To check URL safety on iPhone and Android before opening a link, you need to verify the address bar, security status, and exact domain before tapping. On an iPhone, Safari shows site security in the page controls, while on Android, Chrome displays a security symbol next to the web address.
How to check URL safety on iPhone and Android before opening a link
The safest way to avoid sketchy sites is to verify the link's destination in your mobile browser before tapping. Scammers often create websites that look identical to legitimate ones but use subtle misspellings or fake security indicators. By checking the connection security and domain name on your device, you can catch these tricks before they steal your login credentials or personal data. The steps differ slightly between iPhone and Android, so follow the instructions for your device.
Verify the website's connection security on iPhone
Safari on iPhone checks whether a site's certificate is legitimate and warns you if it is not. To see the details:
- Open the web page in Safari.
- Tap the left side of the search field (the address bar).
- Tap Privacy & Security.
- Tap Connection Security Details to view the certificate information.
This shows whether the connection is encrypted and whether Safari considers the certificate valid. If the site does not use HTTPS, lacks a digital identity certificate, or does not encrypt information, Safari will show "Not Secure." Always verify the address in the Safari toolbar to confirm it is exactly the site you intended to visit.
Turn on automatic 'not secure' warnings in iPhone settings
On iOS 18.2 or later, you can enable a warning that alerts you before you visit a site with an insecure connection:
- Open Settings on your iPhone.
- Tap Apps, then tap Safari.
- Under Privacy & Security, turn on Not Secure Connection Warning.
Once enabled, Safari will automatically show a warning page when you try to open a website that does not use a secure connection. This adds an extra layer of protection, especially if you are in a hurry and might not check the address bar manually.
Check the security status of a page on Android
Chrome on Android shows a security symbol to the left of the web address. The symbol can be one of three states:
- Default (Secure), a lock icon indicating the connection is encrypted and the certificate is valid.
- Info or Not secure, an "i" in a circle or a "Not secure" label, meaning the connection is not encrypted or has issues.
- Not secure or Dangerous, a red warning label indicating a high-risk site.
To see more details, tap the security icon. Chrome will show a summary of the site's privacy details, cookies and site data, permissions, history of visits, and information about the page. This helps you decide whether to proceed or leave the site. In Chrome on Android, tapping the security icon shows a summary including history of visits and information about the page.
Quickly examine the domain name for tricks
Even if the security indicators look fine, scammers rely on domain name tricks to fool you. Compare the domain in the address bar to the real site's name. Look for subtle misspellings, such as "amaz0n.com" instead of "amazon.com," or wrong domain extensions like ".xyz" instead of ".com." Always confirm the address is exactly what you intended. If the domain looks off, do not tap the link or enter any information.
Frequently Asked Questions
What does the "Not Secure" warning mean on iPhone?
It means the website does not use HTTPS, does not have a valid digital identity certificate, or does not encrypt information sent between your device and the site. You should avoid entering any personal data on such pages.
Can I check a link's safety before opening it on iPhone?
You can long-press a link in Safari or Messages to preview the URL without tapping it. This shows the full address so you can inspect the domain and security status before deciding to open it.
Why does Chrome on Android show "Info" instead of "Secure"?
The "Info" icon means the site uses HTTP instead of HTTPS, or the certificate has minor issues. The connection is not encrypted, so do not enter passwords, credit card numbers, or other sensitive information on that page.
Do these checks protect against all phishing scams?
They catch many scams, but sophisticated phishing sites can have valid HTTPS certificates and convincing domain names. Always combine these checks with caution: if an email or message pressures you to tap a link urgently, verify the sender through a separate channel.
Where can I get phone numbers and calling help for reporting a phishing site?
For phone numbers and calling help, check the Phone Numbers, Calling and Messaging Help section in your device's support app or contact your carrier's customer service. You can also report phishing attempts to the Federal Trade Commission at ReportFraud.ftc.gov.
