# Preventing malicious linking
**URL:** https://meta.discourse.org/t/preventing-malicious-linking/37982
**Category:** Feature
**Created:** [1월 15, 2016, 3:07오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982 "2016-01-15T03:07:44Z")
**Posts on this page:** 16
**Page:** 2
### Author:  [@Sudaraka](https://meta.discourse.org/u/Sudaraka)
#### Post date: [11월 25, 2017, 8:06오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/21 "2017-11-25T08:06:16Z")
Didn’t thought about that 😮 . Thats the best way I guess @codinghorror . Then i will start implementing
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [11월 25, 2017, 8:07오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/22 "2017-11-25T08:07:37Z")
Can it not be made so that there is a scheduled task every 6 months to re check the posted links which were flagged earlier?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [11월 25, 2017, 8:15오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/23 "2017-11-25T08:15:09Z")
Again why check something that has not been clicked in 3 months. All of this should key on _someone_ clicking it.
---
### Author:  [@itsbhanusharma](https://meta.discourse.org/u/itsbhanusharma)
#### Post date: [11월 25, 2017, 8:17오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/24 "2017-11-25T08:17:45Z")
That’s fair but my Question was in reference to Your idea!
if a link was flagged for the first time it was clicked and then an year later it is still flagged but safebrowsing has then whitelisted it! … when will the recheck happen? and how to determine when is the right time to do the recheck if any?
---
### Author:  [@Sudaraka](https://meta.discourse.org/u/Sudaraka)
#### Post date: [11월 25, 2017, 9:22오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/25 "2017-11-25T09:22:43Z")
In google api documentation they say that
> We are constantly updating site definitions
I think we have to recheck the URLs against the safebrowsing database in a certain time interval and flag them. We can specify multiple urls at a single time too. Thus I think a routine check will be a better option. They say ,
> Lookup API (v4): You can query up to 500 URLs in a single POST request.
> Lookup API (v4) and Update API (v4): A single API key can make requests for up to 10,000 clients per 24-hour period.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [11월 25, 2017, 7:22오후 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/26 "2017-11-25T19:22:13Z")
The only acceptable way to do this is on click, then cache result for a period of time (months).
---
### Author:  [@Sudaraka](https://meta.discourse.org/u/Sudaraka)
#### Post date: [12월 7, 2017, 5:52오후 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/27 "2017-12-07T17:52:53Z")
Hi,
I will be building a plugin for preventing malicious linking. I would like to do it in two phases.
**Phase 1 :**
- Query each link in google safe browsing API for the first time and if it is a malicious link, store the details in the plugin store.
- When the user clicks the same link after the first time, the plugin will know that the link is malicious by querying the plugin store.
**Phase 2 :**
- I will implement a way to cache the results from google API .
- Cache will be expired after a given time period.
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [12월 7, 2017, 6:36오후 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/28 "2017-12-07T18:36:40Z")
> [@Sudaraka](#):
>
> When the user clicks the same link after the first time, the plugin will know that the link is malicious by querying the plugin store.
Are you going to alert the user only on second time? You can check all the links with Google API at the time post creation itself. `DiscourseEvent` triggers can help you for that. Also you can flag the post immediately after the malicious URL detection. It will be more helpful.
>
>
---
### Author:  [@Sudaraka](https://meta.discourse.org/u/Sudaraka)
#### Post date: [12월 8, 2017, 3:48오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/29 "2017-12-08T03:48:20Z")
> [@vinothkannans](#):
>
> Are you going to alert the user only on second time?
I wanted to say that it will alert the users in the first time using the results directly from the Google’s API and after that it will use the cached results. I was thinking about the links that are not being clicked even once, if I query those links it would be a waste of resources. What do you guys think ?
@vinothkannans ?
---
### Author:  [@vinothkannans](https://meta.discourse.org/u/vinothkannans)
#### Post date: [12월 8, 2017, 5:13오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/30 "2017-12-08T05:13:17Z")
> [@Sudaraka](#):
>
> if I query those links it would be a waste of resources.
I don’t think so. We already querying almost all the links for Onebox. Is that means waste of resources? Here main objective is **Preventing** malicious linking. How will you prevent if someone opened the malicious link from email notification? What if he copied the link and opened in new browser? There are many more ways where you can’t stop users from opening the link.
---
### Author:  [@Sudaraka](https://meta.discourse.org/u/Sudaraka)
#### Post date: [12월 8, 2017, 6:13오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/31 "2017-12-08T06:13:44Z")
Good point @vinothkannans 🙄 never thought about that. So the plugin will check links when the post with the link is created . Thank you a lot for the help. I will continue posting updates.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [12월 8, 2017, 6:14오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/32 "2017-12-08T06:14:29Z")
> [@vinothkannans](#):
>
> How will you prevent if someone opened the malicious link from email notification? What if he copied the link and opened in new browser? There are many more ways where you can stop users from opening the link.
That is a good point, and a solid argument in favor of checking at post create time..
---
### Author:  [@Sudaraka](https://meta.discourse.org/u/Sudaraka)
#### Post date: [12월 13, 2017, 8:58오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/33 "2017-12-13T08:58:14Z")
Hi all,
Would it be appropriate to use the PluginStore for storing data etc : flagged post id’s and malicious urls ?
---
### Author:  [@Sudaraka](https://meta.discourse.org/u/Sudaraka)
#### Post date: [12월 22, 2017, 6:49오전 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/34 "2017-12-22T06:49:53Z")
Hi all ,
currently my plugin is showing this kind of a basic warning
It successfully identifies malicious urls and adds the warning automatically.
---
### Author:  [@Sudaraka](https://meta.discourse.org/u/Sudaraka)
#### Post date: [12월 24, 2017, 12:58오후 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/35 "2017-12-24T12:58:52Z")
Here is my plugin
> [@Plugin for Preventing Malicious Linking](https://meta.discourse.org/t/plugin-for-preventing-malicious-linking/76693):
>
> This is a simple plugin for adding a warning to posts when there are malicious urls present in the content of the post. For identifying malicious urls this plugin uses [Google Safe Browsing API V4](https://developers.google.com/safe-browsing/) . The warning appears as below For getting this plugin to work , you need to obtain an API key to access the Google Safe Browsing API . You have to follow [this](https://developers.google.com/safe-browsing/v4/get-started) guideline to get an API key. Other than the API key you need a Client ID and a Client Version. These details are used by google for …
---
### Author:  [@erlend\_sh](https://meta.discourse.org/u/erlend_sh)
#### Post date: [12월 26, 2017, 2:10오후 UTC](https://meta.discourse.org/t/preventing-malicious-linking/37982/36 "2017-12-26T14:10:59Z")
[이전 페이지](https://meta.discourse.org/t/preventing-malicious-linking/37982.md?page=1)