QR Code Safe Destination Checklist: 7 Checks Before You Publish

Printing a QR code without auditing its destination URL is like handing out business cards with the wrong phone number — except this mistake can also expose your customers to phishing pages. Most businesses skip destination verification entirely and only catch problems after a scan complaint lands in their inbox. This checklist fixes that gap before your code ships.

Why the Destination URL Is Your Biggest Security Surface

The visual design of a QR code tells a scanner nothing about where it leads. A spotless, branded code can route to a credential-harvesting page just as easily as a legitimate one. Attackers know this, which is why quishing attacks — phishing delivered through QR codes — have become a preferred technique for bypassing email filters.

Your code itself isn't the only risk. If you use a redirect layer (as with any dynamic QR code), the destination can be silently changed after printing. A destination audit needs to happen at two moments: when you first create the code, and periodically while it's live in the field.

The 7-Check Destination Audit

Run through every item below before you mark a code ready to print or publish.

1. Confirm the Protocol Is HTTPS

Open the destination URL in a browser. Check that the address bar shows a padlock and https://. An HTTP page transmits data in plain text — if your QR code leads to a login or form, that's a serious problem. Most hosting platforms have enabled HTTPS by default since 2023, but legacy microsites and internal tools sometimes still serve plain HTTP.

2. Inspect the Full URL for Lookalike Tricks

Copy the destination URL into a plain-text editor and read every character. Common substitutions to look for:

• rn in place of m (e.g., cornpany.com vs company.com)
• Unicode homoglyphs (аpple.com with a Cyrillic "а")
• Extra hyphens or subdomains (brand.login.attacker.com)
• TLD swaps (yoursite.co instead of yoursite.com)

If you're using a URL shortener or redirect, expand it first with a tool like urlex.org before running this check.

3. Test the URL in Google Safe Browsing

Paste the full destination URL into Google's Transparency Report checker (transparencyreport.google.com/safe-browsing/search). This database flags sites known for malware, phishing, and deceptive content. It takes ten seconds and catches URLs that look legitimate but are already blacklisted.

4. Check the Domain Registration Age

A domain registered in the last 30–60 days is a yellow flag, especially if your destination is a third-party landing page built by an agency or partner. Use any WHOIS lookup to see the creation date. Attackers frequently register fresh domains for campaigns because aged, trusted domains are expensive. If a partner is building your page on a brand-new domain, ask why.

5. Verify Ownership of Every Redirect in the Chain

Dynamic QR codes often route through: your QR platform's shortlink → your redirect URL → the final page. Each hop is a potential handoff point. Log into your QR platform dashboard, trace every redirect layer, and confirm you control — or explicitly trust — each domain in the chain. A code that routes through an intermediary you don't recognise is a code you shouldn't print.

Understanding the difference between static and dynamic codes matters here: with static QR codes, the final URL is baked in and can't be changed, which removes redirect-layer risk but adds its own limitations. The static vs dynamic QR codes comparison is worth reading if you're unsure which architecture fits your risk tolerance.

6. Test the Destination on a Mobile Device

Desktop browsers hide a lot of redirect behaviour. Open the URL on an Android device and separately on an iPhone. Confirm:

• The page actually loads (no server error)
• The page shown matches what you intended
• No unexpected permission requests appear (camera, location, contacts)
• The final URL in the mobile browser matches the expected destination

This step also catches device-specific redirects that only fire on mobile — a technique phishing pages sometimes use to evade desktop-based security checks.

7. Screenshot and Record the Destination Before Publishing

Take a dated screenshot of the live destination page and save it alongside your campaign files. This gives you a baseline to compare against during periodic re-audits. If a partner or platform later modifies the page, you'll have evidence of what it was supposed to show. For high-volume campaigns, a simple spreadsheet listing each code's ID, short URL, destination URL, and audit date is enough.

Ongoing Monitoring After the Code Is Live

A one-time audit at launch isn't sufficient for codes on printed materials that stay in the field for months. Set a calendar reminder to re-run checks 2 and 3 on your highest-traffic codes every 30 days. If your QR platform includes scan analytics, watch for sudden geographic anomalies or unusual spike patterns — these can signal that a destination has been redirected somewhere you didn't intend.

For physical codes on permanent signage, also review the guidance on detecting and preventing tampering, since destination audits alone won't catch a sticker placed over your original code.

You can build all of this into a repeatable pre-launch process using our QR code generator — create the code, record the destination, run the seven checks, then approve for print.

Key Takeaways

• Always verify https:// and inspect the destination URL character by character before publishing any QR code.
• Expand shortened URLs and trace every redirect hop to confirm you control or explicitly trust each domain.
• Use Google Safe Browsing to check for blacklisted destinations — it's free and takes seconds.
• Young domains (under 60 days) on landing pages built by partners deserve extra scrutiny.
• Test on both iOS and Android, not just a desktop browser.
• Document the destination with a dated screenshot to enable future comparison audits.
• Re-audit live codes every 30 days, not just at launch.