Is this link dangerous? Was your site hacked?
Free checks for dangerous links, hacked websites, lookalike domains and faked email. Use them here, build them into your app, or let us keep watching for you.
Free, with no account.
Link safety checker
Is this link dangerous? See where it really goes, and whether it's a known scam.FreeAPIAlertsWebsite malware check
Was your site hacked? Find hidden spam, injected scripts and sneaky redirects.FreeAPIAlertsLookalike domain finder
Find domains copying yours, and which of them can send email as you.FreeAPIAlertsEmail spoofing checker
Can someone send email pretending to be you? Find out in seconds.FreeAPISecurity headers checker
Get a grade for your site's security headers, with the exact lines to fix them.FreeAPIAlertsQR code safety checker
Scan a picture of a QR code and see where it really goes before you open it.FreeCookie banner checker
See what loads on your site before a visitor has chosen anything about cookies.FreeAlerts
Why it's different
Built to be useful, and honest about its limits
Finds where a link really goes
We follow short links and redirects to the end, and check every stop along the way, not just the first.
Sees what you can't
Hacked sites often only show spam or redirects to search engines and phones from Google. We look the way they do.
Keeps watching
A clean link can turn bad later. Watch your links, and we re-check every one each day and tell you if one does.
Honest answers
We never say a link is safe. We say what we checked, against which lists, and when, so you can decide.
For developers
Check every link people submit to your app
Made for shorteners, QR tools, link in bio pages, forums and directories. Check them one at a time or 100 at once, save your own rules, and let us re-check them every day.
Your code
const res = await fetch("https://www.purlock.com/v1/shield/links/check", {
method: "POST",
headers: {
authorization: `Bearer ${process.env.PURLOCK_API_KEY}`,
"content-type": "application/json",
},
body: JSON.stringify({ url: linkSomeoneSubmitted }),
});
const { verdict } = await res.json();
if (verdict === "dangerous") rejectTheLink();The answer
{
"url": "https://paypa1-login.example/",
"verdict": "suspicious",
"categories": ["lookalike"],
"final_url": "https://paypa1-login.example/",
"reasons": [{
"code": "pretends-paypal",
"title": "It looks like paypal, but isn't"
}],
"lists": { "checked": true, "updated_at": "2026-11-06T07:00:00.000Z" }
}FAQ
Questions, answered
- What is Purlock Shield?
- It's the part of Purlock that protects people from harm through your website: dangerous links, hacks on your site, lookalike domains, and email sent in your name. The checks are free to run, and each one but the QR and cookie checkers has an API.
- How do I know if a link is safe?
- Paste it into the link safety checker. We check it against lists of known phishing sites, follow it to where it really ends, and look for signs like a domain that imitates a brand or was registered days ago. No tool can promise a link is safe, so we report what we found rather than calling it safe.
- Can I check links people submit to my app?
- Yes. Send them to the link API from your server when someone submits one. It's made for shorteners, QR tools, link in bio pages, forums and directories. You can set your own policy, with categories to block and domains to allow or block.
- How can I tell if my website was hacked?
- Run the website malware check. It reads your page as a visitor, a search engine and a phone arriving from Google, because hacks often hide from the owner. It reads from the outside, so finding nothing isn't proof your site is clean.
- What if you flag my site by mistake?
- Tell us at hello@purlock.com and we'll check by hand, then correct the result. The lists we use can be out of date, and a site that's been cleaned up may still appear for a while.
- Can you keep checking links I've already got?
- Yes. Add them to your watch list, and we compare every one with fresh threat lists each day. If one turns dangerous, we email you, and paid plans can send a signed webhook so your app can take it down by itself.
- What does it cost?
- The tools are free with no account. The API uses your normal monthly calls: 100 free, 5,000 on Individual and 25,000 on Business, with a bulk check using one call per link. You can watch 100 links free, 5,000 on Individual and 25,000 on Business, and the daily re-checks don't use any calls.
- Does it check files?
- Not yet. We'd rather not call a file safe until we can do that properly.
Where the data comes from
Threat lists from Phishing.Database (MIT License, copyright 2018-2025 Mitchell Krog, Nissar Chababy and Phishing.Database contributors) and abuse.ch Feodo Tracker, refreshed daily. Results are automated, can be wrong, and aren't legal or security advice. Think we got something wrong? Email hello@purlock.com.