What's New on ExpandURL: Smarter Safety Checks for Every Link You Expand

At ExpandURL, our goal has always been simple — help you know exactly where a shortened link takes you before you click it. Today, we're pleased to share a round-up of the features we've built into the platform to make that goal more meaningful than ever.

From detecting phishing forms to inspecting every hop in a redirect chain, here's a detailed look at what ExpandURL now checks for every single URL you submit.

Why Link Safety Matters More Than Ever

Shortened URLs are everywhere — in emails, text messages, social media posts, and QR codes. Their convenience is also their risk: by design, they hide the destination. Cybercriminals exploit this to disguise phishing pages, malware downloads, and scam sites behind innocent-looking links.

ExpandURL was built to close that gap. Paste a shortened link, and we'll do the detective work — revealing the destination, inspecting the page, and flagging anything that warrants a closer look.

Feature Overview

1. Redirect Chain Inspection

When you click a shortened URL, you rarely go directly to the final destination. Most links pass through one or more intermediate hops — sometimes two or three, sometimes many more. Each hop is a redirect, and each redirect has an HTTP status code that tells you something about what's happening.

ExpandURL traces the entire redirect chain from start to finish, displaying every URL along the way alongside its HTTP status code and a plain-English description of what that code means. Common codes you might see include:

• 301 Moved Permanently — the resource has moved to a new address for good
• 302 Found — a temporary redirect, often used by URL shorteners
• 307 Temporary Redirect — similar to 302, but stricter about the request method
• meta refresh — a page-level redirect rather than a server-level one

Why does this matter? A chain that passes through several unrelated domains before landing somewhere can be a red flag. Legitimate services tend to have short, clean redirect paths. Seeing a link bounce through four or five different domains before arriving at a login page is the kind of detail that's easy to miss if you just click — and exactly the kind of detail ExpandURL is designed to surface.

Each hop in the chain is displayed with its full URL, status code, and a colour-coded badge so you can assess the chain at a glance.

2. Connection Security (HTTPS Check)

Once we've identified the final destination of your link, we check whether that destination uses HTTPS — the encrypted version of the web's standard communication protocol.

When a site uses HTTPS, data travelling between your browser and the server is encrypted. This means your login credentials, personal details, and browsing activity on that site cannot easily be intercepted by a third party on the same network.

When a site uses plain HTTP, that protection is absent. Any data you submit — a form, a password, an email address — travels in plain text and could theoretically be intercepted.

ExpandURL displays one of two results for every destination URL:

• HTTPS — Secure Connection — the site uses encryption; your data is protected in transit
• HTTP Only — Not Secure — the connection is unencrypted; exercise caution before entering any information

It's worth noting that HTTPS alone doesn't make a site trustworthy — phishing sites can and do use HTTPS. But a site asking for your personal details over plain HTTP is an immediate warning sign.

3. Form Detection — Our Newest Safety Feature

This is the feature we're most excited to introduce, and it came from a straightforward observation: if someone is suspicious enough about a link to check it on ExpandURL, they should know whether the destination page is going to ask them for information.

Because we already fetch the page source to extract meta information, we can inspect that source for HTML forms — the elements that collect and submit data from users. We've built a detection system that doesn't just flag the presence of a form, but analyses what kind of form it is and how it behaves.

What We Look For

Password fields — any form containing <input type="password"> is flagged specifically. These are login or account forms, and entering your credentials on an untrusted page is one of the most common ways people get compromised.

Text and email fields — forms that collect names, email addresses, or other text input are noted. These are common on legitimate sites, but on a page you didn't intentionally navigate to, they warrant awareness.

Cross-domain form actions — this is the most technically significant check. Every HTML form has an action attribute that specifies where the submitted data is sent. On a legitimate site, this is almost always the same domain as the page itself. On a phishing page, the action often points to a completely different domain — one controlled by the attacker — to capture what you type.

