Check Before You Click: Inspecting Link Destinations in Your Browser

Every day, Australians tap through hundreds of hyperlinks in emails from AGL or Telstra, text messages about Australia Post parcels, and search results that promise local bargains on Melbourne Cup specials. Most of the time those links go exactly where you'd expect. Sometimes they don't. The difference between a quick tap and a malware warning can come down to the few seconds it takes to peek under the hood of a link before committing to the click.

Browser developer tools ship with every modern browser and let you see the true destination of any link without actually visiting it. This is handy when a message arrives from "myGov" demanding urgent action, when a friend shares a deal on Kmart outdoor furniture, or when you simply want to know whether that minimalist landing page is hiding a redirect chain that ends somewhere you didn't bargain on.

Why Verifying a Link Matters Before You Click

Australia's eSafety Commissioner and the Australian Cyber Security Centre regularly publish warnings about phishing campaigns that mimic trusted brands. Scamwatch, which sits inside the ACCC, has tracked record losses to text-based scams impersonating Linkt toll notices, Australia Post deliveries, and even the ATO. Many of these scams rely on links that look legitimate at first glance but resolve to a different domain entirely. A URL starting with my.gov.au might, after a couple of hops, land on a server in another country.

The Privacy Act 1988 and the Notifiable Data Breaches scheme place obligations on organisations that handle your personal information, but those protections only kick in once data has already been compromised. The simplest defence is knowing where a link goes before you hand over your driver's licence number or your banking details. Inspecting them takes only a few seconds, and once you learn the technique it becomes a habit as natural as checking the speed limit on a rural highway outside Ballarat.

What Hovering Tells You and What It Hides

The fastest way to see a link's destination is to hover over it. In Chrome, Edge, and Firefox, the true URL shows up in the bottom-left corner of the window. On Safari on a Mac, the destination appears at the top of the screen when you point at a link. This works well for plain text and image links, and it requires no special skill.

The catch is that hovering only shows the immediate target. If the destination is a redirector or a tracking URL, what you see may not be the final stop. A link labelled "View your account" might really go to a shortener or a click-tracking service before bouncing to the actual page. Hovering also fails on elements that aren't traditional hyperlinks, such as buttons built from JavaScript, images wrapped in containers, or links generated when you tap a phone number in a mobile browser.

Inspecting a Link With Right-Click and Dev Tools

When hovering falls short, the next step is to call up the Elements panel in your browser's developer tools. On Windows or Linux, press F12 or Ctrl+Shift+I. On a Mac, use Cmd+Option+I, or right-click anywhere on the page and choose Inspect. The DevTools dock opens, and the DOM tree for the area you selected is displayed.

Right-click the link itself and choose Inspect. The line containing the link will be highlighted in the Elements tab. Look for the href value. That is the genuine destination the browser will fetch if you click. For example, a link that reads "Continue to myGov" in plain English might have an href pointing to the chinans.org parked page, which is a strong clue that the message is suspicious. This method works for ordinary anchor tags, but it also reveals where buttons and div-based clickable elements will take you when JavaScript runs. If the element has an onclick handler instead of an href, the relevant code sits nearby in the DOM and can be read directly without clicking anything.

Following the Journey Using the Network Panel

Some links don't end where you'd expect because they bounce. A "login" button on what looks like the Commonwealth Bank's NetBank portal could route through an analytics service, a regional server, or a chain of three or four redirects before landing on the actual authentication page. To see every step, open DevTools, switch to the Network tab, tick Preserve log, and clear the existing entries.

Then, instead of clicking the link, paste the destination into the address bar but set the page to block navigation, or simply right-click and choose Open in new tab while watching the Network log. Each request the browser makes appears as a row, and you can click each row to see headers, status codes, and the Location field that points to the next hop. This is the only reliable way to follow a redirect chain end to end, and it is the technique security teams at firms like Telstra, Optus, and the big four banks rely on when triaging suspicious messages reported by customers from Brisbane to Perth.

Decoding Shortened URLs and Tracking Parameters

Many emails from retailers and airlines carry marketing parameters. A link to Bunnings' weekly catalogue might look like bunnings.com.au/catalogue but actually include utm_source, utm_medium, and a long session ID. Those parameters are not harmful on their own, yet they leak information about your email address, click time, and device to every party that handles the request.

Bit.ly, t.co, and other shorteners compress those long URLs into something tidy. Hovering shows only the short domain. To peek inside, copy the link, paste it into a service such as unfurlchecker.com or directly into the Network panel of DevTools, and inspect the resolved address. Some Australian news outlets, including ABC News and The Guardian Australia, run their own shorteners, and the link you receive in a push notification often disguises the full path of the article behind an in-house tracking wrapper. Inspecting these reveals the genuine article slug and the actual section of the site the link belongs to.

Built-In Protections and Extensions Worth Enabling

Modern browsers include their own link-checking layers that you can tune up, and a handful of lightweight extensions add another layer for users who want more detail.

Browser features worth switching on:

• Enhanced Safe Browsing in Chrome, which checks URLs against Google's live threat list
• SmartScreen in Microsoft Edge, which blocks known phishing sites
• Phishing protection in Firefox, fed by Google's data
• Safari's Fraudulent Website Warning, available on macOS and iOS

Extensions that add another layer:

• URL strippers that remove utm_source and similar parameters before navigation
• Redirect tracers that list the chain of hops in a small pop-up
• Copy Clean Links, which writes the resolved destination to the clipboard

These tools complement, rather than replace, manual inspection, and they pair well with habits such as bookmarking frequently used sites instead of following links from emails, double-checking the sender's domain on Centrelink or Medicare correspondence, and confirming unusual requests by calling the organisation on a number you have looked up yourself rather than one supplied in the message.

Take a minute today to open DevTools on a page you trust, right-click a familiar link, and read the href. Once the technique feels ordinary, you'll spot the difference between a link to a Coles catalogue and a link to a generic redirect page, between a real minimalist web history article and a clone designed to harvest logins. When you land on a page whose about page is empty and whose main landing page offers nothing but a proceed button, walk away. The few seconds you spend inspecting are far cheaper than the hours you'd spend cleaning up after a breach.