How do you think could we secure hyperlinks pasted by users on website's forums, comments, blogs against bad links/leading to malware etc.?

I thought about google safe browsing, projecthoneypot.

Did you address this problem and if can avoid bad links problem?

  • 1
    Checking with those might help. However, with the profusion of URL shorteners, it's not possible to avoid the problems altogether. Commented Apr 25, 2012 at 11:09
  • So there we should use URL redirects follower which resolve these URLs.
    – kamoks
    Commented Apr 25, 2012 at 11:42
  • 1
    I don't see url shorteners as a problem. Just blacklist them, they're annoying anyways. Commented Apr 25, 2012 at 12:12
  • It is good advise.
    – kamoks
    Commented Apr 25, 2012 at 12:13
  • 2
    Not allowing users links at all, or not allowing them to post links until they've earned some kind of reputation in the community? You aren't going to catch all links, but this kind of thinking will stop the spam bot kind of ones.
    – ewanm89
    Commented Apr 25, 2012 at 15:04

3 Answers 3


In general, there's no way to vet links unless you have significant resources. Even if you visit the site, the domain may expire and be acquired by a malware distributor who wants to benefit from the old owner's reputation.

You need to white-list protocols, e.g. only allow http, https, and mailto. javascript: links cannot be trusted.

Besides that, you can rely on most modern browsers to include some kind of malware checking, and possibly not serve links to older browsers.

Either way, you should use nofollow to make sure that malware trackers do not conclude that these links are more reliable because your site links to them or that your site is less reliable because it links to them.

  • 1
    "Even if you visit the site" the website could fingerprint the tools and IP addresses you use to download the content (naively by user-agent header, with an advanced behaviour analysis system to distinguish HTTP bots from humans), so he could show "safe" content to your checking bot and "unsafe" content to others. You could make this fingerprinting more difficult by changing HTTP client, and using proxies or even Tor.
    – curiousguy
    Commented Aug 1, 2012 at 16:54
  • 1
    (...) But unless you are ready to frequently recheck the content of a resource (with various web clients and various proxies to avoid detection), there is simply no way to even have a higher bound on the success probability of such advanced attacks. The alternative is to copy the content on a webserver you control, and then check - and it has many other security issues.
    – curiousguy
    Commented Aug 1, 2012 at 16:57
  • @curiousguy, Quite right. Commented Aug 1, 2012 at 17:47
  • Would you also white-list the FTP protocol?
    – curiousguy
    Commented Aug 1, 2012 at 19:16
  • @curiousguy, Probably not unless the nature of the forum requires it. It's not widely used, allows initiating downloads, and browsers continue to allow user name and password to be embedded in FTP URLs possibly enabling attackers to mask the origin by putting something that looks like a domain in the authority portion. Commented Aug 1, 2012 at 19:34

URL shortening services are a great way to leverage an XSS or CSRF vulnerability because it obscures the request from the user. McAfee provides a secure url shorting service.

Its trivial to see if a link is redirecting, with a HTTP header. CURL can automatically follow HTTP header redirects, however meta-redirect and JavaScript redirects is more difficult.

There are two things you can check. You can verify that the URL isn't on the Google Safe Browning blacklist using Google's api. You could also verify that it doesn't have JavaScript in it. This part is a little harder because of encoding, but still pretty simple to implement.


If the question is what a service provider (i.e. webhost) can do to reduce the likelihood that a malicious link is posted on your site, there are a few available methods. I recall that Websense offers a service, Threatseeker cloud, a web service where service providers can use to verify whether a link (shortened or not) belongs to any number of pre-defined categories (i.e. adult, malicious, etc). I'd guess there are other vendors and ventures aimed at providing this type of service to service providers.

Aside from checking each posted link before its published, you can always look at other technical controls mentioned in the other answers or perhaps a simple administrative/social control to ensure only registered users can post. You can add on the requirement for moderation by a moderator or add on the social component to require posting of links only be available to registered users after some measure (i.e. positive votes, reputation, etc).

Lastly, you could always mask links so the user has to copy/paste it into their browser. But this approach moves the burden back on the user.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .