The problem
A short link hides where it goes. That is what makes it useful, and it is also what makes it the most dependable delivery mechanism abuse has. The standard defence is a single check at the moment the link is created, which catches the careless and misses the patient. The damaging link is almost never the one that was hostile on day one — it is the one that pointed somewhere harmless in March and at a credential-harvesting form in April. Nothing looked at it again, so it carried on resolving, carried on being trusted, and by then it was printed on a poster and a business card where it could not be recalled. Between the destination turning and somebody getting round to reporting it, the link works perfectly. The plumbing makes it worse: a shortener that issues a permanent redirect has handed every browser a cached instruction it will keep obeying, so revoking the link does not reliably stop the traffic it sends.
The approach
Three checks, none of which can be switched off — built against a predecessor that had every guard behind a setting and every setting turned off. A destination is screened before the short link exists, and if the screening provider errors the link is held rather than published: it fails closed, which costs sign-ups and is precisely the point. It is re-screened every hour for the life of the link, so a destination that turns hostile on Thursday stops resolving on Thursday rather than whenever a victim files a report. And the verdict is read again at the redirect, which is what makes revocation immediate instead of eventual. Every redirect is a 302 and never a 301, deliberately: the tidier status code is cached by the browser and quietly removes the ability to kill a link at all. Screening runs on every plan including the free one, because charging extra for not sending someone to malware is not a feature tier. The same discipline runs through everything else — QR codes that encode the short link rather than the destination, so a printed run can be repointed without reprinting it; branded domains that serve nothing until a TXT record proves ownership; click data written append-only and read from daily rollups; an API reference generated from the same file the contract tests read, so a code sample cannot describe an endpoint that is not there. Even the free tools are the argument rather than the marketing: the link expander and the safety checker are given away running the same screening, on the reasoning that anyone who finds those useful has already understood the product.
Who built it
ShortenURL was founded and built by Abdul Rehman Sandhu, a qualified accountant and technology advisor working with businesses globally. The same diagnostic approach behind this venture is the one applied in client engagements.