A computer-implemented method comprising: receiving (301, 805), via a communication interface of a message security system, one or more character-limited messages sent to a user device; detecting (302, 810) a uniform resource locator, URL, within the one or more character-limited messages for replacement; generating (303, 815) a shortened URL corresponding to the detected URL, wherein a domain of the shortened URL identifies a secure web server hosted by the message security system, and wherein generating (303, 815) a shortened URL comprises: generating a random token based on a maximum number of characters that can be transmitted in a single character-limited message; and generating the shortened URL comprising the domain and the generated random token; modifying (304, 820) the one or more character-limited messages by replacing the detected URL with the shortened URL; causing (305A-B, 825) transmission of the modified one or more character-limited messages to the user device; receiving (307, 830), via the communication interface, from the user device, a request to access the shortened URL; scanning content hosted at the detected URL corresponding to the shortened URL for malicious content; and after detecting that the content hosted at the detected URL does not contain malicious content, redirecting (310, 845) the user device to the detected URL corresponding to the shortened URL; determining an expiration of the shortened URL based on the length of the random token; and reassigning the random token used to generate the shortened URL for another URL after the expiration of the shortened URL. receiving (301, 805), via a communication interface of a message security system, one or more character-limited messages sent to a user device; detecting (302, 810) a uniform resource locator, URL, within the one or more character-limited messages for replacement; generating (303, 815) a shortened URL corresponding to the detected URL, wherein a domain of the shortened URL identifies a secure web server hosted by the message security system, and wherein generating (303, 815) a shortened URL comprises: generating a random token based on a maximum number of characters that can be transmitted in a single character-limited message; and generating the shortened URL comprising the domain and the generated random token; generating a random token based on a maximum number of characters that can be transmitted in a single character-limited message; and generating the shortened URL comprising the domain and the generated random token; modifying (304, 820) the one or more character-limited messages by replacing the detected URL with the shortened URL; causing (305A-B, 825) transmission of the modified one or more character-limited messages to the user device; receiving (307, 830), via the communication interface, from the user device, a request to access the shortened URL; scanning content hosted at the detected URL corresponding to the shortened URL for malicious content; and after detecting that the content hosted at the detected URL does not contain malicious content, redirecting (310, 845) the user device to the detected URL corresponding to the shortened URL; determining an expiration of the shortened URL based on the length of the random token; and reassigning the random token used to generate the shortened URL for another URL after the expiration of the shortened URL.