Safe URL checker

Safe URL checker is a free tool that checks whether Google marks a submitted URL as safe or unsafe.

What does Google Safe Browsing check?

Google Safe Browsing checks URLs against threat information maintained by Google. It is intended to identify web addresses associated with risks such as phishing, deceptive pages, malware, and unwanted software.

The check concerns the submitted URL and its reputation in Google's data. It is not a live security audit of the website's code, hosting account, or database.

An unsafe result does not necessarily mean that Google has removed the page from search results or that an internet service provider has blocked it. Safe Browsing warnings, Google Search indexing, and network-level blocking are separate systems.

How do I check whether a URL is safe?

Submit the web address and review the result. Include the relevant path when the warning affects a specific page rather than the entire domain.

For example, checking https://example.co.uk/ may not tell you enough about https://example.co.uk/account/sign-in. The homepage and the sign-in page are different URLs and may have different reputations.

The check runs on the server. The URL is sent to the server over HTTPS and is not stored. Avoid submitting private links that contain password-reset tokens, signed download parameters, or other secrets unless you need to check that exact address.

How should I interpret the result?

Read the result as a binary Safe Browsing status for the URL you submitted. The tool returns one of two messages and does not provide a threat category, scan log, or detailed explanation.

A safe result does not validate an HTTPS certificate, test whether DNS resolves, inspect email authentication, or confirm that a download is clean. It also cannot tell you whether a page is asking for information for a legitimate business reason. Check the domain spelling and the page's context along with the returned status.

When a link needs a closer look

A Safe Browsing check is most useful when the issue involves a security warning or a suspicious destination rather than general website availability.

1. A link in an email looks suspicious. Check the exact link without opening it in a browser. If the result is unsafe, do not enter login credentials or payment details. Even if the result is safe, compare the sender's domain with the organization's known website and avoid links that contain unexpected login prompts.
2. A cleaned website still shows a browser warning. Check the affected page and other compromised paths separately. An unsafe result may mean that Google's status has not changed yet or that some infected content remains. Review the hosting files, database, administrator accounts, and third-party scripts before requesting any available review through the relevant Google service.
3. A visitor is redirected to an unfamiliar domain. Check both the original address and the final destination. The Safe URL checker does not report a redirect chain, so use the URL redirect checker to identify each hop before checking the resulting URLs.

If a website does not resolve after a DNS change, this check cannot diagnose nameservers, A records, AAAA records, or DNSSEC. A certificate warning also requires a separate check of the certificate's hostname, validity period, and chain.

Why can a safe or unsafe status take time to change?

A Safe Browsing status can take time to change because Google reassesses its threat data on its own schedule. DNS records, browser caches, and intermediary caches can separately affect what a visitor experiences, but they do not delay the underlying status.

After malicious files are removed, Google may continue to show an unsafe status until its systems revisit or reassess the affected URL. Conversely, a recently compromised page might not appear in the threat data yet. This delay is one reason a safe result cannot be treated as complete security clearance.

DNS propagation can also create confusing differences. After a hosting move, one network may reach the new server while another still reaches the old address. If the old server was compromised, two people entering the same domain could temporarily receive different content even though the URL text is identical.

Browsers may retain warning information or cached pages for a while. Testing in another browser or on another network can help distinguish a local cache from a broader status, but clearing a cache does not remove a genuine Safe Browsing listing. The Google Cache Checker may help when investigating whether an older version of a page is still visible through Google's systems.

Frequently asked questions

Can I check a shortened URL?

You can check the shortened address itself, but that does not automatically explain every destination it may redirect to. Expand the link with a redirect checker, then check the final URL and any unexpected intermediate domains separately.

Can I use this check for localhost or a private company address?

You can run the check, but Safe Browsing is designed around web threats and publicly meaningful URLs, so a result for localhost, an internal hostname, or a private IP address may not be useful. Diagnose those addresses through local DNS, routing, proxy, and server configuration instead.

Should I include tracking parameters in the URL?

Include parameters when they change the destination or content you are investigating, but remove unnecessary analytics tags when possible. Query strings can contain personal identifiers, access tokens, or email addresses, so inspect the URL before submitting it.

What should I do if only one page is marked unsafe?

Isolate that page and examine its files, embedded scripts, forms, and database content. Also inspect nearby paths and recently changed templates because shared code can affect more than one page, even when only one address has been reported. Keep the affected page offline until the cause has been removed. Change access credentials if compromise or credential exposure is suspected or confirmed.