Anatomy of a URL: reading a web address like a pro

A web address has a fixed shape, and the only part that decides where you actually go is the registrable domain: the name somebody bought, plus its suffix, sitting immediately before the first single slash. In https://accounts.shop.example.com/orders/142?ref=email#items that part is example.com. Everything to the left of it is chosen by whoever owns that domain, and everything to the right of the slash is chosen by them too. Learn to find that one piece and you can read any link, including the ones designed to fool you.

The full address, part by part

Here is a deliberately overstuffed example, using a reserved documentation domain that can never belong to a real company:

https://guest@accounts.shop.example.com:8443/orders/142?ref=email&sort=new#items

• Scheme https: tells the browser which protocol to speak. You will also meet http:, mailto:, tel: and file:.
• Userinfo guest@ is an old feature for passing a username. It is almost never legitimate today and is a classic disguise, because everything before the @ sign is ignored when deciding where you land.
• Host accounts.shop.example.com is the machine name. It reads outward from general to specific as you move right to left.
• Port :8443 picks a numbered door on that machine. It is normally hidden because 443 is assumed for https and 80 for http.
• Path /orders/142 is the location within the site. Unlike the host, it is usually case sensitive.
• Query ?ref=email&sort=new is a list of name and value pairs joined by ampersands, passed to the server as extra instructions.
• Fragment #items points at a spot within the page. It is handled entirely by your browser and is never sent to the server.

Anything a browser cannot put in an address directly gets percent encoded, which is why a space becomes %20 and a slash inside a value becomes %2F. Non Latin characters in a domain get converted to an ASCII form that begins with xn--, and browsers display that raw form when a name mixes scripts, precisely because mixed script names are used for impersonation.

Where the site name actually is

The host is a series of labels separated by dots, read right to left. The rightmost label is the top level domain: com, org, de, io and hundreds more. Immediately to its left is the name somebody registered. Together those are the registrable domain, and that is the thing you should be reading.

The complication is that some suffixes are two or three labels long. In shop.example.co.uk the registrable domain is example.co.uk, because co.uk is a public suffix that nobody can buy as a whole. Browsers keep a maintained list of these suffixes so they know where one owner's territory ends and another's begins.

This is also why www means nothing. It is just a conventional subdomain, and most sites now serve the same content with or without it. Its presence is not a mark of authenticity, and its absence is not a warning sign.

Everything further left is a subdomain, and subdomains are free. The owner of example.com can create login.example.com, secure.example.com or www.bank.example.com in seconds, at no cost, with no approval from anyone. That single fact is the engine behind most deceptive links. The machinery that turns a host name into a server address is covered in how DNS decides where you land.

Read right to left: the one rule

Here is the method, and it takes about three seconds once it is a habit.

1. Find the first single slash after the scheme. Everything before it is the host.
2. If there is an @ sign in the host, ignore everything before the @ entirely.
3. From the end of the host, read backward: the suffix, then the name attached to it. Stop there.
4. That name is the site. Ask yourself whether it is the organization you expected, spelled the way you expected.

Everything after that first slash is under the control of whoever owns the domain, which means a path can contain any text at all. A page at example.net/bank.example.com/login has nothing to do with bank.example.com. It is a folder name on somebody else's server.

Real versus deceptive addresses

All of these use reserved documentation domains, so none of them belong to anyone. Assume for the table that the genuine site is bank.example.com.

Two more tricks do not fit neatly in a table. Lookalike characters substitute a digit or a letter from another alphabet that renders almost identically, so a capital I can stand in for a lowercase l, or a Cyrillic letter for a Latin one. And a very long host stuffed with dots pushes the real domain off the right hand edge of a phone's address bar, leaving only the reassuring part visible. On a phone, rotate to landscape or tap the address bar to see the whole thing.

The query string and what it carries

The part after the question mark is instructions for the server, and it is also where marketing lives. Parameters beginning utm_ record which campaign sent you, and other identifiers can tie a click back to an individual email address. You can usually delete everything from the question mark onward before sharing a link, and the page will still load, though occasionally a parameter is doing real work such as carrying a search term or a product variant.

Two things are worth knowing about privacy here. The query string is part of the address, so it ends up in server logs and in browser history. The fragment after the hash is not sent to the server at all, which is why some services put sensitive values there. What else follows a click around is covered in how web tracking actually works.

When you cannot see the address at all

Reading addresses only helps when you can see one, and three common situations hide it.

Link text lies freely. In email, chat and web pages, the visible words are separate from the destination, so a message can display one address and link to another. Hover on a desktop and read the status bar, or press and hold on a phone until a preview appears, rather than tapping straight through. This gap between what is shown and where it goes is the mechanism behind most phishing messages, and the surrounding signals are catalogued in the red flags in scam texts and emails.

Shorteners hide everything by design. A shortened link tells you nothing until it resolves, and shorteners can be edited or retargeted after the link is sent. Treat one in an unexpected message as unreadable, not as neutral.

QR codes are shorteners you cannot even squint at. Most phone cameras show the destination before opening it, so read that preview every time, especially for codes stuck on parking meters, menus and delivery notices where a sticker over the original is trivial.

Checking a link in ten seconds

Reveal the real address, ignore anything before an @ sign, find the first single slash, and read backward to the registrable domain. If that name is not exactly the organization you expected, stop. If it is, you still only know which site you reached, not whether the operator is honest, which is the limit explained in what the padlock does and does not prove.

Build one habit on top of that: for anything involving money, passwords or identity, do not follow the link at all. Type the address yourself or open the app. That removes the whole problem, because a domain you typed cannot be a lookalike. The same reading skill is the first check when buying from a shop you have never heard of, where a plausible looking domain registered last week is the usual setup. And if you have already clicked and typed something in, the recovery steps are in what to do after clicking a phishing link, where the first ten minutes matter more than anything you read here.