The address bar, decoded
Every time you visit a website, you type or click a URL (uniform resource locator), the address that tells your browser exactly what to fetch and where to get it. Most people read a URL as one solid blob of text, but it is made of distinct parts, and understanding those parts is one of the most useful, low-effort security habits a beginner can learn. Scammers rely on people not reading addresses carefully; you can undo a lot of that risk in about five minutes of practice.
Key terms
- Protocol: the method used to communicate, shown at the start of a URL such as https://. It tells the browser how to talk to the server.
- Domain name: the human-readable address of a website, such as example.com. It maps to a numerical address through DNS.
- Subdomain: an optional prefix before the domain, such as mail in mail.example.com, often used for a specific section or service.
- Path: the part after the domain, such as /support/contact, pointing to a specific page or resource on that site.
- Query string: optional text after a question mark, such as ?ref=email, that passes extra parameters to the page.
- TLS/SSL certificate: a credential that lets a browser verify a site's identity and encrypt the connection, shown as the padlock icon.
Anatomy of a URL, piece by piece
Take an example address: https://www.example.com/support/contact?ref=email. Reading left to right:
- https:// is the protocol. The "s" means the connection is encrypted using TLS, so data between your browser and the site is scrambled against eavesdroppers on the network.
- www.example.com is the domain, sometimes with a subdomain like www. This is the part that matters most for trust: it identifies who actually controls the page.
- /support/contact is the path, telling the server which specific page to return.
- ?ref=email is a query string, often used for tracking a link's source or passing search terms and filters.
The domain is the single most important part to check before you trust a page. Everything after the first single slash is controlled by whoever owns the domain, and a scammer can make a path or subdomain look convincing—but they cannot make example.com become your bank's real domain.
What the padlock actually means
Seeing a padlock or "https" does not mean a site is honest, safe, or verified as legitimate—it only means the connection between your browser and that specific server is encrypted, so a stranger on the same Wi-Fi cannot easily read the traffic. Attackers can and do register their own domains and enable HTTPS on phishing pages. Mozilla's guide on how to tell if a website is safe explains this distinction clearly: encryption protects the pipe, not the honesty of who is on the other end.
How lookalike URLs are used in phishing
Phishing pages frequently exploit the fact that people skim rather than read addresses fully. Common tricks include:
- Misspellings: amaz0n.com or paypa1.com, substituting a digit for a letter.
- Extra subdomains: paypal.com.verify-account.net, where the real domain is verify-account.net, not paypal.com, because the part immediately before the first single slash is what counts.
- Look-alike characters: using letters from another alphabet that render almost identically to Latin letters, a technique called a homograph attack.
- Trusted-sounding paths: a scam domain with a path like /apple-support/id-locked to look official, even though the domain itself is unrelated to Apple.
To read a suspicious URL safely, hover over a link before clicking to preview the actual destination in most browsers and email clients, and always find the domain by locating the first single slash after "https://" and reading immediately to its left.
Practical habits that reduce risk
- Type important addresses—your bank, email provider, workplace portal—directly into the browser or use a saved bookmark, rather than clicking a link from an email or text.
- Before entering a password, glance at the domain and confirm it matches the service exactly.
- Treat urgency ("verify now or your account will be suspended") as a signal to slow down and check the address, not speed up.
- Use your browser's or email provider's built-in warnings; Google's Safe Browsing and similar systems flag many known phishing domains automatically.
- If you are unsure whether a link is genuine, search for the company's official site independently instead of trusting the link.
A quick self-test
Practice on a few real addresses you already trust: your bank's login page, your email provider, and a shopping site. Identify the protocol, domain, and path in each one out loud. Then look at a suspicious message you have received and try the same exercise—often the mismatch becomes obvious once you know where to look.
▶ Watch: How the Internet and Web Addresses Work (open on YouTube)
Understanding URLs will not stop every scam, but it removes one of the most common tricks attackers rely on: hoping you never look closely at the address bar.
A beginner's verification checklist
Good advice about urls should be practical, specific, and easy to undo when it is wrong for your situation. Before changing a setting, installing an app, or sharing information, identify the official source. An official source is the organization that runs the service, makes the product, or is responsible for the policy—not a sponsored search result, a social-media reply, or an unknown download mirror. Read the page address carefully and use a bookmark or manually typed address for important accounts.
Keep a small record
Write down the date, the device involved, and the exact setting you changed. Take a screenshot of the old setting if it is safe to do so. This gives you a rollback plan and makes it easier to ask qualified support for help. Do not include passwords, recovery codes, full account numbers, or private addresses in screenshots you share.
When a guide asks you to enter credentials, understand the difference between signing in and giving away a secret. Sign in only on the known service page or its official app. A password, one-time code, recovery code, and security-key approval are secrets: support staff, friends, and legitimate companies should not need you to send them in chat. If someone creates urgency—"act in five minutes," "your account will be deleted," or "keep this secret"—pause and independently verify the claim.
Make changes one at a time
Changing several things at once makes troubleshooting difficult. Use this simple method:
- State the problem in one sentence and note when it happens.
- Choose the least invasive official fix first.
- Change one item, then test the original problem.
- Keep the change only if it helps and does not create a new risk.
- Revert it or seek official support if the result is unclear.
For example, if an app suddenly behaves differently, check its update notes and account-security page before installing a "fix" from a video comment. If a device asks for an update, install it from the device's own settings or the maker's site. An update is a vendor-provided software change that repairs defects or adds features. Updates are especially important when they fix security vulnerabilities—mistakes in software that an attacker could exploit.
Use trustworthy help
Prefer a manufacturer's manual, a government consumer-protection agency, a recognized library, or the platform's help center. Check the publication date because menus and policies change. Independent reviews can be useful for experience and comparisons, but they do not override product documentation or local law. Be skeptical of pages that make guaranteed promises, hide who operates them, or demand payment before explaining the issue.
Protect your accounts and devices
Most everyday online safety begins with a few repeatable habits. Use a password manager to create a unique password for every important account. Turn on multi-factor authentication wherever available. Keep automatic updates enabled for your operating system, browser, apps, and router. Back up important files and periodically confirm you can restore one. A backup is a separate copy that lets you recover from loss, damage, or ransomware; copies kept only on the same device do not protect against device failure.
Treat unexpected links, attachments, QR codes, login prompts, and payment requests as things to verify rather than obey. If a message claims to be from a company, open the official app or call the number on a statement you already have. Never solve an urgent digital problem by installing remote-control software for a stranger.
Know when to stop
Stop and contact official support, a trusted local professional, or the relevant authority when a step could expose private data, money, an account, or someone else's equipment. If you believe fraud or a crime is happening, preserve lawful evidence such as dates, screenshots, and receipts, then report it through the proper channel. Do not retaliate, "hack back," or publish accusations without reliable proof.
The goal is informed, lawful control of your own technology. Small, documented steps are safer and more effective than shortcuts.
