Reference

    Link Shortening Glossary

    246 terms covering URL anatomy, redirects, analytics, UTM tracking, QR codes, security, APIs, and account management — explained in plain English.

    Backed by 20 cited sources — RFCs, W3C, ISO, GDPR, and platform docs

    Core Concepts & URL Anatomy

    29 terms
    Long URL / Destination URL#
    The full web address that a short link redirects to. Also called the target URL or destination, it is where a user ultimately lands after clicking or scanning the short link. Long URLs often contain tracking parameters, product IDs, filters, session-independent state, or other structured data that can make them difficult to share directly.
    Original URL#
    The URL as entered by the user when creating a short link. In many platforms this is synonymous with long URL, destination URL, or target URL. In some workflows, the original URL may later differ from the current destination if the short link supports destination editing.
    Target URL#
    The active URL to which a short link currently redirects. The target URL may be the same as the original URL or may be changed later if the platform supports editable destinations.
    Slug#
    The unique character sequence appended to a short link's domain that identifies a specific link record. In `https://sho.rt/abc123`, the slug is `abc123`. Slugs can be generated automatically, usually as random or sequential alphanumeric strings, or manually defined by the user as a custom alias.
    Custom alias#
    A user-defined slug chosen to make a short link more readable, memorable, or campaign-specific. Instead of a random string like `x7k9p`, a custom alias might be `summer-sale`, `event-rsvp`, or `product-launch`. Custom aliases are usually subject to availability, length rules, reserved-word restrictions, and plan limits.
    Custom back-half#
    An industry term for the user-defined portion of a short link that comes after the domain. In `https://brand.co/summer-sale`, the custom back-half is `summer-sale`. This term is commonly used by link management platforms and is effectively equivalent to a custom alias.
    Reserved alias#
    A slug or custom alias that cannot be used because it is already taken, protected by the platform, reserved for system routes, restricted for brand or abuse reasons, or considered offensive or misleading. Examples may include `admin`, `login`, `support`, or aliases that impersonate major brands.
    Vanity URL#
    A branded, human-readable URL designed to be memorable and trustworthy. In link management, a vanity URL often combines a branded domain with a custom alias, such as `https://brand.co/summer-sale`. More broadly, the term can also refer to any memorable marketing URL, even when it is not produced by a link shortening platform.
    URL shortener#
    A service, application, or tool that takes a long web address and produces a shorter one that redirects to the same destination. URL shorteners keep a record of which short link maps to which destination and handle the redirect each time someone clicks. You may also see this described informally as "URL compression," though nothing is technically compressed — the short link simply acts as an alias that points to the original address. Examples include Bitly, TinyURL, Rebrandly, Short.io, and similar platforms.
    Domain#
    The registered web address used in a URL. In `https://sho.rt/abc123`, the domain is `sho.rt`. URL shortening services may offer shared default domains and allow customers to configure custom domains for branded short links. [1]
    TLD / Top-level domain#
    The final segment of a domain name, such as `.com`, `.org`, `.io`, or `.ly`. Short-link brands often choose short or memorable TLDs, but the choice of TLD can affect user trust, brand perception, cost, and availability. [1]
    Root domain / Apex domain#
    The base registered domain without a subdomain, such as `example.com`. Some shorteners support using an apex domain for short links, while others recommend a subdomain such as `go.example.com` to avoid interfering with the main website. [1]
    Custom domain#
    A domain owned or controlled by the user and configured to serve short links instead of using the shortening service's default shared domain. Custom domains improve brand recognition, user trust, and long-term portability. Example: using `go.yourcompany.com` instead of `bit.ly`.
    Branded domain#
    A custom domain chosen specifically to reinforce a company, product, campaign, or organization identity. Branded domains are often short, memorable, and aligned with the brand name. Functionally, they are custom domains with a branding purpose.
    Subdomain#
    A prefix added before a root domain, separated by a dot. In `go.yourcompany.com`, `go` is the subdomain. Subdomains are commonly used for short links because they let organizations create branded link namespaces without changing their main website domain. [1]
    Path#
    The portion of a URL that follows the domain and identifies a location, resource, or route. In `https://example.com/products/shoes`, `/products/shoes` is the path. In a short link, the path often consists only of the slug, such as `/abc123`. [1]
    Query string#
    The portion of a URL beginning with `?` that contains key-value parameter pairs. Example: `?color=blue&size=medium`. Query strings are commonly used for tracking, filtering, search state, personalization, and feature flags. Link shorteners may preserve, append, merge, or strip query strings depending on configuration. [1]
    URL parameters#
    Individual key-value pairs within a query string, separated by `&`. Example: `utm_source=newsletter`. URL parameters are widely used for analytics, campaign attribution, personalization, product filtering, and application behavior. [1]
    Fragment / Anchor#
    The portion of a URL following a `#` symbol, used by browsers to navigate to a specific section or state within a page. Example: `https://example.com/page#section-3`. Fragments are processed by the browser and are not sent to the server in normal HTTP requests, which can affect how they interact with redirects and tracking. [1]
    Protocol / Scheme#
    The first part of a URL that indicates how the resource should be accessed. Common examples include `http://`, `https://`, `mailto:`, and custom app schemes such as `myapp://`. Short links nearly always use HTTPS for security and trust. [1]
    HTTP#
    Hypertext Transfer Protocol, the standard protocol used by browsers and web servers to exchange web content. Plain HTTP is not encrypted, so modern browsers may warn users when forms, logins, or sensitive pages are served over HTTP. [2]
    HTTPS#
    HTTP Secure, which uses TLS encryption to protect data in transit between a browser and a server. Reputable link shortening services serve short links over HTTPS to protect users, support modern browser expectations, and improve trust. [2] [3]
    Canonical URL#
    The "official" version of a web address for a piece of content. When multiple URLs — including short links, tracked links, or slight variations — all point to the same page, the canonical URL is the one that search engines and analytics tools should treat as the primary address. Declaring a canonical URL helps avoid confusion or duplicate-content issues in search rankings. [4]
    URL encoding / Percent encoding#
    The process of converting characters that can't safely appear in a web address into a standardized stand-in format. For example, a space becomes `%20`, and an ampersand used inside a value gets converted so it isn't mistaken for a separator. This happens automatically in most tools, but it's worth knowing about when shortening URLs that contain tracking parameters or special symbols. [1]
    IDN / Internationalized domain name#
    A domain name that uses characters outside the standard Latin alphabet, such as accented letters, Arabic, Chinese, or other scripts. While this helps with localization, it can also create security risks — some characters from other alphabets look nearly identical to familiar Latin letters, making it possible to create deceptive domains that appear to be legitimate ones. [5]

