When you check a link on LinkCheckNow, you get three things: the path the link takes, the final address, and a list of what stands out. This guide explains each part so you can make a confident decision.
The path: numbered steps
Each numbered step is one address the link passed through. Our server requested it and recorded the reply. The small label under each address tells you what happened:
| Label | Meaning |
|---|---|
| 301 Moved permanently / 308 Permanent redirect | The server said "this address has moved for good, go here instead". |
| 302 / 307 Temporary redirect | The server said "go here for now". Very common in short links and tracking links. |
| Page refresh redirect | The page loaded but immediately forwarded visitors to another address. Some shorteners and older sites do this. |
| Link shortener | This step belongs to a known short-link service such as bit.ly or tinyurl.com. |
| 200 OK · final destination | A page was found here. This is where the link really ends. |
| 404 Not found / 410 Gone | The final page doesn't exist (any more). The link is broken or was taken down. |
| 403 Forbidden / 429 Too many requests | The site refused our automated visit. That doesn't mean it's unsafe, just that we couldn't see the page. |
| Could not connect / took too long | The site didn't answer. It may be offline or blocking automated checks. |
| Raw IP address, not visited | The link points to a number like 203.0.113.5 instead of a name. We don't visit these, for safety. |
Most ordinary links have one or two steps. Ads and newsletters often have three or four, because the click passes through tracking services. Scam links sometimes bounce through several unrelated sites to hide their destination.
The final address
This is the most important line. Read the domain name, the part just before the first single slash, and ask: is this the real, familiar website of the company the message claims to be from? We also show:
- The page title, the name the page gives itself. A title like "Sign in to your account" on an unfamiliar domain is a classic phishing combination.
- When the website was registered, from public domain records. Established companies have domains that are years or decades old.
Use Copy final address if you want to keep it, share it or open it later. We never open it for you.
What stands out
These notes are facts we noticed, in three colours:
- Amber: worth your attention. These are patterns often seen in scams: look-alike names, brand names on someone else's website, very new websites, raw IP addresses, address tricks, long redirect chains, insecure pages and direct file downloads.
- Grey: good to know, but usually harmless on its own: link shorteners, tracking codes, a fairly new website, an inexpensive domain ending, or a page that might forward visitors with JavaScript.
- Green: nothing unusual stood out.
What each amber note means
- Look-alike name: the site name resembles a well-known brand with swapped characters (like
paypa1). Treat as a strong warning. - Brand name on another site: a brand appears in the address, but the real website is something else, like
apple.com.verify-id.top. - Registered recently: the final website is under 30 days old. Legitimate new sites exist, but banks, couriers and governments don't send you to them.
- Raw IP address: real businesses almost never link to a bare number.
- "@" or encoded characters (xn--): tricks that can disguise the real destination.
- Long redirect chain or a loop: unusual routing that's worth a closer look.
- Not secure (http): never enter passwords or card details on it.
- Downloads a file: only open downloads you were expecting.
Why we don't say "safe" or "dangerous"
No link checker can know for certain whether a page is safe. A scam page set up an hour ago won't be on any blocklist yet, and some perfectly legitimate pages share features with scams. A big green "SAFE" stamp would sometimes be wrong, and that's when it would do the most harm. So we show you what we found, explain it, and leave the decision with you.
A green result means we didn't spot common warning signs. It's a good sign, not a guarantee. If a message asks you to log in, pay or confirm personal details, the safest move is still to go to the company's official app or website yourself.
Limits of the check
- We follow up to 10 redirects, the same limit many search engine crawlers use.
- We can't follow redirects done with JavaScript. When the final page seems to use one, we say so.
- Some sites show different content to different visitors, by country, device or time. Scam sites sometimes hide from automated checks, so a harmless-looking result for a suspicious message deserves extra caution.
- Domain age comes from public registration records, which aren't available for every domain ending.
Want to learn the warning signs yourself? Read how to spot a fake link.