Are short links safe? What a shortener can and cannot promise

A short link is an unreadable promise. gc.mw/k7Qw could be your bank, a news article, or a credential-harvesting page with your employer's logo on it, and nothing about the string tells you which. That property is the reason short links are useful and the reason they get abused, and no shortener can make it go away.

What a shortener can do is put checks in front of the abuse and give readers a way to look before they leap.

What runs when a link is created

The synchronous checks are the cheap ones, and they run before the link exists.

Only http and https are accepted, which rules out javascript:, data: and app schemes that could be used to launch something the reader did not expect. Private, loopback and link-local addresses are refused, along with host names that resolve entirely to private space — that is what stops a shortener being used as a proxy into somebody's internal network. Links back to gc.mw itself are refused, so nobody can build a redirect chain out of our own codes. And anything on the block list is refused outright.

Then the link is created, and reputation checks start out of band. The destination goes to URLhaus and the Spamhaus domain block list, and to Google Safe Browsing where it is configured. None of that happens on the redirect path, because the redirect path does one cache read and returns.

What runs afterwards, which matters more

A link that is clean at creation and malicious a week later is the normal attack, not the exception. Two things handle it.

Links with real traffic are re-checked on a schedule — above a hundred clicks they come back around regularly rather than being trusted forever. And reports from readers are cheap to file: two independent reports on the same link disable it pending review.

How to check a link yourself

Three techniques, in order of effort.

The plus trick. Add + to the end of a gc.mw link. gc.mw/abcd+ shows the destination's host, the link's status, and — if the owner chose to publish them — its click statistics. Nothing is followed and no click is recorded. Bitly popularised this convention and we kept it because readers already know it.

A link expander. Paste the link into a tool that follows the chain server-side and reports every hop with its status code. You see the final destination without your browser ever contacting it, which matters because the first thing a malicious page does is fingerprint your browser.

A link checker, when you want a verdict rather than a chain: status, TLS certificate, redirect count, whether the chain passes through another shortener, and whether it drops from https to http anywhere.

The signals worth taking seriously

Signal	Why it matters
Chain passes through a second shortener	Nesting shorteners is a technique for defeating previews and filters, not a design choice
A hop drops from https to http	The redirect itself can be tampered with in transit
More than three hops	Sometimes lazy engineering, sometimes cloaking
Certificate issued days ago	Not proof of anything, but phishing infrastructure is usually new
Final host looks like a brand with an extra word	paypal-secure-login.example is the whole attack

Any one of these is a reason to slow down, not proof of malice. Long chains and http hops appear in perfectly legitimate systems that nobody has cleaned up in years.

What we refuse to build

There are features a shortener can offer that make abuse cheaper, and we do not offer them. Custom aliases containing a protected brand name — paypal, hdfc, instagram, government and bank names — are held for review rather than served. Codes that match the app's own paths, gc.mw/login most obviously, cannot be created at all. Deleted codes are retired permanently and never re-issued, so a code that appeared in a phishing message can never later belong to somebody innocent.

And every link page carries noindex, so a short link cannot be used to launder a destination into search results.

The honest summary

A shortener can filter known-bad destinations, respond quickly to reports, and make inspection easy. It cannot promise that an arbitrary URL is safe, because nobody can — a page can change its content after every check.

If a link arrives unexpectedly, from someone you were not already talking to, and it wants a password or a payment, the technique that works is not link inspection. It is opening the site yourself, from your own bookmark, and ignoring the link entirely.