What's New on ExpandURL

Why link safety matters more than ever

At ExpandURL, our goal has always been simple: help you know exactly where a shortened link takes you before you click it. Today, we're pleased to share a round-up of the features we've built into the platform to make that goal more meaningful than ever.

Shortened URLs are everywhere: in emails, text messages, social media posts and QR codes. Their convenience is also their risk, because by design they hide the destination. Cybercriminals exploit this to disguise phishing pages, malware downloads and scam sites behind innocent-looking links.

ExpandURL was built to close that gap. Paste a shortened link, and we'll do the detective work: revealing the destination, inspecting the page, and flagging anything that warrants a closer look. From detecting phishing forms to inspecting every hop in a redirect chain, here's a detailed look at what ExpandURL now checks for every URL you submit.

Redirect chain inspection

When you click a shortened URL, you rarely go directly to the final destination. Most links pass through one or more intermediate hops, sometimes two or three, sometimes many more. Each hop is a redirect, and each redirect has an HTTP status code, a three-digit number that tells you something about what's happening.

ExpandURL traces the entire redirect chain from start to finish, displaying every URL along the way alongside its status code and a plain-English description of what that code means. Common codes you might see include:

Why does this matter? A chain that passes through several unrelated domains before landing somewhere can be a red flag. Legitimate services tend to have short, clean redirect paths. Seeing a link bounce through four or five different domains before arriving at a login page is the kind of detail that's easy to miss if you just click, and exactly the kind of detail ExpandURL is designed to surface.

Each hop in the chain is displayed with its full URL, status code and a colour-coded badge, so you can assess the chain at a glance.

Connection security (HTTPS check)

Once we've identified the final destination of your link, we check whether that destination uses HTTPS, the encrypted version of the web's standard communication protocol.

When a site uses HTTPS, data travelling between your browser and the server is encrypted. This means your login credentials, personal details and browsing activity on that site cannot easily be intercepted by a third party on the same network.

When a site uses plain HTTP, that protection is absent. Any data you submit (a form, a password, an email address) travels in plain text and could be intercepted.

ExpandURL displays one of two results for every destination URL:

• HTTPS: Secure Connection, meaning the site uses encryption and your data is protected in transit.
• HTTP Only: Not Secure, meaning the connection is unencrypted, so exercise caution before entering any information.

Form detection: our newest safety feature

This is the feature we're most excited to introduce, and it came from a straightforward observation: if someone is suspicious enough about a link to check it on ExpandURL, they should know whether the destination page is going to ask them for information.

Because we already fetch the page source to extract meta information, we can inspect that source for HTML forms, the elements that collect and submit data from users. We've built a detection system that doesn't just flag the presence of a form, but analyses what kind of form it is and how it behaves.

What we look for

• Password fields. Any form containing <input type="password"> is flagged specifically. These are login or account forms, and entering your credentials on an untrusted page is one of the most common ways people get compromised.
• Text and email fields. Forms that collect names, email addresses or other text input are noted. These are common on legitimate sites, but on a page you didn't intentionally navigate to, they warrant awareness.
• Cross-domain form actions. This is the most technically significant check. Every HTML form has an action attribute that specifies where the submitted data is sent. On a legitimate site, this is almost always the same domain as the page itself. On a phishing page, the action often points to a completely different domain, one controlled by the attacker, to capture what you type.

We compare the form's action URL against the domain of the page being inspected. If they don't match, we flag it prominently. For example:

Page address:  https://secure-bank-login.example/verify
Form sends to: https://collector.another-domain.example/save.php   ← different domain: High Risk

How we communicate the risk

Rather than a simple yes or no, we use a tiered system so the message is proportionate to what was found:

The form detection result appears in the main results card, directly below the Connection Security check, so it's one of the first things you see, not something buried at the bottom of the page.

A note on limitations

Because we analyse the static HTML source of the page, forms that are added dynamically by JavaScript after the page loads may not be detected. This is a limitation of any server-side inspection approach. We surface what we can from the raw source, and we always recommend treating an unfamiliar link with caution regardless of the results.

Google Safe Browsing integration

Every URL submitted to ExpandURL is checked against the Google Safe Browsing API, a constantly updated database of known malicious websites maintained by Google.

If a match is found, we display a clear warning along with the nature of the threat. The categories we check for are:

If no threats are found, we display a clear confirmation that the link appears safe according to Google's database. A link to Google's advisory is always included so you can read more about how the Safe Browsing system works.

Meta information and page preview

For every destination URL, ExpandURL also fetches and displays the page's meta information: the data embedded in the HTML that describes the page's content.

Alongside this, we generate a screenshot preview of the destination page using an external rendering service. This lets you see what the page actually looks like before you decide whether to visit it.

The combination of meta information and a visual preview gives you a strong sense of what kind of page you're dealing with, even before you click.

URL parameter analysis

Shortened URLs frequently carry query string parameters (the extra text after a ? in a web address) that are invisible until the link is expanded. These parameters can serve a number of purposes, and ExpandURL categorises each one so you understand what it's doing.

Each parameter is displayed in a table with its name, value and category, along with a plain-English summary of what was found.

Putting it all together

No single check tells the full story of whether a link is safe. A page can have HTTPS and still be a phishing site. It can pass Google Safe Browsing and still have a form that submits your data to a third-party domain. It can look legitimate in a screenshot and still carry tracking parameters designed to profile you.

What ExpandURL provides is a layered view: multiple independent signals that together give you a much clearer picture than any one check alone. Our goal is to give you the information you need to make an informed decision, presented clearly and without requiring any technical knowledge to interpret.

Quick reference: what every check tells you

Wrapping up

ExpandURL is completely free to use. Paste any shortened URL, from bit.ly, t.co, tinyurl.com or anywhere else, and we'll expand it and run all of the checks described above in seconds.

If you remember four things, make them these:

1. ExpandURL shows every hop in a redirect chain, not just the final destination.
2. A form that sends your details to a different domain is a strong phishing warning.
3. HTTPS and a clean Safe Browsing result are good signs, but neither is proof of safety on its own.
4. The checks work best together, so look at the whole results card before deciding.

Check a link now at expandurl.net

ExpandURL is a free service. We do not store the URLs you submit or share them with third parties.