Before entering an account detail, take a moment to inspect the full address. These steps help you understand where a link goes; they cannot guarantee that a service is trustworthy.
1. Reveal the complete address
Tap the address bar in your mobile browser. If you are inside a messaging app’s built-in browser, use its menu to open the page in your normal browser when that option is available. Menu wording varies by app and version.
2. Separate hostname from path
| Illustrative address | What to notice |
|---|---|
https://example.com/account |
The hostname is example.com; /account is the path. |
https://help.example.com/ |
help is a subdomain of example.com. |
https://example.com.help.example.net/ |
The domain is example.net, despite the familiar text at the beginning. |
https://example.com/?next=other.test |
Text after ? is a query; it is not the current hostname. |
Domain endings can contain more than one label, such as .com.ph. Do not assume the final two labels always identify the registrable domain. The examples above use simple .com and .net endings.
3. Preview an unfamiliar link
Press and hold the link to see its destination where your browser supports this. Do not open a download simply to inspect its name. Shortened links may hide the destination until they redirect, so treat an unexpected link cautiously.
4. Treat certificate warnings as a stop point
A certificate warning can occur when the certificate is expired, does not match the hostname or cannot be validated. Do not enter credentials or bypass the warning to reach a login page. Check the address and the device clock; if the problem persists, contact the site’s verified support.
An encrypted connection is useful, but HTTPS does not prove that the operator is legitimate or authorized.
5. If you already entered information
Change an exposed password through a previously verified route, review sessions and recovery settings, and follow the affected service’s own security instructions. If the password was reused, change it on those other accounts too. Avoid posting the exposed information in a public comment.
Sources
- MDN: What is a URL? — web address structure.
- Google Chrome Help: Check if a site’s connection is secure — connection indicators and warnings.