# URL safety checker

> A URL safety checker tests the website a URL points to. Paste the address below to run Vigilbase's free check of the site's security setup: valid HTTPS, security headers, exposed files and server configuration. Before you visit, also confirm the domain in the URL is the one you expect.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: url safety checker.

## Run the check

- In the browser: https://urlsafetychecker.com/ (results shown on the page)
- API: POST https://api.vigilbase.com/tools/v1/agent/tools/security-headers/execute with {"target":"example.com"}

## The parts of a URL that matter

- Scheme: https:// encrypts the connection. http:// does not.
- Domain: the name just before the first single slash. This is who controls the page.
- Path and query: everything after the domain. Long random strings here are normal and say little about safety.
- @ signs and IP addresses in place of a name are both warning signs.

## Reading real examples

| URL | Who controls it |
| --- | --- |
| https://www.paypal.com/signin | paypal.com |
| https://paypal.com.account-check.net/signin | account-check.net (not PayPal) |
| https://paypa1.com/signin | paypa1.com, with the digit 1 in place of l (not PayPal) |
| https://login.microsoftonline.com | microsoftonline.com (Microsoft's real sign-in domain) |

## What makes a URL unsafe

- The domain imitates a brand but is not the brand's real domain.
- The site behind it has an invalid or mismatched certificate.
- The page asks you to sign in after you arrived from a message, not by typing the address.
- The download starts automatically or the file type does not match what you expected.

## For site owners

If your own URLs fail the check, fix the failed items first: certificate and HTTPS redirects, then exposed files, then headers. A web application firewall such as Vigilbase Shield adds protection in front of the site.

## FAQ

### Does the checker visit the URL?

Yes. It makes ordinary web requests to the site, the same as a browser would, and reports what it finds.

### Is this a phishing or malware blocklist?

No. It checks how securely a site is configured. It does not say whether the people running it are honest.

### Is the URL checker free?

Yes. It runs on vigilbase.com at no cost after a quick email confirmation.

## Related

- [Run the full website security check](https://vigilbase.com/tools/website-security)
- [Check security headers only](https://vigilbase.com/tools/security-headers)
- [Security headers checker](https://vigilbase.com/tools/security-headers)
- [HSTS checker](https://vigilbase.com/tools/hsts-checker)
- [DNSSEC checker](https://vigilbase.com/tools/dnssec-checker)
- [CSP evaluator](https://vigilbase.com/tools/csp-evaluator)
- [Cloudflare checker](https://vigilbase.com/tools/cloudflare-checker)