    Redirects & Routing

    30 terms
    Redirect#
    The behind-the-scenes process that sends someone who clicks a short link to the actual destination page. When you visit a short link, your browser receives a quick instruction from the server saying "go here instead," then takes you to the destination — usually so fast you don't notice the step in between. [2]
    Location header#
    A behind-the-scenes instruction included in a server's redirect response that tells the browser which URL to go to next. Users never see this directly — it's part of the technical exchange that makes redirects work. [2]
    301 redirect / Permanent redirect#
    A type of redirect that signals the move to a new address is permanent. Browsers and search engines may remember a 301 redirect and go directly to the destination on future visits, which can mean some clicks don't pass through the shortener. This also affects how search engines transfer ranking credit to the destination page. [2]
    302 redirect / Temporary redirect#
    A type of redirect that signals the destination may change in the future. Because browsers don't permanently memorize a 302, every click continues to pass through the shortener — which is why most link shortening services use 302 redirects by default. It also means the destination can be updated at any time without breaking the link. [2]
    307 redirect / Temporary redirect with method preservation#
    A temporary redirect that preserves the exact type of request being made. This is mainly relevant for developers building integrations — for everyday link shortening, a standard 302 redirect is used instead. [2]
    308 redirect / Permanent redirect with method preservation#
    A permanent redirect that also preserves the exact type of request being made. Like the 307, this is mainly relevant in technical or developer contexts rather than everyday link management. [2]
    Meta refresh redirect#
    A redirect triggered by an instruction embedded in a web page itself, rather than by the server. The page tells the browser "go to this other address in X seconds." This method is slower and less reliable than a server-side redirect and is rarely used by modern link shortening services. [4]
    JavaScript redirect#
    A redirect triggered by code running in the browser. It can support complex logic but is generally slower and less reliable than a server-side redirect — and it won't work for users who have JavaScript disabled or for bots and search engine crawlers.
    Server-side redirect#
    A redirect handled by the server before any page content is sent to the browser. The server simply says "go here" and the browser follows. This is the fastest and most reliable method, and it's what virtually all link shortening services use. [2]
    Client-side redirect#
    A redirect that happens inside the browser after part of a page has already loaded, typically through JavaScript or a meta refresh instruction. These are slower and less consistent than server-side redirects.
    Redirect chain#
    A sequence of multiple redirects needed to reach the final destination. Example: short link -> tracking link -> affiliate network -> landing page. Redirect chains increase latency, complicate analytics, and can reduce reliability. Best practice is to minimize unnecessary hops.
    Redirect loop#
    An error condition in which one URL redirects back to itself or to another URL that eventually redirects back again, creating an infinite cycle. Browsers usually stop after a limited number of redirects and display an error. [2]
    Pass-through redirect#
    A redirect that automatically carries any extra tracking information from the short link over to the destination URL. For example, if someone shares your short link with a campaign code appended, that code gets passed along to the landing page automatically.
    Parameter forwarding#
    The process of copying tracking values or other information from the short link's address to the destination URL. Platforms may let you forward all values, only selected ones, or merge them with values already on the destination.
    Cloaking#
    When a short link hides or obscures the true destination from the person clicking it. All short links do this to some degree by design — you can't see the full destination before clicking. The term has a negative meaning when it's used deliberately to hide harmful, deceptive, or policy-violating destinations. Preview pages, branded domains, and destination scanning help reduce this risk.
    Smart redirect#
    A redirect that automatically sends different visitors to different destinations based on context — such as what device they're using, where they are in the world, or what time it is. A single short link might send iPhone users to the App Store, Android users to Google Play, and desktop users to a website.
    Device-based redirect#
    A smart redirect that routes visitors to different destinations based on the type of device or operating system they're using — such as desktop, iPhone, or Android.
    Geo-targeting redirect#
    A smart redirect that sends visitors to different destinations based on their location, such as their country, region, or city. Commonly used to show localized offers, the right language version of a page, or region-specific content.
    Language-based redirect#
    A smart redirect that routes visitors to different destinations based on the language their browser is set to. This helps send users to the version of a page that's written in their preferred language.
    Time-based redirect#
    A redirect that changes where it sends people based on the date or time. Useful for countdown campaigns, event registrations that close at a deadline, flash sales, or post-event pages that replace the original destination automatically.
    Rules engine#
    A system inside a link management platform that evaluates conditions — like device type, country, language, time, or where the click came from — and decides which destination to send the visitor to. Rules engines power smart redirects and complex routing logic without requiring code.
    Fallback URL#
    A backup destination that receives visitors when the primary destination isn't available, has expired, or doesn't match any routing rules. Fallback URLs prevent dead ends and help ensure visitors always land somewhere useful.
    Destination override#
    A rule that changes the default destination of a link under specific conditions, such as when a certain parameter is present, when the visitor is in a particular location, or when a campaign has ended.
    Interstitial page#
    A page shown briefly between a short link and its final destination. Interstitial pages might display a branded transition, a safety notice, an age gate, a password prompt, or a preview of the destination before the visitor continues.

