Act on where links lead with link safety

Link safety follows short links and checks where they lead, so your policy can block phishing links without changing category scores.

A message can read as friendly and still carry a link to a page that collects passwords. Moderation categories judge what the message says, so "Thanks for coming yesterday, the slides are here" scores close to zero whatever the link behind it. Link safety, now in preview, checks where each link in an asset leads and lets your policy act on the destination.

Following the link first

Many harmful links are short links. The visible text names a shortener, and the destination is only known once the redirect is followed. Link safety follows a short link one redirect at a time, up to five, with a short timeout for each request. It sends no cookies and never renders the page, so nothing on the destination runs.

A link counts as a short link when its domain is a known shortener or is classified as a redirect service. Other links are checked where they point.

If a short link can't be followed, because a redirect fails, the chain is too long or the shortener shows its own page instead of redirecting, the link is unresolved. CalmLens doesn't guess a destination for it.

Verdicts

Each destination is checked two ways: its domain against content categories, and its URL against lists of phishing and malware pages. The link gets the most severe verdict the checks support:

A check that can't answer is never read as a pass. Its link is unresolved, and your policy decides what that means: a children's service may block it, while a general community may allow it.

A separate policy setting

Link safety has its own section in your moderation policy, with an action for each verdict: allow, limit, age-restrict or block. The asset takes the strongest action any of its links takes. That raises the decision, as a block list does; a stricter category decision still applies.

The link never changes a category's score. Categories describe the content that was supplied, and a gambling link in a post about the weekend doesn't make the post gambling content. Keeping the two apart means a report still shows what the text said, and classification.moderation.source is link-safety when a link decided the asset.

You can also act on every link outside the domains you list, whatever its verdict, for communities that keep members on the platform.

Defaults in the built-in policies

Every built-in policy blocks phishing and malware links. General age-restricts links to adult sites, like adult content itself, and allows gambling links. Teen-safe and Learning and support block adult links, and Teen-safe blocks gambling links too. Kids blocks every verdict except safe, including links it couldn't check.

What you see

Each checked link appears in classification.linkSafety.links with the link as written, its destination after redirects (null when it couldn't be followed), the number of redirects, where it was found, its verdict and the evidence from each check:

{
  "url": "https://bit.ly/calmlens-prize",
  "finalUrl": "https://claim-your-prize.example.com/login",
  "redirects": 2,
  "source": "text",
  "verdict": "phishing",
  "evidence": [
    { "check": "domain-categories", "status": "checked", "labels": ["Security Risks", "Phishing"] },
    { "check": "threat-lists", "status": "checked", "labels": ["SOCIAL_ENGINEERING"] }
  ]
}

An asset whose links act also records an asset.link-flagged event with the verdict, the link and its destination. The portal shows each link, its verdict and its destination on the asset page and in the review queue, as text rather than clickable links, so nobody opens a phishing page by reviewing it.

Where links come from

Links are read from plain-text documents, from QR codes and OCR text in images when link detection is on, and from QR codes in the sampled frames of a video. Web addresses shown as text in a video and links spoken in audio aren't read. Up to 20 links per asset are checked, and results are cached for a while per domain and URL, so a destination's verdict can take some time to change.

The link safety guide covers the settings and results in full.