To check if a website is safe, confirm the address is spelt exactly right, make sure it loads over HTTPS without warnings, look it up in Google's Safe Browsing site status and Get Safe Online's Check a Website tool, then check the domain's age, the company's real-world details and independent reviews. No single check proves a site is safe.
The short answer: paste the address into Google's Safe Browsing site status, check the domain's registration date, and look for the company behind the site in an official business register. If the site is flagged, brand new, or impossible to trace to a real business, do not buy from it or log in.
The rest of this guide explains each check, what a website "trust score" really measures, what a padlock does and does not tell you, how to check your own business website, and where to report a scam site in the UK, the US and elsewhere.
Key takeaways
- No single check proves a website is safe, so combine several checks before you enter money or personal details.
- HTTPS only means the connection is encrypted, as scam and phishing sites routinely use valid certificates too.
- Read the full address carefully, then look it up in Google Safe Browsing and Get Safe Online's Check a Website tool.
- Report suspicious websites to your national authority, such as the NCSC in the UK or the FTC and the FBI's IC3 in the US.
Why isn't the padlock enough?
HTTPS means the connection between your browser and the server is encrypted, so nobody on the same Wi-Fi can read or change what you send. It says nothing about who runs the site or whether they are honest. Free certificates from Let's Encrypt and others are issued automatically to anyone who controls a domain, which is a good thing for the web, but it means phishing sites have certificates too.
Chrome stopped showing a padlock in 2023 and now shows a neutral "site settings" icon for HTTPS pages, partly because people read the padlock as "trustworthy". What you should still watch for is the opposite: a "Not secure" label, or a full-page warning such as "Your connection is not private". Those mean the connection itself has a problem, and you should not enter anything.
How do I check if a website is safe? Nine checks
Work through these in order. The first three take seconds; the rest matter when money or personal data is involved.
- Read the full address carefully. Look at the part just before the first single slash.
paypal.com.account-check.cobelongs toaccount-check.co, not PayPal. Watch for swapped letters (rnform), extra words (-secure,-login,-uk) and unusual endings. - Type it yourself. If the link came by email, text or social media, don't click. Type the address you already know, or use a bookmark.
- Check for HTTPS and warnings. The address should start
https://with no "Not secure" label. Any certificate warning on a shop or login page is a stop sign. - Look it up in Google Safe Browsing. Paste the address into Google's Safe Browsing site status. It tells you whether Google currently flags the site for malware, phishing or unwanted software. "No unsafe content found" is reassuring but not proof, because new scam sites appear faster than lists are updated.
- Use Get Safe Online's Check a Website. The UK charity runs a free Check a Website tool with Cifas and ScamAdviser. It gives a trust score drawn from more than 40 data sources, including reports from law enforcement and brands. It can't check shortened links such as bit.ly, and the score is a likelihood, not a guarantee.
- Check the domain's age. A shop claiming "trading since 1998" on a domain registered three weeks ago is a red flag. Use a WHOIS lookup to see the registration date and registrar; for
.ukdomains, Nominet's WHOIS shows the registration date and registrar. - Verify the business. UK limited companies must be on Companies House; in the US, check the business registry of the secretary of state where the company says it is based. Search the company name and number from the site's footer and check the registered address matches. Look for a real phone number and a geographic address, not just a contact form.
- Read independent reviews. Search the site's name plus "scam" or "reviews" and read what appears on sites the business doesn't control. A brand-new shop with only five-star reviews on its own pages tells you nothing.
- Look at how it wants to be paid. Credit card or an established payment provider gives you protection. Requests for bank transfer, gift cards or cryptocurrency, especially with "today only" pressure, are classic scam signs.
How do I check a website's trust score?
Website trust score checkers, such as ScamAdviser and Get Safe Online's Check a Website, give an address a single rating, usually out of 100. They don't test the site the way a person would. Instead they combine public signals into a probability. The signals vary by service, but most look at:
| Signal | What it suggests | Check it yourself |
|---|---|---|
| Domain age | Scam shops tend to use domains registered weeks or months ago and abandon them quickly | WHOIS lookup for the registration date and registrar |
| SSL certificate | A valid certificate is expected; a missing or broken one is a warning, but a valid one proves little | SSL checker for the issuer, validity and expiry |
| Blocklists | Whether the domain or its servers appear on phishing, malware or spam lists | Google Safe Browsing site status, plus the blacklist checker for spam blocklists |
| Reviews and reports | Complaints from shoppers, brands and law enforcement | Search the name plus "reviews" or "scam" on sites the business doesn't control |
| Hosting and ownership | Hidden owner details, hosting shared with known scam sites, or a server in a different country from the one claimed | WHOIS and the business's own registry entry |
| Traffic and popularity | Long-established, well-visited sites are less likely to be throwaway scams | Not easy to check for free; treat it as a weak signal |
Our Website Safety Checker runs the domain-age, certificate, HTTPS, spam-blocklist and homepage checks from this table in one go and lists each warning sign it finds, though no automated check can prove a site is safe.
Use a trust score as a prompt, not a verdict. Its limits are real:
- New scam sites score badly, but new honest sites do too. A shop that launched last month can get a low score through no fault of its own.
- Established sites can still be dangerous. A legitimate site that has been hacked keeps its old domain age, its certificate and its good reviews until the blocklists catch up.
