The greatest benefit of a short link — hiding the destination — is also its greatest risk. Users cannot tell where they are going. This piece covers practical controls for both sides: the people clicking and the people creating.

Why attackers like short links

  • The domain is hidden. Instead of secure-yourbank-login.xyz, a familiar shortener domain appears.
  • They evade filters. A blacklisted address is not recognisable at first glance once shortened.
  • Chains can be built. Several hops lead to the malicious page; each hop complicates analysis.
  • Clicks reveal information. Even a single click yields IP, device and timing data.

For users: before you click

1. Question the context

The question that comes before any technical check: was I expecting this? An unexpected delivery notification, an "your account will be closed" warning, or a "check this out" from someone you do not know is suspicious regardless of the address.

2. Preview it

Many shorteners expose the destination when you append a marker to the address. A general method is to paste the link into a link-expander service. Corporate email systems usually do this automatically.

3. Be wary of credential prompts

If a link takes you straight to a login screen, stop. Always reach your bank, email or corporate account by typing the address yourself. No legitimate organisation forces you to enter a password via a link.

4. Treat urgency as a warning

"Within 24 hours", "your account will be deleted", "final notice" exist to stop you thinking. Urgency is the most consistent marker of phishing.

For organisations: when creating links

Destination validation

Any system generating short links must validate the destination before storing it. The checks lnkz.tr applies:

  • Only http and https are accepted. javascript:, data: and file: are rejected.
  • Local network addresses (localhost, 10.x, 192.168.x, 169.254.x) are blocked, preventing the server from being used to probe its own internal network (SSRF).
  • Links back to our own domain are rejected, so no loops can form.
  • Address length is capped.

Rate limiting

Anonymous users have an hourly creation limit, which makes the service a poor foundation for bulk spam. On the API side, a per-key per-minute limit applies.

Fast takedown

Being able to disable an abused link within minutes is the only way a service keeps its reputation. A disabled link should show an informative page rather than failing silently.

Protection layers for sensitive content

Password protection

A link can be placed behind a password; the destination is never revealed without it. Useful for draft contracts, price lists or internal documents.

Do not send the password through the same channel as the link. If the link goes by email, send the password by phone — if both sit in the same inbox, there is no protection.

Expiry

The link stops working after a date you choose. It is the cleanest way to grant temporary access: you cannot forget to revoke it, because it revokes itself.

Click limit

A link sent to five people closes after five opens. Even if forwarded, it cannot spread.

Used together, these three cover most scenarios: valid for three days, ten clicks maximum, password protected.

The data side

A shortener collects data about the people who click. How that data is handled matters for organisational use.

  • IP addresses should not be stored in plain text. lnkz.tr keeps only an irreversible SHA-256 digest, used solely for de-duplication and abuse detection.
  • Do not carry personal data in the destination. A parameter like ?email=alice@example.com lands in server logs and referrer headers. Use an opaque token instead.
  • Mind the referrer. The destination page can see which short link the visitor came from, so the code itself must not encode anything sensitive.

A short rule list for teams

  1. Use a single shortener domain in corporate communication so staff and customers recognise it.
  2. Never send people to a credential prompt via a short link.
  3. For internal documents, combine a password with an expiry.
  4. Review active links created by departing employees.
  5. Keep your takedown time for a reported link under one hour.
  6. Repeat "do not click links you were not expecting" training annually.