User Guide
Creating a Short Link
How to shorten URLs, input validation rules, and security protections.
Creating a Short Link
GO Shortener provides a streamlined interface for shortening destination URLs quickly and securely, with or without a registered account.
Shortening as an Anonymous Visitor
Anyone can shorten a link directly from the homepage (https://go.arcn.online):
- Paste your target destination URL into the input field.
- Select an expiration duration from the dropdown menu (e.g., 1 hour, 1 day, 3 days, or 7 days).
- If Cloudflare Turnstile is enabled, complete the interactive verification checkbox.
- Click Shorten.
- Your shortened link (e.g.,
https://go.arcn.online/K8xP2q) is generated immediately. Click Copy to place it in your clipboard.
Anonymous visitors are allocated a quota of 15 links per 24-hour period. Quotas are monitored via an identity hash to prevent abuse while accommodating shared network environments.
Shortening as a Registered User
When logged into your account:
- Use either the homepage shortener or the modal in your User Dashboard.
- Select from expanded expiration windows (ranging up to 1 year).
- Created links automatically attach to your user account, enabling click tracking, detailed analytics, status management, and renewal capabilities.
- Registered users have a quota of 100 links per calendar month.
Input Validation & URL Filtering
To ensure user safety and server stability, every destination URL submitted to GO is evaluated against strict security policies:
1. Protocol Validation
- Only standard web protocols (
http://andhttps://) are permitted. - Dangerous or non-standard URI schemes—including
javascript:,file:,data:, andftp:—are strictly rejected with a400 Bad Requesterror.
2. SSRF (Server-Side Request Forgery) Shield
To prevent attackers from using the shortener as an internal network proxy or port scanner, the backend resolves the target domain and blocks requests pointing to:
- Loopback addresses (
127.0.0.0/8,::1). - Private RFC 1918 subnets (
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16). - Link-local and cloud metadata endpoints (
169.254.169.254).
3. Anti-Recursion Shield
- Destination URLs matching the GO instance's own base domain (
go.arcn.online) are blocked to prevent infinite redirect loops and resource exhaustion.
Random Short Codes
GO generates cryptographically random, collision-resistant 6-character identifiers using standard URL-safe characters:
https://go.arcn.online/K8xP2q
Custom alias selection (vanity URLs like
/my-company) is intentionally disallowed to prevent URL squatting, brand impersonation, and phishing scams.