> But isn't it dangerous? How does it know you re not preloading the "please delete everything" link?

In a perfect world no-one would be using links for actions which modify state - they should always be a POST behind a button, not a GET behind a link.

But in the real world this is probably a legitimate concern. They do have methods to mark links as non-preloadable (https://instant.page/blacklist), but anyone using it should definitely do a thorough test, not just copy and paste and hope for the best