Show the Full URL in Safari to Spot Phishing

By default Safari shows only a site's name in the address bar — "apple.com" — and hides everything else. That's tidy, but it's exactly the wrong behaviour when you're checking whether a link is a fake. Turn on the full website address and Safari shows the whole URL, so you can read the real domain and catch a phishing page before you type a single character.

Turn on the full address (the reliable way)

Do this inside Safari — it's the route that always works and takes effect immediately:

1. In Safari, open the menu bar and choose Safari → Settings (or press Cmd+,).
2. Click the Advanced tab.
3. Tick Show full website address.

The address bar switches from the short site name to the complete URL — scheme, domain, path, and query string. There's nothing to restart; the change is live. This checkbox exists in the same place on macOS 13 Ventura, 14 Sonoma, and 15 Sequoia.

How to read a URL for fakes

Seeing the full address only helps if you know where to look. Phishing pages count on people misreading it, so learn the one rule that matters:

• The real site is the domain right before the first single slash. In https://apple.com.login-secure.co/verify, the true domain is login-secure.co — not Apple. Everything to the left of it is just decoration the attacker chose.
• Subdomains lie freely. Anyone can put apple.com at the start as a subdomain, as above. Read right-to-left to the real registered domain.
• Watch for look-alikes like paypaI.com (capital i for the l) or app1e.com. The full address makes these easier to catch than a truncated site name would.
• A padlock is not safety. It only means the connection is encrypted; phishing sites get padlocks too. The domain is what tells you who you're actually talking to.

With the full URL visible, the habit is simple: before entering a password or card number, glance at the address bar and confirm the domain before the first slash is really the company you expect.

Prefer the Terminal? Read this first

The same setting has a preference key, ShowFullURLInSmartSearchField, but on modern macOS Safari's preferences are protected — a plain defaults write won't stick unless Terminal has Full Disk Access (System Settings → Privacy & Security → Full Disk Access) and Safari is fully quit first. Because of that, the Settings checkbox above is the route to use. If you've already granted Full Disk Access and quit Safari, the command is:

# Quit Safari first; Terminal needs Full Disk Access
defaults write com.apple.Safari ShowFullURLInSmartSearchField -bool true

# Undo
defaults write com.apple.Safari ShowFullURLInSmartSearchField -bool false

For almost everyone, the Advanced checkbox is faster and avoids granting Terminal that much access in the first place.

Let Safari flag the obvious fakes too

Reading URLs yourself is the last line; Safari has a first line. Make sure Safari's fraudulent website warning is on so known phishing pages are blocked before you even see them.