Understanding URLs

By Martin Edwards

Last updated July 2018

You might not know it’s called a URL, but you’ve probably seen one:

https://en.wikipedia.org/wiki/Tapir

A uniform resource locator (URL) identifies a particular website, or a particular page or feature within a website. Knowing how to interpret a URL is probably the best way to tell whether a site is genuine or bogus.

Part 1: https

The first part of a URL is either http or https followed by a colon and two slashes. The latter means that your communication with the site is protected against eavesdropping or interference by your Internet provider, employer, someone else on the coffee shop Wi-Fi, and so on:

https://en.wikipedia.org/wiki/Tapir

In 2018 we’re seeing the tipping point in a movement to protect all websites with https, and to reflect this, browsers will soon no longer show this part of the URL. https will continue to be indicated by a padlock icon, and plain old http will be indicated by a warning like ‘not secure’.

Note that the padlock doesn’t guarantee you’re on a genuine website. A bogus site can just as easily use https. It’s no consolation knowing your message is private if the party you’re sending it to isn’t who you think it is!

Part 2: the domain name

This is the important bit. The domain name continues until either a slash or the end of the URL, whichever comes first. In our example, it’s en.wikipedia.org:

https://en.wikipedia.org/wiki/Tapir

Computers actually read domain names from right to left, separating them at the dots. Usually, the rightmost part – or two – indicates a country and/or type of organisation. These are called top-level domains:

The part immediately to the left of the top-level domain is typically the name of the organisation:

Note: There are exceptions, like diy.com for do-it-yourself retailer B&Q.

Combining these parts, we have full domain names:

These are the best indicator of the legitimacy of a site. Remember, what matters is the sections immediately before the first single slash (or end of the URL):

https://blogs.unicef.org/blog/ukraines-water-heroes/

Bogus domains

Fake or malicious sites might use a misspelling of a genuine domain:

Special cases

I wanted this guide to be really short, but it would be foolish of me not to explain a few common caveats that make interpreting URLs harder in some cases.

Strange-looking but genuine subdomains

Sometimes, you’ll see subdomains like this:

https://secure-appldnld.apple.com/itunes12/

Is this the real Apple website? Yes! Check the rightmost part of the domain. Apple has simply chosen to use a server called secure-applednld; can you work out what it’s an abbreviation of?

Trick subdomains

On the other hand, a crafty bogus site might use a subdomain in this fashion:

http://www.bbc.co.uk-news-health-39217858.martinedwards.co.uk

Is this the real BBC website? No! At a glance, it looks like it might be an article in the Health section, but there’s no slash after bbc.co.uk — the domain name continues, in this case to the end of the address. It’s an elaborate one that in fact resolves to the server hosting this site, martinedwards.co.uk. If I was so inclined, I could create a page at this URL, mimicking the BBC but with some malicious software thrown in!

Redirects

A domain name that looks suspicious at first might actually redirect you to a genuine site. For example, if you’re on John Lewis’s mailing list, the emails you receive might contain links to promotions that look like this:

https://johnlewis.us13.list-manage.com/track/click?u=eef5926

This site is genuine. The domain list-manage.com is used by email marketing company MailChimp to track which subscribers click which links in an email, to help the owner of the mailing list (like John Lewis in this example) learn more about its customers.

Shorteners

Some companies use shorteners to make URLs that are more compact and easier to communicate. These are really just redirects, but are increasingly common so deserve a special mention. For example:

Trick hyperlinks

This isn’t a URL issue per se, but a link in an email or website may be made to look like a URL that’s different from its actual destination. Try clicking this link and see where it takes you (it’s harmless, just not what you expect):

https://www.bbc.co.uk

You can usually reveal the true destination of a link by hovering your mouse over it or, on a phone or tablet, long-pressing it (i.e. pressing and holding for a second or two).

Need help?

I’m a computer technician and tutor serving North Oxford, Kidlington, Woodstock and the surrounding villages. Visit my home page to find out more and get in touch.