    Analytics & Tracking

    35 terms
    Click tracking#
    The process of recording data each time someone clicks a short link. This typically captures when the click happened, what device was used, roughly where in the world the person was, what website or app they came from, and other useful details.
    Click count#
    The total number of times a short link has been clicked within a given period. This is the most basic measure of link activity, though it may include repeat clicks and automated traffic unless filtered.
    Total clicks#
    The raw count of all click events recorded for a short link, including repeat visits from the same person and automated traffic. Total clicks show overall volume but may be higher than the number of actual people reached.
    Unique clicks#
    An estimate of how many distinct individuals clicked a link. Because it's difficult to identify people with certainty online, this is typically estimated using a combination of IP address, browser information, and other signals. Treat this as a useful approximation rather than an exact count.
    Raw clicks#
    All click events recorded before any filtering or cleaning. Raw clicks may include real visitors, automated bots, security scanners, duplicate clicks, and internal testing activity.
    Filtered clicks#
    Clicks remaining after the platform removes known bots, duplicate events, internal traffic, and other activity that doesn't represent genuine visitors. Filtered clicks give a cleaner picture of real human engagement.
    Human clicks#
    Clicks that the platform has determined are most likely from real people rather than automated systems. This classification uses signals like browser behavior, IP reputation, and device patterns — it's a best estimate, not a guarantee.
    Click-through rate (CTR)#
    The percentage of people who see a link and actually click it. Calculated as clicks divided by impressions, multiplied by 100. CTR is widely used to measure how compelling a message, ad, or call to action is.
    Impression#
    A single instance of a link, ad, or post being displayed to someone. CTR is calculated using impressions as the baseline. Link shorteners can track clicks, but they can't always measure impressions — that data usually comes from the platform where the link was shown.
    Referrer / Referring URL#
    The website or app that a visitor came from before clicking a short link. For example, if someone clicks your link in a newsletter, the referrer might show as your email platform. Note that privacy settings, certain apps, and browser policies sometimes hide this information, causing clicks to show up as "direct" or "unknown." [2]
    Traffic source#
    The channel or origin that sent visitors to a short link — such as email, social media, paid advertising, or a partner website. Traffic source is typically identified through referrer data, UTM parameters, or click IDs.
    Direct traffic#
    Clicks where no referrer information is available. This can happen when someone types a URL directly, clicks a link in a messaging app, copies and pastes a link, or visits from an environment that strips referrer data. Direct traffic is often larger than expected for this reason.
    Geographic data / Geo data#
    Location information inferred from a visitor's IP address at the time of a click. It typically includes country, region, and city. This is an approximation — VPNs, shared networks, and mobile carriers can affect accuracy.
    Browser data#
    Information about which browser or app was used to click a short link, such as Chrome, Safari, or Firefox. This comes from information the browser sends automatically with each request.
    Device type#
    The category of device used to click a link — such as desktop computer, mobile phone, or tablet. Device data helps with understanding your audience and setting up smart redirect rules.
    Operating system#
    The software running on the visitor's device, such as Windows, macOS, iOS, or Android. This is often used alongside device type to understand your audience or route mobile users to the right app store.
    User agent#
    A string of text that browsers and apps automatically send with every web request, describing what software and device is being used. Link platforms use this to determine device type, browser, and operating system — and to help identify bot traffic. User agents can sometimes be incomplete or altered for privacy. [2]
    IP address#
    A number that identifies the device or network making a request. Link shorteners use IP addresses to estimate location, detect bots, count unique visitors, and enforce security rules. IP addresses can be shared among many users (like on a corporate network) or hidden by a VPN, and may be considered personal data under privacy laws in some regions. [8]
    Time of click#
    The date and time recorded when a click event occurs. Platforms typically store this in a universal time standard and display it in your account's time zone. Time-of-click data helps you understand when your audience is most active.
    Session#
    A period of user activity grouped together by an analytics system. Link shorteners track individual clicks; session-level data (like pages visited after clicking) is usually captured by the analytics platform on the destination website.
    Conversion#
    A meaningful action taken by a visitor after clicking a link — such as making a purchase, signing up, downloading a file, or submitting a form. Conversions are the ultimate measure of whether a link campaign actually achieved its goal.
    Conversion tracking#
    The process of measuring how many people who clicked a link went on to complete a desired action. This typically requires adding a small tracking snippet to the destination page or connecting the shortening service to an analytics or advertising tool.
    Post-click tracking#
    Tracking what visitors do after they land on the destination page — such as browsing, filling out a form, or making a purchase. This requires instrumentation on the destination website and is separate from what the link shortener records.
    Attribution window#
    The time period during which a click can receive credit for a later conversion. For example, a 7-day attribution window means a link click gets credit for a purchase if it happens within seven days of the click.
    Engagement rate#
    A measure of how meaningfully visitors interact with content, beyond simply clicking a link. Depending on the tool, engagement rate might factor in time spent on page, how far they scrolled, whether they converted, or other actions.
    Dashboard#
    The main screen in a link management platform where you can see analytics, manage your links, monitor campaign results, and access settings. Dashboards typically show top-level metrics like total clicks over time, your most-clicked links, where visitors came from, and what devices they used.
    Real-time analytics#
    Analytics data that updates within seconds of a click occurring. Real-time analytics are especially useful during live events, product launches, or time-sensitive campaigns where you need to react quickly.
    Historical data#
    Stored analytics data from past activity. Historical data lets you compare performance across time periods, identify trends, and evaluate the long-term impact of campaigns. How far back data goes depends on your plan and provider.
    Bot traffic#
    Clicks generated by automated programs rather than real people. Bots include search engine crawlers, link preview generators, email security scanners, and malicious scripts. Unfiltered bot traffic inflates click numbers and skews analytics.
    Bot filtering#
    The process of identifying and separating bot-generated clicks from real human activity. Platforms use signals like browser behavior, known bot lists, IP reputation, and request patterns to filter out automated traffic.
    Invalid traffic#
    Clicks or activity that don't represent genuine visitor engagement — including bots, duplicate clicks, fraudulent traffic, and accidental reloads. Filtering invalid traffic gives a more accurate picture of real campaign performance.
    Click deduplication#
    The process of identifying and handling repeated clicks from the same person, device, or bot within a set time window. Deduplication helps distinguish how many times a link was clicked from how many individual people clicked it.
    Internal traffic filtering#
    Excluding clicks from your own team, agency, or office network from analytics reports. Without this, testing links, reviewing campaigns, and employee activity can inflate your click data.
    Event stream#
    A chronological log of activity related to a link — including clicks, edits, expirations, and other platform events. Event streams are useful for monitoring, automation, and connecting link data to other business systems.

