ForHosting KIT · Validation

Screen a link for danger

Every link your app renders, stores or forwards is a liability the moment someone else controls the destination. The malicious URL checker API expands redirects, inspects the final destination and returns a clear verdict so you can hold, warn or drop a link before it reaches a user's screen.

● BetaPer request + per item$0.002

Run — $0.002 How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Run it online

Run this on our servers with your account. Free tools run in your browser; this one bills your KIT balance per the price above.

Who ends up needing this

Teams that accept user-submitted links are the obvious case: chat apps, forum software, ticketing systems, comment sections, browser extensions. Less obvious but just as common are email platforms rewriting links at send time, ad networks vetting creative URLs, and internal tools that ingest URLs from spreadsheets or CRM exports nobody has looked at closely. Anywhere a URL crosses a trust boundary, this endpoint has a job to do.

What actually happens to a URL

Submit a URL to POST /verify/url-safe and the task walks the redirect chain to its true endpoint, since attackers routinely hide a malicious page behind two or three legitimate-looking hops. It checks the resolved host and path against known bad-URL patterns, evaluates structural red flags such as lookalike domains, punycode tricks and suspicious TLD combinations, and returns a verdict with the specific signals that drove it, not just a bare score.

A short history of a long problem

URL-based attacks have outlived nearly every other web threat category because the fix is structurally hard: a URL is just text until something resolves it, and by then the damage window has often opened. Shortened links made it worse by hiding destinations entirely, and redirect chains through ad-tech and tracking infrastructure now routinely add legitimate-looking hops attackers exploit deliberately. The result is that eyeballing a URL has stopped being a reliable defense for years, which is exactly the gap automated verification fills.

Fitting it into a pipeline

Because the task is asynchronous, you fire the request at the moment a URL is submitted or ingested and move on; the verdict lands on your webhook, or you fetch it from a signed link valid for 24 hours if you prefer to poll. Failed checks are never billed, three retries happen automatically, and a request that still can't complete returns a clear error rather than a silent gap, which matters when the check is standing between a user and a click they cannot take back.

What it deliberately does not do

This endpoint judges the URL itself, not the page's full content for brand impersonation or the sender's reputation history; pair it with verify.phishing when you need a content-level read on a landing page or an email. Keeping the two separate keeps this check fast and cheap enough to run on every single link at submission time, rather than only sampling a fraction of your traffic.

What you can do with it

Chat and messaging apps

Scan links the moment a user pastes them into a conversation, so a malicious redirect gets flagged before anyone else in the thread taps it.

Support and ticketing tools

Check URLs attached to inbound tickets automatically, since agents handling high volume are prime phishing targets via crafted attachment links.

Comment sections and forums

Hold posts containing unverified links for a beat, catching spam and malware droppers before they reach public view.

Bulk link audits

Sweep a spreadsheet of URLs collected from old campaigns or scraped sources to find which ones now resolve to compromised or abandoned domains.

FAQ

Is there a free tier for the malicious URL checker API?

There's no free tier — free tiers get abused and slow everyone down. Access runs on a prepaid ForHosting KIT balance: top up from $10.00 (it never expires) and each request is charged at its published price, so a call with no balance returns HTTP 402. No subscription, no tokens, no invented credits, and a failed task is never charged.

How much does a URL check cost?

$0.002 per request, billed only on success. Retries on a failed check happen automatically and you are never charged for a check that didn't complete.

How do I get the result?

By signed webhook, which we recommend for production pipelines, or by fetching a signed link that stays valid for 24 hours if you'd rather poll.

Does it follow redirect chains?

Yes, the task resolves the URL to its final destination before evaluating it, since the submitted link is often not where a click actually lands.

Can I check URLs in bulk?

Yes, call the endpoint per URL as fast as your integration allows; each call is an independent async task with its own task_id.

Does this replace phishing content analysis?

No. This endpoint evaluates the URL and its resolution path; for scoring a page or email's phishing signals, use verify.phishing alongside it.

What response times should I expect?

The task runs asynchronously and returns a task_id immediately; actual check time depends on redirect depth, and the webhook fires as soon as the verdict is ready.

Is my submitted URL data kept?

No, data is deleted after the retention window and is never used for training, regardless of the verdict returned.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/verify/url-safe

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/verify/url-safe \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/verify/url-safe", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/verify/url-safe",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/verify/url-safe", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/verify/url-safe", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "verify.url_safe",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →