Every destination is checked against Google Safe Browsing when you save it, and all live codes are rechecked automatically on a regular schedule. If a destination is later flagged as hosting malware or a phishing page, we turn that code off automatically and show you why.
This is not a judgement about you. Websites get compromised, domains expire and get bought by someone else, and a link that was perfectly fine six months ago can turn bad without the owner noticing.
The reason we act on it: every code on mfco.app shares one domain reputation. If one link points somewhere harmful, the whole domain can get blocklisted — which would break every code on it, including ones already engraved on products that have shipped.
To fix it, edit the code to point somewhere safe. It is re-checked when you turn it back on.
We also refuse destinations that are not ordinary web addresses at all — raw IP addresses, local addresses, and links to other URL shorteners, which hide the real destination from every check.