Security & safety checks

A short link hides its destination, so the platform behind it has to be trustworthy. Here is exactly what runs on every link we create and every redirect we serve.

1. Automatic pre-redirection malware check

Every destination URL is screened before a visitor is forwarded. On creation, the target is submitted to our reputation pipeline (a VirusTotal-compatible scanning mock in this build) and the verdict is cached for 24 hours.

If any engine flags the destination for phishing, malware or unwanted software, the redirect is halted and an interstitial warning page is shown instead. Links flagged twice are permanently disabled and their analytics frozen for review.

2. How password-protected links work

Access keys are never stored in plaintext. We keep a salted hash and compare it at redirect time, so nobody — including us — can read your key back.

A successful unlock issues a short-lived, link-scoped session cookie. The visitor can follow the same link again for the rest of the session without re-entering the key, while every unlock attempt is rate-limited and logged in your analytics feed.

3. HTTPS encryption & WAF protection

All traffic is served exclusively over TLS 1.3 with HSTS enabled; plaintext HTTP requests are upgraded before any redirect logic runs.

A Cloudflare-fronted web application firewall filters injection attempts, credential stuffing and volumetric abuse at the edge, and per-IP rate limits keep automated scraping away from your click data.

4. Anti-bypass: no nested shorteners

Chained short links are the most common way to smuggle a malicious destination past a scanner. We refuse them outright.

URLs whose host belongs to a known shortening service — bit.ly, tinyurl.com, t.co, is.gd, cutt.ly, rebrand.ly and hundreds more — are rejected at creation time with a clear error. Redirect chains are also followed at scan time, so a clean-looking host that forwards into a shortener is caught too.