Anatomy of a URL

You probably know what a URL is, but do you know how to read it? Knowing the anatomy of a web address is the difference between logging into your bank and handing your credentials to a scammer.

Let’s break it down. A URL has five main parts: the protocol, the domain, the path, the query string, and the fragment. The last three are optional. If you just type apple.com, you’re hitting the homepage. No path, no extras.

The first part is the protocol. You’ll see either http or https. That “s” stands for secure. Practically every legitimate website uses https now. If you see http, that’s a red flag. It could be a phishing site. There are rare exceptions—like a local printer’s status page on your home network—but for anything involving money or personal data, https is non-negotiable.

Next is the domain. This is where it gets tricky. Take www.bank.com. The www is the subdomain, bank.com is the actual domain, and .com is the top-level domain (TLD). TLDs include .com, .net, .org, and .gov.

Here’s the critical part: scammers exploit the subdomain. They can register www.bank.com.sketchy.net. If you skim the URL and see https://www.bank.com, your brain goes, “That’s my bank,” and you click. But you’re actually going to sketchy.net. The bank.com part is just a subdomain on a malicious host.

After the domain, you might have a path, like /login. This tells the server which resource you want. Then there’s the query string, marked by a ?. It looks like ?name=value and can have multiple pairs, like ?forgot_password=true&last_try=false. The server uses this to adjust what it shows you—maybe a password reset screen instead of the main login page. Finally, the fragment (marked by a #) is for navigating within a page and doesn’t get sent to the server.

The takeaway? Careful clicking links people send you, especially for banking. Bookmark your bank’s website. If you’re ever in doubt, check the TLD and the full domain carefully. A quick glance at https and bank.com isn’t enough. Read the whole thing.