How to block URL shorteners on your network
A short link hides its destination until someone clicks. That makes shorteners useful for marketers and equally useful for phishing, malware and filter bypass.
This guide helps IT admins, MSPs, school IT teams and filtering vendors decide when to block, when to warn and when to judge the destination instead.
short.example/x7KpWhat the user seesHTTP redirectShortener answerstracker or 2nd hopOptional extra redirectsfinal-site.exampleWhere your filter decidesWhy organisations block URL shorteners
Shorteners are not harmful in themselves. The concern is what they hide and how attackers use that.
Phishing
The reader cannot see the real domain, and simple email filters may only check the shortener's domain, which has a good reputation.
Changing destinations
Some services let the owner change where a link points after it was sent, so a link that was safe at delivery can turn bad.
Malware downloads
Short links in chat messages and comments often lead to fake installers or document lures.
Filter bypass
Students share short links to proxy sites and game mirrors, hoping the filter judges only the first hop.
Tracking
Every click on a public shortener is logged by the service, which some privacy policies want to avoid.
QR code lures
QR codes often carry short links, and they open on phones where controls may be weaker.
Not all shorteners are equal: block, warn or allow
The right action depends on the type of shortener. This is a suggested default for a business network; schools usually move each row one step stricter.
Anyone can create links anonymously or with a free account. Most phishing use of shorteners happens here.
Little legitimate use on a work network, frequent abuse, and they come and go quickly.
Used by a platform for its own links. Blocking them breaks that platform, so follow the platform's own policy.
Businesses use custom short domains for campaigns. They usually inherit the owner's reputation and category.
Created by scheduling tools for social posts. Moderate risk, common in marketing teams.
Not shorteners in the strict sense but used the same way. Judge them by the pages they lead to.
What breaks when you block shorteners
Test the impact before you switch to block. These are the most common complaints after a broad shortener block. Running the category in log only mode for a week shows which teams depend on short links.
| What breaks | Why | Mitigation |
|---|---|---|
| Links in X posts | X wraps outbound links through t.co | Do not block t.co unless X itself is blocked |
| LinkedIn post links | LinkedIn uses lnkd.in for shared links | Allow when LinkedIn is allowed |
| Shared YouTube videos | youtu.be is YouTube's short domain | Apply your YouTube policy, not the shortener policy |
| Newsletters and press releases | Marketing tools shorten links for tracking | Warn mode instead of block for staff |
| Partner and vendor emails | Senders use public shorteners in signatures and invites | Allowlist specific short links on request |
| Printed materials and QR codes | Posters and packaging often use short links | Warn mode on phones, user guidance |
Judge the destination: why categories matter more than the shortener
What happens at click time
- The browser asks DNS for the shortener domain; your DNS filter sees the URL Shorteners category.
- If allowed or warned, the shortener returns a redirect to the next address.
- The browser looks up the final domain; your filter checks its categories again.
- If the destination is phishing, malware, a proxy or any blocked category, the user sees your block page.
What this means for policy
- A good destination check makes most shortener blocks unnecessary for adults.
- The destination must be categorized quickly, because phishing domains are young. See our guide to blocking newly registered domains.
- Warn pages on the shortener give users a moment to think, without breaking business links.
- For students and high risk roles, a block on generic shorteners removes a whole class of tricks.
- Our URL checker shows the category of a destination you are unsure about.
The email security angle
Most malicious short links arrive by email or chat. Email security sees the link before the user does, so give it the same category data as your web filter.
Expand on arrival
Email security follows short links when a message arrives and checks every hop.
Re-check at click
Link rewriting or time of click checks catch links that change after delivery.
Score shorteners
Treat a generic shortener in an email from an unknown sender as a risk signal.
Share the verdict
Feed blocked destinations back into the web filter so the same link fails everywhere.
Vendors building these checks can read about real time URL classification and how a lookup API fits into mail flow.
Methods: router, firewall, DNS, Intune, Google Admin and MDM
Router
- Use a filtering DNS resolver that blocks the URL Shorteners category or a short list of generic shorteners.