We compare the form's action URL against the domain of the page being inspected. If they don't match, we flag it prominently.

How We Communicate the Risk

Rather than a binary yes/no, we use a four-tier system so the message is proportionate to what was found:

The form detection result appears in the main results card, directly below the Connection Security check, so it's one of the first things you see — not something buried at the bottom of the page.

A Note on Limitations

Because we analyse the static HTML source of the page, forms that are injected dynamically via JavaScript after the page loads may not be detected. This is a limitation of any server-side inspection approach. We surface what we can from the raw source, and we always recommend treating an unfamiliar link with caution regardless of the results.

4. Google Safe Browsing Integration

Every URL submitted to ExpandURL is checked against the Google Safe Browsing API — a constantly updated database of known malicious websites maintained by Google.

If a match is found, we display a clear warning along with the nature of the threat. The categories we check for include:

• Malware — sites known to distribute software designed to damage or gain unauthorised access to your device
• Potentially Harmful Applications — sites distributing apps that exhibit harmful behaviour
• Unwanted Software — sites distributing software that doesn't meet acceptable standards
• Social Engineering — sites designed to deceive users into sharing personal information or taking harmful actions (the technical classification for phishing)

If no threats are found, we display a clear confirmation that the link appears safe according to Google's database. A link to Google's advisory is always included so you can read more about how the Safe Browsing system works.

It's important to understand that Safe Browsing is a blocklist — it catches known bad sites, but a newly created phishing page may not yet appear in the database. This is precisely why the other checks (form detection, HTTPS, redirect chain) provide valuable additional context.

5. Meta Information and Page Preview

For every destination URL, ExpandURL also fetches and displays the page's meta information — the data embedded in the HTML that describes the page's content:

• Page Title — the title as defined by the site
• Meta Description — the summary the site provides for search engines
• Meta Keywords — any keywords the site has declared
• Canonical URL — the URL the site considers its definitive address

Alongside this, we generate a screenshot preview of the destination page using an external rendering service. This lets you see what the page actually looks like before you decide whether to visit it.

The combination of meta information and a visual preview gives you a strong sense of what kind of page you're dealing with — even before you click.

6. URL Parameter Analysis

Shortened URLs frequently carry query string parameters that are invisible until the link is expanded. These parameters can serve a number of purposes, and ExpandURL categorises each one so you understand what it's doing.

We currently identify three categories:

• Tracking parameters — used by advertisers and analytics platforms (such as Google, Meta, and HubSpot) to measure where traffic comes from. Examples include utm_source, fbclid, and gclid. These are very common on legitimate links and don't affect the destination page content.
• Affiliate identifiers — parameters like ref or aff_id that indicate the link owner may earn a commission if you make a purchase after clicking.
• Session and internal values — tokens, nonces, timestamps, and other values used by the site internally. These are normal but worth being aware of, as some can be used to pre-fill forms or identify you to the destination site.

Each parameter is displayed in a table with its name, value, and category, along with a plain-English summary of what was found.

Putting It All Together

No single check tells the full story of whether a link is safe. A page can have HTTPS and still be a phishing site. It can pass Google Safe Browsing and still have a form that submits your data to a third-party domain. It can look legitimate in a screenshot and still carry tracking parameters designed to profile you.

What ExpandURL provides is a layered view — multiple independent signals that together give you a much clearer picture than any one check alone. Our goal is to give you the information you need to make an informed decision, presented clearly and without requiring any technical knowledge to interpret.

Try It Yourself

ExpandURL is completely free to use. Paste any shortened URL — from bit.ly, t.co, tinyurl.com, or anywhere else — and we'll expand it and run all of the checks described above in seconds.

If you're a regular user of social media, email, or messaging apps, it's worth making a habit of checking unfamiliar links before you click. It takes a few seconds and could save you from a great deal of trouble.

Check a link now at expandurl.net

ExpandURL is a free service. We do not store the URLs you submit or share them with third parties.