How do I tell whether a web address is really the site I think it is?

Where the real domain sits in an address, why everything before it can say anything at all, and the lookalike tricks that survive a quick glance.

Difficulty: beginner
Time: 8 min
Read: 3 min
Safety: caution

Short answer

Read backwards from the first single slash. The two parts immediately before that slash are the real site — everything to the left of them can be set to anything, including the name of your bank. So barclays.secure-login.example.com is example.com, not Barclays. The padlock tells you nothing about honesty.

Phishing does not depend on people failing to look at the address. It depends on them looking at the wrong part of it. The address has a fixed grammar, and once you know where the true name lives, most fakes become obvious in a second without any special knowledge.

Safety

The padlock in the address bar means the connection is encrypted, not that the site is honest. Criminals get certificates for their sites in minutes and for free. A padlock on a fake bank page is entirely normal, so it must never be part of how you decide a site is genuine.

Where the real site name sits in a web address

Step by step

Find the first single slash after the site name.In https://www.example.co.uk/accounts/login, ignore the two slashes after https:, and find the next one. Everything before that slash is the address of the machine; everything after it is a path on that machine and is controlled entirely by whoever owns the site.
Read the last two parts before that slash.That is the registered domain. In www.example.co.uk it is example.co.uk. In login.barclays.co.uk it is barclays.co.uk. That is the part somebody had to register and pay for, and it is the only part that identifies the owner.
Ignore everything to the left of it.Subdomains are free and unlimited. hsbc.login.security-check.example.com belongs to example.com. This is the single most exploited fact about web addresses.
Ignore everything after the slash.example.com/hsbc/login/verify is still example.com. A path can say anything at all.
Watch for characters that look alike.A lowercase l against a capital I, rn against m, a zero against an O, a hyphen inserted, .co.uk changed to .com or .co, an extra word added. Read it slowly, letter by letter, particularly on a phone where the address bar truncates.
Do not treat the padlock as a safety signal.It means the traffic is encrypted between you and that server. It says nothing about who owns the server. Most phishing sites have one.
Check the address on a phone deliberately.Mobile browsers shorten the address and hide the start of it, which is precisely what lookalike domains rely on. Tap the address bar to see the whole thing before typing anything.
When in doubt, do not follow the link at all.Type the address yourself, or open the app. Reading addresses well is useful, but not needing to read them is better.

Tips

Shortened links hide the destination completely. Treat any shortened link in an unexpected message as unreadable and therefore untrusted.
An address in an email may display one thing and lead to another. On a computer, hover to see the real destination in the corner; on a phone, press and hold to preview it.
Companies do use unfamiliar domains for marketing and surveys, which is why this check works better as "is this the site I expect" than "does this look official".

Common mistakes

Deciding a site is real because it looks right — The page is a copy of the real one, often a live mirror. Appearance is the one thing the criminal has already perfected.
Reading only the start of the address — The start is free space. The identity is at the end of the host part, immediately before the first single slash.
Trusting a .co.uk to be British and therefore accountable — Registration is cheap and quick, and a domain says nothing about who is behind it or where they are.

Questions people ask

What about addresses with the real name in the middle?

They are almost always fake. Real organisations put their name at the end of the host part: something.barclays.co.uk. Fakes put it at the start or in the path, because those cost nothing.

Is http instead of https a reliable warning?

It is a warning that the connection is not encrypted, and no genuine login page should use it. But https on its own means nothing about honesty.

How do I check a link before clicking on a phone?

Press and hold it. A preview appears showing the destination. Read the two parts before the first single slash.