Inspecting a URL before entering your password is the most important technical skill for avoiding phishing attacks. Every URL has the same structure, and learning to read it is the difference between entering credentials safely and handing them to an attacker who has set up a nearly perfect fake. The good news is that a proper URL inspection takes only about ten seconds and requires no special tools — just your eyes and a basic understanding of how web addresses are constructed.

This guide breaks down exactly what to look for when examining a URL, explains the most common deception techniques attackers use, and gives you a repeatable ten-second protocol you can apply every time you log in.

Why URL Inspection Matters

Phishing attacks have become increasingly sophisticated. Modern phishing pages replicate the look and feel of legitimate login screens so accurately that visual inspection alone is no longer reliable. An attacker can copy logos, colour schemes, typography, and even the layout of a real website with pixel-perfect precision. The one thing they cannot perfectly replicate is the domain name in your browser's address bar.

That is what makes URL inspection so powerful. No matter how convincing the page looks, if the domain name does not match the official website of the service, you are on a fake. The URL is the single strongest signal of a website's true identity, and learning to read it correctly is a fundamental phishing defence.

Many people glance at a URL and check for "https://" or a padlock icon, assuming that means the site is legitimate. While HTTPS encryption is important for protecting data in transit, it is not a reliable indicator of trustworthiness — phishing sites routinely use HTTPS certificates to appear legitimate. The padlock only tells you the connection is encrypted, not that you are on the right website. The domain name itself is what matters.

Understand the Structure of a URL

A typical URL is made up of several parts. Consider this example:

https://www.example.com/login?return=home

The most important part is the domain, which identifies the website owner. Here is how the components break down:

• Scheme (https://) — the protocol used for the connection. HTTPS indicates encryption, but as mentioned, both legitimate and phishing sites use it.
• Subdomain (www) — an optional prefix that sits before the main domain. Attackers often abuse subdomains to create misleading URLs.
• Root domain (example) — the core identifier of the website. This is what you need to verify.
• Top-level domain or TLD (.com) — the suffix. Common ones include .com, .org, .net, .co.uk, and .gov.
• Path (/login) — everything after the first forward slash belongs to the domain owner and can be anything. Attackers use path elements to make URLs look more convincing.
• Query parameters (?return=home) — additional data passed to the page, also controlled by the domain owner.

The critical rule is: everything after the domain name (the path and query string) belongs to the organisation that owns that domain. An attacker can put "login" or "secure" or "paypal" anywhere in the path, but it still does not make the domain PayPal's if the root domain is something else.

Find the Root Domain

The most reliable technique for identifying the true owner of a website is to read the domain from right to left. The top-level domain (TLD) is the rightmost portion: .com, .org, .net, .gov, .co.uk, and so on. Moving one step to the left gives you the root domain — the actual name of the website. Everything to the left of the root domain is a subdomain, which can be set by the domain owner or (in the case of some hosting platforms) by attackers.

Let us apply this technique to a few examples:

example.com — Read right to left: TLD is .com, root domain is "example". Simple and clear.

login.example.com — TLD is .com, root domain is "example", subdomain is "login". This is still the legitimate example.com website using a subdomain for its login portal.

example.com.login.attacker.com — TLD is .com, root domain is "attacker", subdomains are "login" and "example.com". This is a fake page hosted on attacker.com. The word "example" appears in a subdomain name, which tricks many people into thinking they are on the real site.

The last example — subdomain spoofing — is one of the most common phishing techniques because it takes advantage of the way people scan URLs. Most people look for the brand name somewhere in the URL and stop reading once they find it. Attackers count on this.

Common URL Deception Techniques

Attackers use several methods to make malicious URLs look legitimate. Understanding these techniques helps you spot them quickly.

Subdomain Spoofing

As shown above, the attacker registers a domain that includes the target brand name as a subdomain or path element. A URL like paypal.com.security-verify.com has a root domain of "security-verify.com" with subdomains "paypal" and "com". To the untrained eye, it looks like it might be PayPal. The right-to-left reading technique immediately reveals the deception.

