Paste a link. First it is read, here in your browser, without anything being opened: who the site really is, what tracking rides along, whether it is a shortener or a mail system's wrapper. Then, if it is safe to, a server follows it hop by hop and reports where it ended up.
cooking · work in progressFollowing…
Everything the read does comes from taking the address apart. Here is one with every trick in it.
https://paypal.com@secure.example.net/login/reset?utm_source=mail&id=42#top
A shortener says nothing about where it goes; only following it does, and the one that owns the destination adds a note on the way saying you came by the short road. A wrapper is what a mail system or a social network puts round every link so it can count the click, with the real address carried inside in plain sight. A permanent name, like a DOI, redirects to wherever the thing lives today, so the name can be printed on paper and outlive the address. A pointer to the newest, like a releases-latest link, resolves to a different version each time one ships. A random link goes somewhere new on every visit. And a decoy puts a name you trust where it has no power: before an @, in a subdomain, in a folder, or spelled with a letter from another alphabet that your screen draws identically.
The read never leaves this tab. A link is a small structured thing and most of what
matters is written in it: the real host is the part just before the first slash, whatever is
written before an @ sign is a decoy, a well-known brand name in the middle of a host is not that
brand, and parameters beginning utm_ exist to identify you or the campaign rather than
to choose a page.
The follow asks a server to open the link so that you do not have to. It goes one hop at a time and reports each one: the host, how it answered, and whether it sent us on. The server sees the page but you never see the page; it comes back with addresses and status codes only. The site being visited sees a request from Cloudflare's network identifying itself as this tool, not from you.
Some links do something the moment they are opened: unsubscribe, confirm an address, sign you in, accept an invitation, cancel an order. Many of those work exactly once. If a server opened one on your behalf, your own click afterwards would do nothing, and you would not know why. So anything that looks like one of those is read but not followed, and the choice to follow it anyway is yours, behind a box you have to tick.
A page can send you on with a line of script rather than a redirect, and this does not run scripts, so a chain can end at a page that would have kept going in a browser. Some sites answer a bot differently from a person. And where a tracking link's real destination is hidden inside a database rather than the address, only following it will show where it goes.
The times are a finding too. Every hop shows how long that server took to answer, measured from Cloudflare's network rather than from your connection, so it is the server's own delay. A tracking redirect that takes half a second is half a second added to every click on every link in that campaign, and a chain of four of them is why some links feel slow before the page even starts. The total after the last hop is what that link cost before any page loaded.
Results for a link are kept for ten minutes so a second look does not visit it again. Nothing you paste is stored. This is not a safety verdict: a link can go somewhere ordinary and still be a bad idea, and the page counts and reports rather than judges.