    UTM Parameters & Campaign Tracking

    26 terms
    UTM parameters#
    A set of short labels you can add to the end of a web address to tell your analytics tools where a click came from and which campaign drove it. UTM stands for Urchin Tracking Module — named after an early analytics company that later became Google Analytics. When you shorten a URL that includes UTM labels, those labels are preserved and passed along to the destination, where your analytics platform reads them. [9]
    UTM source#
    The `utm_source` label, used to identify where the click came from — such as a specific newsletter, social platform, or partner site. Examples: `newsletter`, `linkedin`, `google`, `spring_email_list`. [9]
    UTM medium#
    The `utm_medium` label, used to identify the type of marketing channel. Examples: `email`, `paid_social`, `cpc` (paid search), `affiliate`, `qr`. [9]
    UTM campaign#
    The `utm_campaign` label, used to name the specific campaign or promotion. Examples: `spring-launch`, `black-friday-2026`, `product-announcement`. [9]
    UTM term#
    The `utm_term` label, traditionally used in paid search ads to note which keyword triggered the ad. It can also be used in other contexts when you want to track a specific term or audience segment. [9]
    UTM content#
    The `utm_content` label, used to tell apart different links within the same campaign — for example, two different buttons in the same email, or two ad creatives in the same campaign. Example values: `hero-button`, `footer-link`, `blue-creative`. [9]
    UTM ID / Campaign ID#
    The `utm_id` label, used to tag a campaign with a stable, unique identifier. Useful when campaign names might change or when you need a consistent ID to connect data across different tools. [9]
    UTM builder#
    A tool that helps you create properly formatted campaign URLs by filling out a simple form — so you don't have to type UTM labels manually and risk mistakes. Most link management platforms include a built-in UTM builder.
    Campaign URL#
    A destination web address that includes UTM labels for tracking. Campaign URLs are often long and messy, which is why they're typically shortened before being shared.
    Campaign tagging#
    The practice of adding UTM or other tracking labels to links before distributing them. Consistent tagging across all your campaigns makes it possible to accurately compare channel performance in your analytics reports.
    UTM naming convention#
    An agreed-upon set of rules for how your team writes UTM values — including capitalization, punctuation, source names, and campaign formats. Without a naming convention, the same source might appear as `Email`, `email`, and `e-mail` in your reports, splitting data that should be combined.
    UTM governance#
    The process of defining, documenting, and enforcing your UTM naming rules across teams, agencies, and tools. Good governance keeps analytics data clean and consistent as your organization grows.
    Channel grouping#
    A way of organizing web traffic into broad categories like Email, Paid Search, Organic Social, or Referral. Channel groupings are usually defined in your analytics platform and rely on UTM source and medium values to sort traffic correctly.
    Auto-tagging#
    When an advertising platform automatically adds its own tracking identifiers to URLs rather than requiring you to add them manually. Google Ads and Meta do this by default. Auto-tagging needs to be coordinated with any manual UTM tagging to avoid conflicts. [10]
    GCLID / Google Click Identifier#
    A tracking code that Google Ads automatically adds to URLs when someone clicks a Google ad. It helps connect the ad click to conversions and analytics data in Google's platforms. [10]
    FBCLID#
    A tracking identifier that Meta (Facebook and Instagram) sometimes adds to outbound links. It's used for attribution within Meta's advertising systems. Many analytics teams choose to filter it out to keep URLs clean.
    MSCLKID#
    A tracking identifier added by Microsoft Advertising (formerly Bing Ads) when auto-tagging is enabled. It works similarly to Google's GCLID, connecting ad clicks to conversion data. [11]
    Click ID#
    A unique identifier tied to a specific click event. Click IDs are often appended to destination URLs so that advertising platforms, affiliate networks, or analytics systems can match the click to a later conversion.
    Attribution#
    The process of figuring out which marketing touchpoints deserve credit for a conversion. Attribution answers the question: "Which link, ad, or campaign actually drove this result?"
    First-touch attribution#
    An attribution model that gives all the credit for a conversion to the very first link or touchpoint a person interacted with. Useful for understanding what first introduced someone to your brand or product.
    Last-touch attribution#
    An attribution model that gives all the credit to the final link or touchpoint before a conversion. Simple to implement, but it ignores all earlier interactions that may have influenced the decision.
    Multi-touch attribution#
    An attribution approach that spreads credit for a conversion across multiple touchpoints in a person's journey. Common models include giving equal credit to all touchpoints, giving more credit to recent ones, or giving extra weight to the first and last interactions.
    Pixel tracking#
    A method of tracking visitor behavior by placing a tiny, invisible image or small piece of code on a web page. When someone visits the page, it quietly sends data to an analytics or advertising platform. Pixels are commonly used for conversion tracking and building retargeting audiences.
    Retargeting pixel#
    A tracking pixel that adds visitors to an advertising audience so you can show them follow-up ads later. For example, if someone clicks your short link and visits your product page, a retargeting pixel can add them to a list for a follow-up ad campaign.
    Tag#
    A word with different meanings depending on context. In analytics and advertising, a tag is a tracking pixel or script placed on a web page. In a link management platform, a tag is an organizational label you apply to links to group and filter them. In UTM tracking, a tag refers to the UTM parameters themselves.
    Tag manager#
    A tool like Google Tag Manager that lets you add and manage tracking scripts and pixels on a website through a simple interface — without needing to edit the website's code directly every time.

