Home / Blog / Check a Link or File Before You Trust It
Security • 8 min read • Updated October 2026

How to Check a Link or File Before You Trust It (2026 Guide)

A friend forwards a link. An email promises a refund if you download a form. A website offers a free version of paid software. Each one takes a single click — and a single click is all a phishing page or a tampered download needs. The good news: you can check almost any link or file in under a minute, for free, right in your browser, before you trust it with your accounts or your computer.

This guide gives you a simple routine: the 10-second look, the free tools that verify a link's real destination, and the file checks that catch tampered downloads. No signup, no software to install.

The 10-second look: read before you click

Most traps fail a careful look. Before clicking any link, hover over it (on a phone, long-press to preview) and read the real address that appears:

If anything feels off at this stage, stop. A legitimate sender will not mind you contacting them through their official website or app instead of their link.

Step 1: Scan the link with a phishing checker

When the 10-second look is not enough, let a tool inspect the address. Our free Phishing URL Checker analyses a link's structure for common phishing patterns — suspicious domains, deceptive subdomains, risky characters and other warning signs — without you having to visit the page at all. Paste the link, read the verdict, and only then decide whether to open it.

This is the single most useful habit in this guide: never open a link from an unknown sender without checking it first. It takes seconds, and it catches the majority of phishing pages, because most of them rely on you not looking closely. Our companion guide, How to Use a Phishing URL Checker, walks through the tool's warnings one by one.

Step 2: Check where the site really lives

Sometimes a link looks plausible but you want more evidence. An IP Lookup reveals the server location and network behind a domain — useful when, for example, a supposed local bank's website is hosted in a country it has no connection to, or a "government" page resolves to an ordinary hosting provider. Location alone never proves a site is fake, but a mismatch with what the site claims to be is a strong reason to pause and verify through another channel.

Also check the site's security headers with our Security Headers Checker. Legitimate, well-maintained websites normally set basic protections; a login page missing them entirely is another small signal that the site may not be what it claims. See How to Check a Site's Security Headers for what each result means.

Step 3: Verify a file before you open it

Downloads need the same discipline as links, especially free software, documents from strangers, and anything that arrived as an email attachment:

Step 4: The "second channel" rule for anything important

For anything involving money, passwords or sensitive information, never trust a single message — verify through a second, independent channel:

This one habit defeats almost every impersonation attack, because attackers can fake a message but they cannot fake the real company's app, phone line or website.

Step 5: If you already clicked or opened it

Do not panic — act quickly and in order:

  1. If you entered a password, change it immediately from the real website (typed by hand, not via the suspicious link), and change the same password anywhere else you reused it.
  2. Turn on two-factor authentication on the affected account. Even a leaked password is far less useful to an attacker once a second factor is required.
  3. If you downloaded something suspicious, do not open it. Delete it, run a full antivirus scan, and if you did run it, consider asking a trusted technician to check the device.
  4. If money is involved, contact your bank at once — the sooner a fraudulent transaction is reported, the better the chance of stopping or reversing it.
  5. Warn the people who might get the same message. If the attack came through a friend's hacked account, tell them through another channel so they can recover it.

The 60-second checklist

Trust on the internet is not about being suspicious of everything — it is about spending sixty seconds verifying the few things that actually matter. Make the checklist a habit and most attacks never get past the first step.

Frequently asked questions

Does a padlock icon mean a link is safe?

No. The padlock only means the connection is encrypted — it says nothing about who runs the site. Phishing pages routinely use encryption too. Always check the domain itself, not just the padlock.

Can a link be dangerous without me downloading anything?

Yes. A phishing page only needs you to type your login details into it, and some malicious pages try to exploit browser weaknesses. That is why checking before you click matters more than scanning after.

Is it safe to paste a suspicious link into a checker tool?

Yes, when the tool analyses the link text rather than opening the page — that is exactly how our phishing checker works. Never paste passwords, private links containing tokens, or personal information into any public tool.

What if a file's hash does not match?

Delete the file and do not run it. A mismatch means the file differs from the developer's published version — it may be corrupted, outdated, or tampered with. Download again from the official source and re-check.

Try the tools: Phishing URL Checker · IP Lookup · Hash Generator · Security Headers Checker

Try it now: Free Link Safety Checker