The fix, in one snippet
curl -sI https://bit.ly/xxxx | grep -i locationIllustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The host is matched against a list of shortening services (bit.ly, t.co, tinyurl.com, ow.ly, is.gd, buff.ly, rebrand.ly, cutt.ly, t.ly, short.io, lnkd.in and branded ones such as amzn.to and youtu.be; goo.gl links stopped resolving in August 2025). The checker then follows the redirect with a safe request that executes nothing and reports the final destination and every hop, so the other phishing checks run against where you would actually land. Severity is low on its own; the destination sets the real result. Limits: some services show an interstitial or block automated clients, in which case the destination is reported as unresolved; the owner of a short link can retarget it later, so the destination seen now is not guaranteed to be the one served tomorrow.
Why it matters
A short link hides both the domain and the path, defeats link scanners that examine only the shortener, and lets the sender change the destination after the message has passed a filter. Shorteners are everywhere in legitimate marketing and social media, which is why the severity is low, but they are also the standard delivery for SMS phishing ("your parcel is held, pay the fee") and for QR codes on posters and invoices, where the user cannot see any URL at all before scanning.
How to fix it
Preview before you visit. Many services support a preview form (bit.ly links show their destination if you append +; TinyURL has a preview subdomain), and pasting the link into the phishing URL checker expands it without visiting. On desktop, hovering shows only the shortener, so do not rely on that. Treat shortened links in unexpected SMS messages as phishing until proven otherwise. If you send links in security-sensitive messages, use your own domain rather than a shortener. Related: redirect chains. Guide: how to spot phishing.
Where this fits
URL shortener hides the destination is check 13 of 13 that the phishing url checker runs under url and phishing indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Top-level domain heavily abused for phishing (low), where the domain ends in a top-level domain that is disproportionately used for phishing and spam, usually because registrations there are free or very cheap. An attacker who has that does not need this, so it is the better use of the same hour.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: URL shortener hides the destination (low severity)
Scanner check id: url-shortenerThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