    QR Codes & Physical Media

    14 terms
    QR code#
    A square barcode made up of black and white patterns that encodes information — most commonly a web address. Smartphones can scan QR codes using their camera and instantly open the encoded URL, making QR codes a popular bridge between physical materials and digital content. [12]
    Dynamic QR code#
    A QR code that points to a short link rather than directly to a final destination. Because the short link's destination can be updated at any time, you can change where the QR code sends people without reprinting it. Dynamic QR codes also support scan tracking.
    Static QR code#
    A QR code that is permanently encoded with a specific destination. Once printed, a static QR code cannot be changed — if the destination moves, you need a new QR code. Static codes generally don't provide scan tracking unless they point to a tracked URL. [12]
    QR code generator#
    A tool that creates QR codes from URLs or other data. Most link management platforms include a QR code generator and may offer customization options like colors, logos, file formats, and campaign tracking.
    QR code scan#
    The act of pointing a smartphone camera at a QR code to decode it and open the encoded URL. When a dynamic QR code routes through a trackable short link, each scan is recorded as a click event.
    Offline-to-online#
    The broader practice of moving people from physical-world touchpoints into digital experiences. Link management tools make these transitions trackable through QR codes, short URLs, and NFC tags.
    Scan rate#
    The number of times a QR code has been scanned in a given period, or the percentage of scans relative to estimated views or impressions. Scan rate is a key metric for measuring the effectiveness of print, packaging, and out-of-home campaigns.
    QR customization#
    The ability to change how a QR code looks — such as its colors, the logo in the center, or the shape of its corner markers — while keeping it scannable. Good customization stays on-brand while maintaining enough contrast and structure to be read reliably by cameras. [12]
    Error correction level#
    A setting that determines how much of a QR code can be damaged, obscured, or covered by a logo and still be scanned successfully. Higher error correction allows more visual modification but may make the code denser and slightly harder to read at small sizes. [12]
    QR eye / Finder pattern#
    The three large square markers in the corners of a QR code that help cameras detect, orient, and decode it. These are often customized with rounded shapes or brand colors while still allowing reliable scanning. [12]
    Quiet zone#
    The blank border of white space around the outside of a QR code. This margin helps cameras find and read the code. Cropping into the quiet zone is a common cause of scanning failures. [12]
    Scannability#
    How easily and reliably a QR code can be scanned in real-world conditions. Good scannability depends on size, contrast between light and dark areas, print quality, the surface it's printed on, available lighting, and whether the quiet zone is intact. [12]
    NFC tag#
    A small chip embedded in a physical object — like a sticker, card, or product — that can trigger an action, such as opening a web address, when a compatible smartphone is tapped against it. NFC tags are often used alongside QR codes as another way to connect physical items to digital experiences. [13]