Typosquatting

Attackers register domain names that are slight misspellings of popular brands. Examples include goolge.com (instead of google.com), facebok.com, amazom.com, or microsft.com. These rely on users not noticing a missing letter, an extra letter, or a swapped character. Some typosquatting domains are extremely convincing — for instance, using "rn" (r followed by n) to look like "m" in a domain name.

Homograph Attacks

Internationalised domain names (IDNs) allow characters from different writing systems in domain names. Attackers exploit this by replacing Latin letters with visually identical characters from Cyrillic, Greek, or other scripts. For example, the Cyrillic letter "а" (U+0430) looks identical to the Latin "a" (U+0061) in most fonts. A domain like арple.com (using Cyrillic 'а' and 'р') would look like "apple.com" in a browser but is actually a different domain. Modern browsers display IDN domains in their Punycode form (xn--...) in the address bar, but not all users know to check for this.

URL Shortener Abuse

Attackers use URL shorteners like bit.ly, tinyurl.com, or ow.ly to hide the real destination of a link. A shortened URL gives no indication of where it leads. Before clicking a shortened link, use a URL expander tool to preview the full destination. If you receive a shortened link in an email that claims to be from your bank, it is almost certainly phishing.

The 10-Second URL Check Protocol

Before entering credentials on any login page, perform this quick check. With practice, it takes about ten seconds and becomes an automatic habit:

1. Click or tap the address bar to reveal the full URL. Many browsers truncate long URLs in the default view, hiding the root domain.
2. Read the domain from right to left. Identify the TLD, then the root domain immediately to its left.
3. Check that the root domain matches the official domain of the service you intend to log into. For example, if you are logging into Google, the root domain must be "google.com" — not "g00gle.com", not "google.security-check.com", not "google.com.malicious-site.ru".
4. If it does not match or looks unusual in any way, do not enter your credentials. Close the tab and navigate to the service by typing the official URL directly into your browser's address bar.

A password manager like NordPass automates much of this process — it only offers to autofill credentials on the exact domains you have saved, making it easy to spot mismatches. If a password manager does not offer to fill your credentials, that is a strong signal that the site is not the legitimate one.

What to Do When You Spot a Suspicious URL

If you identify a suspicious or clearly malicious URL, do not interact with the page further. Close the tab entirely. If you clicked a link in an email, report the email as phishing to your email provider — most major services (Gmail, Outlook, Yahoo) have a "report phishing" button that helps their spam filters improve for everyone.

If you entered credentials on a suspicious page before realising it was phishing, follow the incident response steps immediately: change the password on the real website, revoke all active sessions, enable or rotate MFA, and check other accounts where you may have reused the same password. The faster you act, the less damage an attacker can do.

How Password Managers Enhance URL Inspection

Beyond generating and storing strong passwords, modern password managers provide built-in phishing protection through domain-aware autofill. When you save a credential for "google.com", the password manager will only offer to autofill that credential on pages whose domain exactly matches "google.com". If you land on "g00gle.com" or "google.com.verify-login.xyz", the password manager stays silent — a clear warning that something is wrong.

This feature is one of the most practical phishing defences available. It does not require you to remember which domain is correct for each service; the password manager does the verification automatically. Using a password manager like NordPass alongside the ten-second URL check gives you both an automated safety net and a manual verification habit — defence in depth for your credentials.

Conclusion

URL inspection is a simple, free, and highly effective defence against phishing attacks. By understanding the structure of a URL, learning to identify the root domain, and applying a consistent ten-second check before entering credentials, you can avoid the majority of phishing attempts. The techniques attackers use — subdomain spoofing, typosquatting, homograph attacks — all rely on users not looking closely enough at the address bar. By making URL inspection a habit, you remove that vulnerability.

Combine this manual check with a password manager that provides domain-aware autofill, and you have one of the strongest practical defences available against credential theft. The address bar is your first line of defence — learn to read it, and you will catch phishing attempts before they can do any damage.