How to read a URL properly

Phishing survives because reading a URL is a skill nobody is taught, and because browsers now hide most of the address by default.

The skill takes a few minutes to learn and does not go out of date.

Where to look

Take an address like:

https://accounts.google.com.security-check.example.net/verify?id=88213

Work from the first single slash backwards. The registered domain is the last two labels before that slash — here, example.net. That is who controls this page. accounts.google.com is a subdomain, and subdomains are chosen freely by whoever owns the registered domain.

Reading left to right is exactly the mistake the address is constructed to invite.

The four parts

https://   shop.example.co.uk   /orders/1421   ?ref=email
scheme     host                 path           query

• Scheme. https means encrypted transit. Nothing more — a phishing site can and usually does have a valid certificate.
• Host. The only part that identifies who you are talking to. Read it right to left.
• Path. Free text chosen by the site owner. example.net/paypal.com/login is a page on example.net.
• Query. Also free text. Frequently used to carry a convincing-looking reference number.

For country domains such as .co.uk or .com.au, the registered domain is the last three labels: example.co.uk. That is the only wrinkle.

The tricks worth recognising

Subdomain stuffing. paypal.com.account-verify.example.org — the real brand appears, in the wrong position.

Hyphenation. paypal-secure.com and secure-paypal.com are unrelated to paypal.com. A hyphen creates a new domain; it does not extend an existing one.

Character substitution. paypa1.com with a digit one, rnicrosoft.com where rn reads as m at small sizes. Compare unfamiliar domains character by character rather than at a glance.

Homograph attacks. Non-Latin characters that render identically to Latin ones — a Cyrillic "а" in аpple.com. Browsers defend by displaying such domains in Punycode, as xn--80ak6aa92e.com. A domain that renders as `xn--` in your address bar is a warning, not a curiosity.

Look-alike top-level domains. example.com and example.co are different owners. So are .com and .cm.

Shorteners. bit.ly/3xK2p tells you nothing until it resolves. Preview the destination — most shorteners expose one by appending + to the link — or simply do not follow shortened links that arrived unexpectedly.

What the padlock does and does not mean

The padlock means the connection is encrypted, so nobody between you and the server can read it. It is a statement about the pipe, not about who is at the other end.

Certificates are free and issued in minutes to anyone who controls a domain, including phishing domains. The overwhelming majority of phishing sites now serve HTTPS. The padlock's absence is a problem; its presence is not evidence.

Where the address is hidden

The address bar is the only trustworthy place to read a URL, and several common situations hide it:

• In-app browsers. Links opened inside a social or messaging app often show a truncated domain or none.
• Mobile browsers hide the path and sometimes truncate long hosts.
• Link text in email. The visible text is decorative; the destination is the href. Long-press on mobile or hover on desktop to see where it actually goes.
• QR codes are addresses you cannot read at all until your camera resolves them. Check the preview before opening.

If you cannot see the full host, you cannot check it. Open the link in a real browser, or better, navigate to the site yourself.

The habit that beats all of this

For anything that matters — banking, tax, deliveries, account security — do not follow the link at all. Type the address yourself, or use a bookmark, or open the app. The message may be genuine; the action it asks for will still be waiting for you when you arrive by your own route.

That habit costs about ten seconds and removes the entire category of problem, which is more than any amount of careful reading can promise.

What is a URL made of?

A URL is an address with four parts, and only one of them says who you are talking to. The scheme describes the transport, the host identifies the server, and the path and query are free text chosen by whoever owns the host.

Reading it correctly means finding the registered domain — the last two labels before the first single slash, or the last three for country domains such as .co.uk.

Which part can be faked?

Five of the six rows are under the attacker's control. The third is the one to read, and it is the one abbreviated interfaces hide.

Where can you not see the address?

• In-app browsers inside social and messaging apps, which truncate or omit it.
• Mobile browsers, which hide the path and shorten long hosts.
• Link text in email, where the visible words are decorative and the destination is the underlying href.
• QR codes, which are addresses you cannot read until your camera resolves them.

If you cannot see the full host, you cannot check it. For anything that matters — banking, tax, deliveries, account security — do not follow the link at all: type the address, use a bookmark, or open the app. See website safety, suspicious links and impersonation.

Reading a URL when it is shortened or hidden

A shortened link tells you nothing until it resolves. Most shorteners expose a preview if you append a + to the address, and link-expander services do the same. An unexpected shortened link is best not followed at all.

The WHATWG URL standard defines how browsers parse these, and the Public Suffix List is what decides where the registered domain ends — the reason example.co.uk takes 3 labels and example.com takes 2.

For anything that matters, the habit beats the analysis: type the address, use a bookmark, open the app. It takes about 10 seconds and removes the whole category rather than requiring you to win an argument with a lookalike domain at 8am. Read the host right to left, ignore everything after the first slash, and treat the padlock as a statement about the pipe rather than about who is at the other end of it.

A short drill

Take 3 addresses you received this week and find the registered domain in each. It takes about 20 seconds once and becomes automatic within a fortnight.

Then check where your browser hides part of a URL — an in-app browser inside a social app, or a mobile address bar — because those are the places where the habit has to be replaced by not following the link at all. A URL you cannot fully read is a URL you cannot check, and no amount of care substitutes for seeing the host.