A short link looks like magic: ten characters that open a page with a URL a hundred times longer. There's no magic — just a database row and a single HTTP redirect. Understanding that mechanism tells you why some short links help your SEO and analytics, why others are used to hide phishing pages, and how to tell a trustworthy short link from a dangerous one.
How a URL shortener actually works
A URL shortener does one deceptively simple job: it maps a short, memorable path to a long destination URL and forwards visitors there. The whole flow takes three steps:
- You submit a long URL. The service generates a unique slug — a short string like
x7Qk2— and stores a row linking that slug to your destination in its database. - You share the short link, for example
https://sho.rt/x7Qk2. Nothing is embedded in the slug itself; it's just a lookup key. - Someone clicks. Their browser requests the short URL, the shortener looks up the slug, and it answers with an HTTP redirect (a
3xxstatus plus aLocationheader pointing to your long URL). The browser then loads the real destination.
That redirect is the entire product. The short domain never serves your content — it only tells the browser where to go next. Because every click passes through the shortener's server first, the service gets a chance to count the click and decide where to send the visitor before handing off. That single interception point is what makes shorteners so useful for analytics, and also what makes them attractive to bad actors.
301 vs 302: the redirect that changes everything
Not all redirects behave the same, and for short links the choice of status code has real consequences. The two you'll meet are the 301 Moved Permanently and the 302 Found (or its stricter sibling 307 Temporary Redirect).
A 301 tells browsers and search engines that the move is permanent. Browsers cache it aggressively — often indefinitely — so after the first visit a user's browser may jump straight to the destination without ever contacting the shortener again. That's great for speed and SEO, but it means you can no longer change where that short link points, and you stop seeing new clicks.
A 302/307 is a temporary redirect. Browsers don't cache it hard, so every click keeps flowing through the shortener. That preserves two things shorteners depend on: the ability to edit the destination later and the ability to record every click for analytics.
| Redirect | Browser behavior | Editable destination? | Reliable analytics? | SEO equity |
|---|---|---|---|---|
301 Permanent | Cached hard, may skip shortener | No — effectively locked once cached | Undercounts after first click | Passes nearly all link equity |
302 Found | Not cached, hits shortener each time | Yes | Yes — every click recorded | Historically passes equity too |
307 Temporary | Not cached, method preserved | Yes | Yes | Treated as temporary |
301 when a short link is a permanent, unchanging alias and SEO matters most; use a 302/307 when you need editable destinations, accurate click counts, or campaign tracking. Most commercial shorteners default to a temporary redirect precisely so their analytics stay accurate.What short links are good for
Shortening isn't just about saving characters. Done well, a short link gives you:
- Cleaner, shareable links. A tidy slug survives being pasted into chat, printed on a flyer, or read aloud far better than a URL stuffed with query parameters.
- Branded domains. A short link on your own domain signals legitimacy and reinforces your brand every time it's seen.
- Click tracking. Because clicks route through the shortener, you get counts, referrers, devices, and rough geography without touching the destination site's code.
- UTM tagging. The shortener hides long tracking parameters behind a clean slug, so your analytics stay rich while the shared link stays neat.
- QR pairing. Short URLs produce simpler, more scannable QR codes, and an editable short link lets you change where a printed QR points without reprinting it.
Link safety: risks and how to check
The same property that makes shorteners useful — hiding the real destination behind an opaque slug — is exactly what makes them a favorite tool of attackers. Treat every unfamiliar short link with healthy suspicion.
Obfuscation and phishing
A short link reveals nothing about where it leads. Phishing campaigns exploit this to disguise a malicious login page or malware download as a harmless-looking link. You cannot judge a short URL by its host, because the host is just the shortener.
Link rot
Short links are only as durable as the service behind them. If the shortener shuts down or a free plan lapses, every link it ever created can break at once — a real risk for anything printed or archived. Several large shorteners have gone dark over the years, taking millions of links with them.
Loss of trust
Because generic shorteners are so heavily abused, some email filters and security tools automatically flag or block them, and cautious users simply won't click. That hurts legitimate senders as much as it slows attackers.
How to preview a short link before clicking
Never click a suspicious short link blind. Instead, expand it first:
- Use a redirect tracer. Paste the short URL into a tool that follows the
3xxchain server-side and shows every hop plus the final destination — without loading the page in your browser. - Try the preview trick. Many shorteners show a preview page instead of forwarding if you append a character (often
+) to the short URL. - Inspect the destination domain. Once expanded, judge the real host: is it the brand you expected, served over
https://, with a plausible path?
Branded and custom short domains
A branded short domain swaps a generic third-party host for a short domain you own — think go.yourbrand.com/spring-sale instead of an anonymous slug on a shared service. This matters for two concrete reasons.
First, trust and click-through. Recipients recognize your name in the link, so they're more willing to click, and studies of marketing links consistently show branded short domains lifting click-through rates over generic ones. The link itself becomes a small piece of brand reinforcement.
Second, ownership and durability. When you control the domain, the links keep resolving even if you change shortening providers, and you're insulated from a third party's blocklisting or shutdown. You also control the redirect behavior, HTTPS certificate, and analytics rather than renting them.
Tracking, UTM tags, and analytics
Two layers of measurement work together on a shortened link.
Shortener-side counts. Because every click hits the redirect server, the shortener records the total number of clicks and metadata like referrer, device type, and approximate location. This is the fastest way to answer “how many people clicked this specific link?”
Destination-side attribution with UTM. To connect clicks to sessions and conversions in your own analytics, append UTM parameters to the destination URL before you shorten it:
| Parameter | Answers | Example value |
|---|---|---|
utm_source | Where the traffic came from | newsletter |
utm_medium | The channel type | email |
utm_campaign | Which campaign | spring_sale |
utm_content | Which link variant | header_cta |
The shortener hides all of that query-string clutter behind a clean slug, so recipients see a neat link while your analytics platform still attributes every visit to the right source, medium, and campaign. Crucially, this only works when the shortener uses a temporary redirect it can measure — a hard-cached 301 that skips the server after the first click will quietly undercount.
Best practices for shortening links
- Always use HTTPS on both the short domain and the destination, so the redirect and the landing page are both encrypted.
- Pick a reputable or branded service. A trusted or self-owned short domain avoids the blocklisting and shutdown risks that plague throwaway free shorteners.
- Use meaningful slugs where you can —
/spring-salereads and converts better than/x7Qk2, and gives recipients a hint of where they're going. - Choose the right redirect. Temporary (
302/307) for anything you might edit or need to track; permanent (301) only for stable aliases. - Tag with UTM parameters before shortening so campaign data flows into your analytics.
- Monitor for abuse. Watch click patterns for spikes that suggest your link is being used in spam, and expand any short link you didn't create before you click it.
Shorten links the right way
URL Unicorn, our sister product, creates clean, trackable short links on branded domains — with editable destinations, click analytics, and QR pairing built in.
Shorten a link with URL Unicorn →Frequently asked questions
Are short links safe to click?
Do URL shorteners hurt SEO?
How do I see where a short link goes before clicking?
What is a branded or custom short domain?
go.yourbrand.com/sale. Because it's recognizable and owned by you, recipients trust it more and click-through rates rise. The links also keep working even if a third-party shortener disappears.