Time-of-click inspection is a security control that rechecks a URL when a user opens it, instead of trusting the result from the moment the email arrived. This matters because phishing links can change behavior over time, hide behind redirects, or lead to a page that becomes malicious only after delivery. A message may look clean in the inbox, but the destination can still be dangerous once the click happens.
In practice, time-of-click inspection helps defend against link-based phishing, URL cloaking, and delayed malicious landing pages. Security products may rewrite links, evaluate the final destination in real time, and compare it against reputation, sandboxing, or policy rules. It is especially useful when attackers borrow trusted mail paths or authenticated domains to make messages look legitimate. By checking the link at the moment of use, defenders close the gap between email filtering and browser access.