Purlock
API Post and comment link checker

Stop bad links before they're posted.

Send what someone wrote, from your server, and we find every link in it and tell you what to do. It runs on your side, so bots can't skip it.

Get your API key Read the docs

One API call per link found. Text with no links costs nothing.

What you get

What it does for you

  • Finds links people hide

    Full links, ones with no https like bit.ly/abc, and ones disguised like evil[.]com or hxxps://.

  • One clear answer

    Allow, review or block for the whole post, plus the same for each link, so your code stays one line.

  • Follows redirects

    A short link is judged on where it really ends up, and every stop along the way gets checked.

  • Your own rules

    Block short links, file sharing sites or any domain you choose. Save them once, or send them with a request.

  • Doesn't punish new sites

    A link isn't blocked just for being on a new domain, because plenty of real businesses are new.

  • Keeps nothing

    The text is only read for links. We don't save it or log it.

How it works

What it looks like in your code

Your request

POST /v1/shield/text/check

{
  "text": "Claim your prize at https://paypa1-login.example/win"
}

The answer

{
  "action": "block",
  "reason": null,
  "links_found": 1,
  "links": [{
    "url": "https://paypa1-login.example/win",
    "verdict": "suspicious",
    "categories": ["lookalike"],
    "reason": "It looks like paypal, but isn't",
    "action": "block"
  }],
  "checked_at": "2026-11-07T09:00:00.000Z"
}

Good to know

What it can't do

  • It's built on threat lists refreshed daily, so a scam that appeared today may not be listed yet.
  • It catches phishing far better than malware.
  • It only looks at links. It doesn't judge what the text says.

FAQ

Questions, answered

What happens with a wall of links?
More than 20 links comes back as block, with the reason too_many_links, and costs nothing. Most real posts don't have that many.
What should I do with review?
Review means we couldn't fully check a link, or it shows warning signs short of a block. Hold the post for a person, or let it through. That's your call.
Can I allow adult sites?
Yes. They're blocked by default. Send allow_adult: true to let them through.
How is this different from the form script?
The script runs in the visitor's browser and needs no developer, but bots can skip it. This runs on your server, so nothing gets past it.

Related