- Privacy-protected WHOIS is normal. Many registrars hide owner details by default, so a hidden owner is not on its own a sign of fraud.
- Blocklists lag behind. Phishing pages are often live for hours before anyone reports them, so "no unsafe content found" is not a clean bill of health.
- Different checkers disagree. Each one uses different data and weights, so the same site can score 80 on one and 40 on another.
Google's Safe Browsing site status is not a trust score. It answers a narrower question: does Google currently flag this site for malware, phishing or unwanted software? Because Chrome, Firefox and Safari use the same lists to show their red warning pages, it is the check most worth doing first. Then use the domain-age, business-register and payment checks above to fill the gaps that no score can cover.
What are the warning signs of a scam website?
These patterns come up again and again in consumer scams:
- Prices far below every other retailer, particularly for trainers, electronics, festival tickets and holidays.
- Countdown timers and "only 2 left" banners on every product.
- Poor grammar, stock photos, and a "contact us" page with only a form or a free webmail address.
- No returns policy, or one copied from another shop with the wrong company name still in it.
- A login page that appears after clicking a link in an unexpected message about a parcel, refund or account problem.
If two or more of these apply, leave the site.
How do I check if my own business website is safe?
Customers increasingly run the checks above on you, so it pays to pass them. Start with Google: the Security issues report in Google Search Console tells you if Google has detected hacked content, malware or phishing on your property, and the Safe Browsing site status tool shows what visitors' browsers will see.
Then look at the technical basics that make a site look and behave trustworthily:
| Check | What good looks like |
|---|---|
| TLS certificate | Valid, not near expiry, covers both www and the bare domain |
| HTTPS redirect | Every http:// URL redirects permanently to https:// |
| Mixed content | No images, scripts or fonts loaded over plain HTTP |
| Security headers | HSTS, Content-Security-Policy, X-Content-Type-Options, frame protection |
| Exposed files | /.env and /.git/ return 404 or 403, never content |
| Cookies | Session cookies marked Secure and HttpOnly |
You can check all six in one go: MakeItFlow runs a free website security scan that covers the certificate, HTTPS redirect, security headers, cookie flags, mixed content and exposed .env/.git files, alongside SEO and performance. For a single item, the free SSL checker and security headers checker are quicker.
MakeItFlow does not scan for malware, and its blacklist checker covers email spam blocklists rather than malware lists, so if you suspect your site has been compromised, use Search Console, Safe Browsing and a dedicated malware scanner from your host or security provider. Our guide to signs your website was hacked walks through what to look for.
Where do I report a scam website in the UK?
- Suspicious websites: use the NCSC's Report a suspicious website form. Copy the link carefully rather than clicking it. If the NCSC finds the site malicious, it can ask the hosting provider to take it down.
- Suspicious emails: forward them to
report@phishing.gov.uk. - Suspicious texts: forward them free to 7726.
- If you've lost money: contact your bank straight away, then report to Report Fraud at reportfraud.police.uk or on 0300 123 2040 if you are in England, Wales or Northern Ireland. Report Fraud replaced Action Fraud in December 2025. In Scotland, call Police Scotland on 101.
Where do I report a scam website in the US and elsewhere?
- United States: report scams and fraud to the FTC at ReportFraud.ftc.gov, and internet crime, especially if you lost money, to the FBI's Internet Crime Complaint Center (IC3).
- Anywhere: report phishing pages to Google through its Safe Browsing report form, which can lead to browser warnings for everyone.
- Other countries: use your national scam reporting service, such as the Canadian Anti-Fraud Centre or Scamwatch in Australia, and contact your bank first if money has left your account.
What to do next
Before you buy from or log in to an unfamiliar site, take two minutes for the address, HTTPS, Safe Browsing and Check a Website steps; add the domain-age and Companies House checks when larger sums are involved. If you run a website yourself, look at it the way a cautious customer would: run a free website audit to catch certificate, redirect and header problems before customers notice them.
Frequently asked questions
Does HTTPS mean a website is safe?
No. HTTPS only means the connection is encrypted. Scam and phishing sites routinely use valid certificates because they are free and automatic. Treat HTTPS as a minimum requirement, not a sign of trust.
Can I check if a link is safe without clicking it?
Yes. Long-press or right-click the link and copy it, then paste it into Google's Safe Browsing site status or Get Safe Online's Check a Website tool. Shortened links can hide the real destination, so treat them with extra caution or avoid them altogether.
Is a website with a .co.uk address more trustworthy?
Not automatically. Anyone can register a .co.uk domain, and scammers do so to look local. It is still worth checking the domain's age and the company behind it in Companies House.
What should I do if I entered my details on a fake website?
Change the password on that account and anywhere you reused it, and turn on two-step verification. If you entered card or bank details, call your bank immediately using the number on your card, then report it to Report Fraud (or Police Scotland on 101).
Why does my browser say my own website is not secure?
Usually because the certificate has expired, doesn't cover the hostname being visited, or the page is loading over HTTP. Our guide to SSL certificate errors explains each warning and the fix.
Are browser extensions that rate websites reliable?
Some are helpful, but many collect browsing data, so choose carefully and read the permissions. Built-in protection such as Chrome's Safe Browsing, Microsoft Defender SmartScreen in Edge, and Firefox's phishing protection already blocks known bad sites without an extra extension.
Sources
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 31 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