    Security, Trust & Compliance

    38 terms
    Burn-after-read / Burn after reading#
    The destruction model behind one-time links: the moment the content is first revealed, it is permanently deleted ("burned") from the service's storage. A burned link cannot be recovered by the sender, the recipient, or the operator — non-recoverability is the security property, not a limitation. Services often distinguish burning (consumed by a view) from expiry (destroyed by a deadline passing unviewed).
    SSL / TLS / HTTPS#
    SSL and TLS are the security technologies that encrypt data traveling between your browser and a website, protecting it from being intercepted. HTTPS in a web address means that encryption is active. All reputable link shortening services use HTTPS to keep users safe and signal that a link is trustworthy. [3]
    TLS certificate#
    A digital credential that enables a website to use HTTPS. When you set up a custom domain for short links, the link management platform typically handles obtaining and renewing this certificate for you. [3]
    Phishing#
    A scam where someone tricks you into visiting a fake website — usually designed to look like a trusted brand — to steal your password, payment details, or other sensitive information. Short links are sometimes misused in phishing because they hide the real destination. Link platforms actively scan for and block phishing links.
    Malware scanning#
    Automated checks that inspect a link's destination for harmful software, suspicious scripts, or known dangerous content before the link is created or while it remains active.
    Safe browsing#
    A category of protection systems that check web addresses against databases of known harmful sites. Google Safe Browsing is one widely used example. Link platforms may use these services to screen destinations and warn users about risky links. [14]
    Threat intelligence#
    Information used to identify risky websites, domains, or online behaviors. Link platforms use threat intelligence from their own systems and external security providers to catch harmful links before they reach users.
    Phishing detection#
    The process of identifying links designed to impersonate trusted brands, steal credentials, or mislead users. Detection looks at factors like visual similarity to known brands, suspicious domain names, and patterns associated with scam campaigns.
    Lookalike domain / Homograph attack#
    A scam technique that uses a domain name designed to visually resemble a well-known and trusted one — for example, replacing a lowercase `l` with the number `1`, or using a character from another alphabet that looks identical. These fake domains are used in phishing and fraud campaigns. [5]
    Blocklist / Blacklist#
    A list of domains, web addresses, or other identifiers known or suspected to be harmful or abusive. Link platforms use blocklists to prevent short links from pointing to dangerous destinations. "Blocklist" is the modern preferred term; "blacklist" is an older synonym.
    Allowlist / Whitelist#
    A list of approved destinations, users, or actions that are explicitly permitted. Some enterprise link platforms use allowlists so that employees can only create short links pointing to approved company domains. "Allowlist" is the modern preferred term; "whitelist" is an older synonym.
    Domain reputation#
    A measure of how trustworthy a domain is, based on its history with spam, phishing, malware, and other signals. A domain with a poor reputation may cause links to be flagged by email providers, blocked by browsers, or distrusted by users.
    Abuse report#
    A report submitted by a user, researcher, or automated system flagging a short link as potentially harmful, deceptive, or in violation of platform policies. Abuse reports trigger investigation and potential removal of the offending link.
    Abuse prevention#
    The combination of automated tools and human review processes that a link platform uses to detect and stop misuse — including spam, phishing, malware distribution, and policy violations.
    GDPR compliance#
    Following the rules of the General Data Protection Regulation, a European law that governs how personal data about individuals is collected, used, and stored. For link management platforms, this affects how click data — including IP addresses and location — is handled, and it requires mechanisms for user consent and the ability to delete personal data on request. [8]
    CCPA / CPRA compliance#
    Following California's privacy laws, which give California residents rights over their personal information — including the right to know what data is collected, to opt out of data sharing, and to request deletion. Link platforms that collect click and device data need to address these requirements for California users. [15]
    Privacy policy#
    A public document that explains what data a platform collects, how it's used, who it's shared with, how long it's kept, and what rights users have. Link management platforms publish privacy policies that describe how click analytics and account data are handled. [8]
    Data retention#
    How long a platform keeps click data, analytics, and other records. Retention periods vary by provider and plan — some keep data for 30 days, others for years. Shorter retention can support privacy best practices by not keeping data longer than necessary. [8]
    Data processing agreement / DPA#
    A formal contract between an organization and a software vendor that specifies how the vendor will handle personal data on the organization's behalf. DPAs are common in enterprise relationships and are particularly important for GDPR compliance. [8]
    Data residency#
    The requirement or preference that data be stored and processed within a specific country or region. This matters for regulated industries, government organizations, and companies with regional data compliance obligations. [8]
    PII / Personal data#
    Information that can be used to identify a specific individual. In link analytics, this may include IP addresses, device identifiers, location data, and click-level logs, depending on the jurisdiction and how the data is combined or used. [8]
    Terms of service#
    The legal agreement between a link management platform and its users. It defines what you can and can't do with the platform, what content and destinations are prohibited, and what happens if the rules are broken.
    Rate limiting#
    A control that caps how many requests a user, IP address, or application can make within a given time period. Rate limiting protects the platform from abuse, automated attacks, and overload — and ensures fair access for all users.
    CAPTCHA#
    A challenge — like identifying objects in photos or checking a box — used to verify that a request is coming from a real person rather than an automated bot. Link platforms may use CAPTCHAs during sign-up or when suspicious activity is detected. [16]
    Two-factor authentication / 2FA#
    A login security feature that requires two forms of verification to access your account — typically your password plus a one-time code sent to your phone or generated by an app. 2FA makes it much harder for someone to access your account even if they know your password.
    Single sign-on / SSO#
    A way to log into a link management platform using the same credentials you use for other work tools — like Google Workspace, Microsoft, or Okta — rather than a separate username and password. SSO simplifies access management, especially for large teams.
    Role-based access control / RBAC#
    A system that assigns team members different levels of access based on their role. For example, an admin might be able to create and delete links, while a viewer can only read reports. RBAC ensures people can only do what their job requires.

    API, Integrations & Technical Infrastructure

    28 terms
    API / Application Programming Interface#
    A way for software applications to communicate with each other. A link management platform's API lets developers build their own tools, automate link creation, pull analytics data, and integrate the platform into other systems — all without using the web interface manually.
    API key#
    A private code used to prove your identity when making API requests. Think of it like a password for your application. API keys should be kept secret, monitored, and changed if they're ever exposed.
    Access token#
    A temporary credential used to authorize API requests. Access tokens often have defined permissions and expiration times, making them slightly more secure than long-lived API keys for certain integrations. [17]
    OAuth#
    A widely used standard that lets you grant third-party apps access to your account without sharing your password. When you click "Sign in with Google" or "Connect your account" in a platform, you're typically using OAuth. [17]
    REST API#
    A common style of building APIs that uses standard web methods — like GET to retrieve data, POST to create something, PUT or PATCH to update, and DELETE to remove — applied to specific URLs. Most link management platforms offer REST APIs. [2]
    Endpoint#
    A specific URL within an API that handles a particular action or resource. For example, one endpoint might create a new short link while another retrieves click analytics for a specific link.
    SDK / Software Development Kit#
    A ready-made package of code that helps developers connect to an API using their preferred programming language. Instead of writing all the low-level web requests from scratch, an SDK provides pre-built functions and examples.
    Webhook#
    An automatic notification your platform sends to another system when something happens — like a link being clicked, created, or expired. Instead of constantly checking for updates, your other tools receive a notification the moment an event occurs.
    Webhook signature#
    A security code included with every webhook notification that lets the receiving system verify the message genuinely came from the link platform and wasn't tampered with in transit.
    Retry policy#
    Rules that define what happens when an API call or webhook notification fails — such as how many times to try again, how long to wait between attempts, and what to do if all retries fail.
    Rate limit#
    A cap on how many API requests can be made within a given time window — for example, 1,000 requests per hour. Exceeding the rate limit results in a temporary block until the window resets. Rate limits protect the platform and ensure fair access for all users.
    Zapier / Make integration#
    Ready-made connectors that let you link your link management platform to hundreds of other apps without writing any code. For example, you could automatically shorten a URL whenever a new row is added to a spreadsheet, or post a notification to Slack when a link reaches a certain number of clicks.
    CMS integration#
    A plugin or built-in connection that adds link shortening and tracking features directly into a content management system — such as WordPress or HubSpot — so you can manage short links without leaving your content editor.
    Browser extension#
    A small add-on installed in your web browser that lets you shorten, copy, or manage the URL of the page you're currently viewing with a single click, without opening the link management platform separately.
    DNS configuration#
    The process of setting up your domain's internet records so that your custom short-link domain points to the link management platform's servers. This is a required step before your custom domain can start serving short links.
    DNS propagation#
    The time it takes for a DNS change to spread across the internet so that everyone's browsers and devices see the updated settings. Propagation usually takes a few minutes to a few hours, though it can occasionally take longer depending on settings and network caches.
    CNAME record#
    A type of DNS record that points one domain name to another. For example, you might set up `go.yourcompany.com` to point to your link platform's servers using a CNAME record. [18]
    A record#
    A type of DNS record that connects a domain name directly to a specific server's IP address. Some link platforms use A records instead of CNAME records when setting up custom domains — particularly for root domains like `yourcompany.com` rather than subdomains. [18]
    TXT record#
    A DNS record used to store text-based information about a domain. Link platforms often ask you to add a TXT record to prove you own a domain before activating it for short links. [18]
    Domain verification#
    The process of proving to a link management platform that you actually own or control a custom domain before it's activated. This usually involves adding a specific DNS record or file that the platform checks.
    CDN / Content Delivery Network#
    A network of servers spread across many locations around the world that work together to deliver content faster. Link shortening platforms may use a CDN so that redirects are processed from a server close to the visitor, reducing the time it takes to reach the destination.
    Edge redirect#
    A redirect handled by a server located close to the visitor — rather than at a central server far away — to make the redirect faster. Edge redirects are made possible by CDN infrastructure.
    Latency#
    The delay between clicking a short link and arriving at the destination page. Lower latency means a faster, smoother experience. Latency is affected by server location, network speed, the number of redirect hops, and DNS lookup time.
    Uptime / SLA#
    Uptime is how much of the time a service is operational and available. A Service Level Agreement (SLA) is a formal commitment from the provider specifying guaranteed uptime (e.g., 99.9%) and what remedies apply if that standard isn't met. For link shortening, downtime means every short link stops working — so uptime is critically important.
    Multi-region failover#
    A design approach where traffic automatically shifts to backup servers in another location if one server or data center goes down. Multi-region failover improves reliability for high-volume or business-critical link campaigns.
    Caching#
    Storing frequently used data — like which short link maps to which destination — in fast-access memory so it can be retrieved almost instantly without looking it up from scratch each time. Caching speeds up redirects significantly, though it can occasionally cause a slight delay when a destination is updated.
    Server log#
    A record kept by the platform's servers of every request they process. For link shortening, server logs include timestamps, IP addresses, devices, browsers, and request details for every click. Logs are used for analytics, debugging, and compliance.

