. Still, check the domain first and never sign in from a link you did not expect.

### How do I protect my team from phishing links?

Publish DMARC at p=reject so attackers cannot send as your domain, train staff to read domains, and monitor sign-ins. Vigilbase OS watches for risky sign-ins and account changes.

### What should I do if I clicked a phishing link?

If you entered a password, change it everywhere you used it and turn on two-factor authentication. If it was a work account, tell your IT or security team straight away.

## Related

- [Check your domain's email security](https://vigilbase.com/tools/email-security)
- [See Vigilbase OS](https://vigilbase.com/os)
- [Security headers checker](https://vigilbase.com/tools/security-headers)
- [HSTS checker](https://vigilbase.com/tools/hsts-checker)
- [DNSSEC checker](https://vigilbase.com/tools/dnssec-checker)
- [CSP evaluator](https://vigilbase.com/tools/csp-evaluator)
- [Cloudflare checker](https://vigilbase.com/tools/cloudflare-checker)