- Block other resolvers so the rule applies to every device.
- Routers cannot show warn pages, so expect support requests for business links.
Firewall
- Set the URL shortener category to warn or block in the web filter profile.
- Make sure the firewall evaluates the final URL after redirects, not just the first request.
- Keep platform shorteners in line with the platform's own rule.
DNS filter
- Block or warn on URL Shorteners per user group.
- Block Malware / Phishing / Suspicious and VPN / Proxy / Anonymizers so bad destinations fail anyway.
- Allowlist branded short domains of partners on request.
Intune and Defender
- Turn on Defender network protection so web protection covers all browsers.
- Use custom indicators to block specific shortener domains.
- Enable SmartScreen in Edge through Intune for reputation checks on destinations.
Google Admin console
- Add generic shorteners to the Chrome URL blocklist for student organisational units.
- Keep Safe Browsing protection on in Chrome policy.
- Prefer a category filter on managed Chromebooks so new shorteners are covered.
Mobile MDM
- Push your DNS or filtering profile so QR code links are checked on phones.
- Apply the same category policy as on laptops.
- On unmanaged phones, rely on awareness about QR codes and texts.
Policy by audience: one size does not fit
Shortener rules work best when they follow the risk of the user group, not one rule for everyone. Most filters let you set the action per group or organisational unit.
| Audience | Generic shorteners | Throwaway shorteners | Platform shorteners | Reason |
|---|---|---|---|---|
| Students under 13 | Block | Block | Follow platform rule | Little need, high bypass and safety risk |
| Older students | Warn | Block | Follow platform rule | Research links are often shortened |
| General staff | Warn | Block | Allow | Business links must keep working |
| Finance, HR and executives | Block | Block | Allow | Most targeted by payment and credential phishing |
| Guest Wi-Fi | Allow | Block | Allow | Rely on destination checks, avoid support calls |
| Security and IT teams | Allow with logging | Allow on analysis devices | Allow | Need to investigate suspicious links |
MSPs can keep these as templates and apply them per tenant. See our page on web filtering for MSPs for how tenant templates are usually structured.
Investigating a suspicious short link safely
When a user reports a short link, IT needs to know where it goes without opening it on a normal workstation. A simple, repeatable routine keeps analysts safe.
Do not click
Copy the link as text from the report. Never open it on a production device.
Use a preview
Several shortening services offer a preview page that shows the destination. Check each service's help pages for how.
Check categories
Run the final domain through a category lookup to see if it is phishing, malware or new.
Isolate if needed
Open anything unclear only in an isolated browser or sandbox, never with real credentials.
Search the logs
Look for other users who clicked the same short link or reached the same destination, and reset their passwords if it was a credential page.
Report abuse
Most public shorteners accept abuse reports and disable malicious links. Report the link once you have recorded the evidence.
Bypass risks to plan for
New shortener services
Fresh shorteners appear all the time. A category feed with daily updates catches them; a static list does not.
Chained redirects
A short link points to another short link, then to the target. Filters must check every hop and the final destination.
Open redirects on trusted sites
Some well known sites have redirect pages that can forward to any address. Only the destination check catches these.
Encrypted DNS
Browsers using their own DNS skip a DNS filter entirely. Disable DoH by policy or point it at your resolver.
Proxies behind short links
Students hide proxy addresses behind shorteners. Block the proxy category as well, see how to block proxy sites.
QR codes on personal phones
Personal phones on mobile data are outside your control. Teach people to check the address shown before opening.
How to test your shortener policy
| Test | Method | Expected |
|---|---|---|
| Generic shortener | Create a short link to a safe page with a public service and open it | Warn or block page, depending on group |
| Bad destination | Shorten a link to a known test page that your filter blocks | Destination block page, even if the shortener is allowed |
| Platform links | Follow a link from an X or LinkedIn post | Works if the platform is allowed |
| Category check | Look up shortener domains in our domain lookup tool | URL Shorteners listed |
| Chained hops | Shorten a short link, then open the outer one | Final destination still checked |
| Phone and QR | Scan a QR code for a short link on a managed phone | Same policy as on laptops |
| Send a test email with a short link to a blocked page | Email security flags or rewrites it |
For vendors: building shortener handling into a filter
If you build a firewall, DNS filter, gateway or email security product, shorteners are a feature your customers will ask about. These are the capabilities that matter most.
