Link safety
Link safety is in preview. It checks where the links in an asset lead and acts on assets that link to phishing, malware, adult or gambling sites, through its own section of your moderation policy. Turn it on by choosing an action for a verdict in your Portal › Moderation policies.
What is checked
Links are found in:
- Plain-text documents.
- Images, through link detection: QR codes, and the extracted text when OCR is on.
- Videos: QR codes in the sampled frames. Web addresses shown as text in a video, and spoken in audio, aren't read as links.
Each link is then checked:
- A short link is followed one redirect at a time, up to 5 redirects, without cookies or loading the page. Known shorteners and domains classified as redirect services count as short links. Any other link is checked at its own address, even if it redirects.
- The destination's domain is checked against domain categories, and the destination URL against lists of phishing and malware pages.
Up to 20 links per asset are checked, at the same time as the content is classified. The first check of a domain can add up to about 20 seconds to classification. Results are then cached for up to a day (a URL that isn't listed, for 30 minutes), so later links to the same places are quicker, and a destination's verdict can take that long to change.
Verdicts
Each link gets one verdict, the most severe its checks support:
| Verdict | Meaning |
|---|---|
phishing | The destination is listed as phishing or social engineering. |
malware | The destination is listed as malware, unwanted software or a botnet host. |
adult | The destination's domain is classified as adult content. |
gambling | The destination's domain is classified as gambling. |
unresolved | A short link couldn't be followed to its destination, or a check couldn't answer. It is never treated as safe. |
safe | Every check answered and none of the above applies. |
Policy settings
The link-safety section of a policy sets an action for each verdict: allow, limit, age-restrict or block. A verdict without an action is allowed. The asset takes the strongest action any of its links takes, and that raises the policy's decision; a stricter category decision still applies.
Optionally, act on every off-platform link: any link whose destination is outside your allowed domains takes the action you choose, whatever its verdict. A domain also covers its subdomains.
Link safety is separate from the moderation categories. Where a link leads never changes a category's score, because categories describe the content itself. Each built-in policy sets its own link actions; change them in your own copy.
Results
Each checked link appears on the asset as classification.linkSafety.links, with the link as found, its finalUrl after redirects (null when it couldn't be followed), the number of redirects, its source, its verdict and the evidence from each check. classification.moderation.linkSafety records the action, the links that took it and the settings in force. When a link decides the asset, classification.moderation.source is link-safety.
When a check can't answer
A link whose check couldn't answer, for example because a check timed out, has that check's evidence entry with status: "failed", and its verdict is unresolved. A short link that couldn't be followed has finalUrl: null and no evidence. classification.linkSafety.status stays evaluated in both cases, because every link still gets a verdict for your policy to act on. To hold back links that couldn't be checked, give unresolved a stricter action; this also catches short links that can't be followed.
An asset whose links act also records an asset.link-flagged event with the link's verdict, the link and its destination. The portal shows each link's verdict and destination on the asset page and in the review queue, as text rather than clickable links.