    Plans, Billing & Account

    14 terms
    Free plan#
    A no-cost tier that gives you basic link shortening features with limits on how many links you can create, how many clicks are tracked, what analytics are available, and which features are accessible. Free plans are designed to let you try the platform before committing to a paid subscription.
    Click limit#
    The maximum number of click events included in a plan per billing period. When the limit is reached, the platform may keep redirecting visitors but stop recording analytics, or it may prompt you to upgrade.
    Overage#
    Usage that goes beyond what your plan includes. Depending on the platform, overages may result in extra charges, reduced features, paused tracking, or a prompt to move to a higher plan.
    Team account / Organization account#
    An account designed for multiple people working together. Team accounts include shared access to links and analytics, centralized billing, and tools for managing who can do what within the account.
    Member / Seat#
    An individual user within a team or organization account. Pricing for team plans is often based on the number of seats, with options to add more members for an additional cost.
    White-label#
    A setup that lets an agency, reseller, or enterprise customer offer link shortening under their own brand — with their logo, domain, and design — hiding any reference to the underlying platform provider.
    Reseller#
    A business or individual that purchases link management services and offers them to their own customers, often under a white-label arrangement. Resellers include marketing agencies, SaaS companies, and managed service providers.
    Enterprise tier#
    The highest level of service, designed for large organizations with complex requirements. Enterprise plans typically include high or unlimited usage, custom contracts, dedicated support, SSO, advanced access controls, compliance features, and custom integrations.
    Account owner#
    The primary administrator of an account, responsible for billing, settings, user management, and overall account governance. The account owner typically has the highest level of access.
    Billing contact#
    The person or email address that receives invoices, payment notices, and billing-related communications. The billing contact may be a different person from the account owner or technical administrator.
    Usage quota#
    The defined limit on resources included in a plan — such as the number of links, clicks, custom domains, QR codes, team members, or API requests allowed per billing period.
    Analytics retention limit#
    How far back your click data is available to view in the platform. A free plan might show only the last 30 days, while an enterprise plan might retain data for several years. This affects your ability to do historical reporting and compare campaigns over time.

    References

    20 sources

    Terms backed by formal standards, official platform documentation, or enacted legislation cite the sources below. Industry-convention terms stand on their own definition rather than carrying low-quality references.

    1. [1]

      RFC 3986 — Uniform Resource Identifier (URI): Generic Syntax

      Berners-Lee, T., Fielding, R., & Masinter, L. (2005). *RFC 3986: Uniform Resource Identifier (URI): Generic Syntax*. Internet Engineering Task Force (IETF).

      https://www.rfc-editor.org/rfc/rfc3986

      Cited for: Domain, TLD / Top-level domain, Root domain / Apex domain, Subdomain, Path, Query string, URL parameters, Fragment / Anchor, Protocol / Scheme, URL encoding / Percent encoding

    2. [2]

      RFC 9110 — HTTP Semantics

      Fielding, R., Nottingham, M., & Reschke, J. (2022). *RFC 9110: HTTP Semantics*. Internet Engineering Task Force (IETF).

      https://www.rfc-editor.org/rfc/rfc9110

      Cited for: HTTP, HTTPS, Redirect, Location header, 301 redirect, 302 redirect, 307 redirect, 308 redirect, Server-side redirect, Redirect loop, Referrer / Referring URL, User agent, REST API

    3. [3]