Separate category
- Expose URL Shorteners as its own category so admins can warn rather than block.
- Keep platform shorteners mapped to their platform, so policies stay consistent.
Redirect awareness
- In proxies and gateways, evaluate each redirect hop and the final URL.
- In DNS filters, rely on the browser's follow-up lookups and categorize every domain fast.
Warn pages
- Offer a "continue" page that shows the shortener and a reminder to check the source.
- Log whether the user continued, for later investigation.
Fresh domain coverage
- Phishing destinations behind short links are often days old.
- Daily delta files for newly registered domains close that window.
Lookup at click time
- An API call for unknown destinations avoids letting them through by default.
- Cache results so repeated clicks stay fast.
Reporting
- Show admins which shorteners their users click most and where those links lead.
- That report alone often justifies a stricter policy for high risk groups.
Our OEM licensing
Three habits to teach users
Look before you tap
Phones show the real address after a QR scan or a long press. Check it matches the sender you expect.
Be wary of short links in surprise emails
A real bank, supplier or IT team rarely sends a generic short link for a login page.
Never sign in after a short link
If a short link leads to a login page, close it and go to the service directly instead.
Category-based blocking with our database
URL Shorteners is one of our 59 web filtering categories. It covers public shortening services and their redirect domains, so you can block, warn or log them as a group without keeping a list.
The bigger win is the destination. Our phishing, malware and spam categories, and the daily categorization of new domains, mean the page a short link leads to is usually already known. See the phishing category and the full taxonomy.
Files arrive as CSV, Parquet or JSON and run inside your own systems, including air-gapped networks. Licensed customers can also export the shortener category as DNS RPZ, hosts files, AdGuard or Pi-hole style lists and firewall external dynamic lists, so a warn or block rule can be rolled out to many sites at once.
URL shortener FAQ
Should I block all URL shorteners?
Usually not. Blocking every shortener breaks links in social media, newsletters and partner emails. Most organisations block generic public shorteners for high risk groups, use warn pages for everyone else, and rely on the filter to judge the final destination.
Will blocking t.co break X links?
Yes. X wraps links in posts through t.co, so blocking it stops users following links from X, even to safe sites. Treat platform shorteners like t.co, lnkd.in and youtu.be as part of the platform's own policy.
Why do phishing emails use URL shorteners?
A short link hides the real destination from the reader and from simple filters that only check the visible domain. Attackers can also change where some short links point after the email has been delivered.
Can my web filter see where a short link goes?
Yes, at click time. The browser follows the redirect and requests the final domain, which your DNS filter or proxy then checks against its categories. That is why category blocking of the destination matters more than the shortener itself.
Which category covers URL shorteners?
Our database has a dedicated URL Shorteners category within its 59 web filtering categories, covering public shortening services and their redirect domains.
How do I deal with QR codes that hide short links?
QR codes usually open on phones, so the phone needs your filtering profile through MDM. On unmanaged phones, user awareness is the main defence.
Judge every hop with current category data
License a categorized domain database with a URL Shorteners category, fast coverage of new domains and a lookup API, running in your own systems. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Talk to usBitly is a trademark of Bitly, Inc. TinyURL is a trademark of TinyURL, LLC. X is a trademark of X Corp. LinkedIn is a trademark of LinkedIn Corporation. YouTube, Google, Chrome and Chromebook are trademarks of Google LLC. Amazon is a trademark of Amazon.com, Inc. Hootsuite is a trademark of Hootsuite Inc.
Microsoft, Intune, Edge, SmartScreen and Defender are trademarks of Microsoft Corporation. AdGuard is a trademark of AdGuard Software Ltd. Pi-hole is a trademark of Pi-hole LLC. Other names are trademarks of their respective owners. These names are used here only to identify the services discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.