---
title: "What you can check about a link before opening"
url: "https://lookvalid.com/blog/security/link-safety-checks-before-you-click.md"
canonical_url: "https://lookvalid.com/blog/security/link-safety-checks-before-you-click"
last_updated: "2026-10-22"
type: "conceptual"
summary: "The parts of a URL you can inspect without visiting it, and exactly what the link-safety check covers: one published list of malicious domains."
related: ["https://lookvalid.com/products/link-safety.md", "https://lookvalid.com/tools/is-this-link-safe.md", "https://lookvalid.com/products/domain-age.md", "https://lookvalid.com/docs/api/link-safety.md"]
---

# What you can check about a link before opening

The parts of a URL you can inspect without visiting it, and exactly what the link-safety check covers: one published list of malicious domains.

A URL tells you more than it first appears to, and you can learn several things about it without ever fetching the page. Some of those checks are cheap string work, some need a lookup, and one needs a list of domains that people have already reported. This post separates them, and states plainly what our link-safety product does and does not do.

## Read the URL itself

A URL begins with a scheme, and its authority part has the shape `userinfo@host:port`, where the userinfo and port are optional [1]. The part that decides where a click goes is the host, which sits after any userinfo. The same standard warns that because userinfo is rarely used and appears before the host, it can be used to build a link meant to mislead a person: the text before the `@` can look like a trusted hostname while the real host is something else [1].

- Scheme: only `http` and `https` links are worth checking as web links. Anything else is a different kind of action.
- Userinfo: a `name@` before the host is a reason to look twice.
- Host: read it right to left. The registered domain is the last two or three labels, not the first words.

## Redirect chains hide the destination

A short link or a tracking link usually answers with a redirect rather than a page. HTTP defines a family of redirect responses: 301 says the target resource has been assigned a new permanent URI, and 302 says it resides temporarily under a different URI [2]. The new address arrives in a `Location` header, so the page you land on can be on a different domain from the link you were sent.

Following a chain means making requests to each hop, which is an active step, so we do not do it in the link-safety product. If you need to follow redirects, do it in a sandbox with a request limit, and run the host of every hop through a check.

## Registration facts and known-bad lists

Two lookups need no visit to the page. The first is the domain's registration record: RDAP returns events such as `registration` (the object was initially registered) and `expiration` [3]. A domain registered a few days ago deserves more caution than one that has existed for years; the [domain age product](https://lookvalid.com/products/domain-age.md) runs that check.

The second is a list of domains that have already been reported as malicious. The CERT Polska Warning List is one: a continuously updated list of dangerous websites, aimed at phishing domains, maintained by CERT Polska, which is part of NASK [4]. Domains stay on it for six months, the list may be used for any purpose including commercial use, and attribution is not required [4].

Pre-click checks and how to run each

| Check | Needs a visit to the page | How |
| --- | --- | --- |
| Scheme, userinfo, host | No | Parse the URL |
| Redirect chain | Yes, one request per hop | Follow `Location` headers with a limit |
| Domain registration age | No | RDAP lookup, or the domain-age product |
| Listed as malicious | No | Look the domain up in a published list |

## What our link-safety check does

The `link-safety` product takes a URL, requires it to be `http` or `https`, and checks its host and parent domains against one source: the CERT Polska Warning List. It matches at domain level, so the path is not examined, and it does not fetch the page or follow redirects. The response reports a `listed` or `not_listed` verdict, which feeds were checked with their data date and licence, and any feed that could not be read.

A `not_listed` result is not a safety rating. The list holds only domains that have already been reported, and a listed domain can be a compromised site that is now clean. Treat the result as one signal next to the checks above.

Check a URL against the list

```bash
curl -X POST https://YOUR_API_HOST/v1/link-safety \
  -H "Authorization: Bearer $LOOKVALID_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com"}'
```

Excerpt of a captured example response for https://example.com

```json
{
  "host": "example.com",
  "verdict": "not_listed",
  "matches": [],
  "feeds_checked": [
    { "id": "cert-pl-warning-list", "name": "CERT Polska Warning List of malicious domains", "matched": false }
  ],
  "feeds_unavailable": []
}
```

## A pre-click routine

1. Parse the URL and reject any scheme other than `http` or `https`.
2. Flag userinfo before the host.
3. Send the URL to the link-safety check and branch on `verdict`.
4. Check the registration age of the host and hold young domains for review.
5. Open anything that is still unclear only in an isolated browser.

You can try the check without a key in the free [link safety tool](https://lookvalid.com/tools/is-this-link-safe.md), then wire the same lookup into your own flow from the [link safety product page](https://lookvalid.com/products/link-safety.md).

## Sources

1. [RFC 3986: Uniform Resource Identifier (URI) Generic Syntax](https://www.rfc-editor.org/rfc/rfc3986.html), read 2026-10-19
2. [RFC 9110: HTTP Semantics, redirection status codes](https://www.rfc-editor.org/rfc/rfc9110.html), read 2026-10-19
3. [RFC 9083: JSON Responses for the Registration Data Access Protocol (RDAP)](https://www.rfc-editor.org/rfc/rfc9083.html), read 2026-10-19
4. [CERT Polska Warning List of malicious domains](https://cert.pl/en/warning-list/), read 2026-10-19

By LookValid engineering. Published 2026-10-19, updated 2026-10-19.

## Related

- [Link Safety Check API](https://lookvalid.com/products/link-safety.md)
- [Free link safety checker](https://lookvalid.com/tools/is-this-link-safe.md)
- [Domain Age API](https://lookvalid.com/products/domain-age.md)
- [Link Safety Check reference](https://lookvalid.com/docs/api/link-safety.md)