      RFC 8446 — The Transport Layer Security (TLS) Protocol Version 1.3

      Rescorla, E. (2018). *RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3*. Internet Engineering Task Force (IETF).

      https://www.rfc-editor.org/rfc/rfc8446

      Cited for: HTTPS, SSL / TLS / HTTPS, TLS certificate

    4. [4]

      HTML Living Standard — Canonical URLs and Meta Refresh

      WHATWG. (2024). *HTML Living Standard*. Web Hypertext Application Technology Working Group.

      https://html.spec.whatwg.org/

      Cited for: Canonical URL, Meta refresh redirect

    5. [5]

      RFC 5891 — Internationalized Domain Names in Applications (IDNA): Protocol

      Klensin, J. (2010). *RFC 5891: Internationalized Domain Names in Applications (IDNA): Protocol*. Internet Engineering Task Force (IETF).

      https://www.rfc-editor.org/rfc/rfc5891

      Cited for: IDN / Internationalized domain name, Lookalike domain / Homograph attack

    6. [6]

      Apple Developer Documentation — Supporting Universal Links in Your App

      Apple Inc. (2024). *Supporting Universal Links in Your App*. Apple Developer Documentation.

      https://developer.apple.com/documentation/xcode/supporting-universal-links-in-your-app

      Cited for: Universal Link

    7. [7]

      Android Developer Documentation — Android App Links

      Google LLC. (2024). *Verify Android App Links*. Android Developer Documentation.

      https://developer.android.com/training/app-links/verify-android-applinks

      Cited for: Android App Link

    8. [8]

      Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR)

      European Parliament and Council of the European Union. (2016). *Regulation (EU) 2016/679 on the Protection of Natural Persons with Regard to the Processing of Personal Data*. Official Journal of the European Union.

      https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

      Cited for: IP address (as personal data), GDPR compliance, Cookie consent, Consent management, Privacy policy, Data retention, Data processing agreement / DPA, Data residency, PII / Personal data

    9. [9]

      Google Analytics Help — About Custom Campaigns and UTM Parameters

      Google LLC. (2024). *Collect campaign data with custom URLs*. Google Analytics Help.

      https://support.google.com/analytics/answer/1033863

      Cited for: UTM parameters, UTM source, UTM medium, UTM campaign, UTM term, UTM content, UTM ID / Campaign ID

    10. [10]

      Google Ads Help — About Auto-Tagging and the GCLID

      Google LLC. (2024). *Set up auto-tagging*. Google Ads Help.

      https://support.google.com/google-ads/answer/3095550

      Cited for: Auto-tagging, GCLID / Google Click Identifier

    11. [11]

      Microsoft Advertising Help — Auto-Tagging and MSCLKID

      Microsoft Corporation. (2024). *How to use auto-tagging for Microsoft Advertising*. Microsoft Advertising Help.

      https://help.ads.microsoft.com/apex/index/3/en/56521

      Cited for: MSCLKID

    12. [12]

      ISO/IEC 18004:2015 — QR Code Bar Code Symbology Specification

      International Organization for Standardization. (2015). *ISO/IEC 18004:2015: Information technology — Automatic identification and data capture techniques — QR Code bar code symbology specification*. ISO.

      https://www.iso.org/standard/62021.html

      Cited for: QR code, Static QR code, QR customization, Error correction level, QR eye / Finder pattern, Quiet zone, Scannability

    13. [13]

      ISO/IEC 18092 — Near Field Communication (NFC) Interface and Protocol

      International Organization for Standardization. (2013). *ISO/IEC 18092: Information technology — Telecommunications and information exchange between systems — Near Field Communication — Interface and Protocol (NFCIP-1)*. ISO.

      https://www.iso.org/standard/56692.html

      Cited for: NFC tag

    14. [14]

      Google Safe Browsing — Overview

      Google LLC. (2024). *Safe Browsing APIs*. Google Developers.

      https://developers.google.com/safe-browsing/v4

      Cited for: Safe browsing

    15. [15]

      California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

      State of California Department of Justice. (2020, amended 2023). *California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020)*. California Legislative Information.

      https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100

      Cited for: CCPA / CPRA compliance

    16. [16]

      von Ahn, L., Blum, M., Hopper, N. J., & Langford, J. (2003). CAPTCHA: Using Hard AI Problems for Security

      *Proceedings of the International Conference on the Theory and Applications of Cryptographic Techniques (EUROCRYPT 2003)*, Lecture Notes in Computer Science, vol. 2656, pp. 294–311. Springer, Berlin, Heidelberg.

      https://doi.org/10.1007/3-540-39200-9_18

      Cited for: CAPTCHA

    17. [17]

      RFC 6749 — The OAuth 2.0 Authorization Framework

      Hardt, D. (Ed.). (2012). *RFC 6749: The OAuth 2.0 Authorization Framework*. Internet Engineering Task Force (IETF).

      https://www.rfc-editor.org/rfc/rfc6749

      Cited for: OAuth, Access token

    18. [18]

      RFC 1035 — Domain Names — Implementation and Specification

      Mockapetris, P. (1987). *RFC 1035: Domain Names — Implementation and Specification*. Internet Engineering Task Force (IETF).

      https://www.rfc-editor.org/rfc/rfc1035

      Cited for: CNAME record, A record, TXT record

    19. [19]

      The Open Graph Protocol

      Meta Platforms, Inc. (2010, ongoing). *The Open Graph Protocol*. ogp.me.

      https://ogp.me/

      Cited for: Open Graph / OG tags

    20. [20]

      X (Twitter) Developer Documentation — Cards

      X Corp. (2024). *Cards — X Developer Platform*. X Developer Documentation.

      https://developer.x.com/en/docs/twitter-for-websites/cards/overview/abouts-cards

      Cited for: Twitter Card / X Card

    Put these terms into practice

    Create short links, track clicks, and share secrets with a free LinkPilot account — or try the free tools without signing up.