URL filtering works by comparing URLs against a list of approved or blacklisted links. This can be done in real-time as emails are composed and sent. Email service providers (ESPs) often use automated systems to scan URLs and determine if they are safe or suspect. If a URL is flagged as suspicious, it can either be removed or replaced with a warning message.