Website Safety Checker (Is This Site Legit?)

A website safety checker helps you answer the question most people ask before they pay a shop they have never heard of: is this site legit, or is it a scam? Our Website Safety Checker reads the public signals behind any address in one go. It shows how long ago the domain was registered and when the registration ends, which registrar holds it, whether HTTPS works with a valid certificate, whether plain HTTP redirects to it, and whether the site's servers appear on free spam blocklists. It then reads the homepage for contact details, privacy and terms links, a name that does not match the domain, wording common on scam pages, and addresses that imitate well-known brands. Every signal is marked as passed, a warning or information, with a short summary. It cannot certify that a site is safe, and it says so; it gives you the facts to decide what to check next.

How to use the Website safety checker

1. 1 Copy the addressCopy the website address from your browser, an ad or a message. You can paste a full link or just the domain, such as example.com. Do not click a link you are unsure about just to get its address: long-press or right-click it and copy it instead.
2. 2 Run the checkPaste it into the box and start the check. The tool contacts the domain registry, opens a secure connection to the site, looks up its IP addresses on spam blocklists and reads the homepage. It takes a few seconds.
3. 3 Read the summary firstThe summary at the top says whether we found high-risk signs, caution signs or no obvious warning signs, and lists the ones that matter. High-risk signs include a domain registered in the last 30 days, a broken certificate and an address that imitates a brand.
4. 4 Open each warningClick any signal to see why it matters and what to do about it. A warning is a reason to look harder, not a verdict on its own.
5. 5 Check Safe Browsing and reviewsFollow the link to Google's Safe Browsing site status, then search for independent reviews of the site. Only pay when the whole picture makes sense, and pay with a protected method.

What a website safety checker can and cannot tell you

There is no official register of safe websites, and no tool can look at a site and prove that the people behind it are honest. What a checker can do is gather public facts that tend to differ between established businesses and throwaway scam sites, and show them in one place so you do not have to run five separate lookups.

Those facts are useful because scams follow patterns. Fake shops are usually set up quickly on newly registered domains, copy their policies from other sites and push buyers to pay fast. Phishing pages borrow a famous brand's name and put it on an address that is one letter off. Seeing several of those signs together should make you stop.

The limits are just as real. A legitimate site that has been hacked keeps its old domain, its certificate and its good reputation until someone notices. A genuine business that launched last month will look young. Some checks, such as the homepage signals, can be fooled by a careful scammer. Treat the result as a prompt for your own judgement, never as a guarantee.

The signals we check and what each one means

Each signal is marked as passed, a warning or information. Information rows are facts worth knowing that do not count for or against the site. The summary at the top highlights any high-risk signs, because a single strong warning matters more than several small ones.

• Domain age: a domain registered within the last 30 days is a high-risk sign; under six months is a reason for caution. Older domains pass, but age alone proves nothing.
• Registration expiry and status: a registration that has lapsed or is about to end, or a registry hold that often follows an abuse report.
• Registrar: the company the domain was registered through, shown for information and for reporting abuse.
• HTTPS and certificate: whether the site answers over HTTPS with a valid certificate, who issued it and how many days it has left, and whether plain HTTP redirects to HTTPS.
• Spam blocklists: whether the website or mail server IP addresses appear on free DNS blocklists. These lists track spam senders, not fraud, so a listing is a hint rather than proof.
• Security headers and homepage: whether the homepage loads, and whether basic security headers are set.
• Page signals: contact details, privacy and terms links, a name in the title that does not match the domain, and wording often seen on scam pages, which is shown for information only.
• Lookalike address: domains one character away from a well-known brand, digit swaps such as a 1 for an l, or a brand name paired with words like login or secure.

How to spot a scam website yourself

Automated checks work best alongside a few minutes of your own attention. Start with the address bar. Read the domain from right to left up to the first single slash: in paypal.com.account-help.net, the site belongs to account-help.net, whatever comes before it. Watch for swapped letters, extra words such as secure or support, and endings you would not expect for the business.

Then look at the offer. Prices far below every other retailer, countdown timers on every product and banners saying only two are left are designed to stop you thinking. So are messages that claim your account is locked or that you have won a prize. Real businesses rarely need you to act within the next ten minutes.

Finally, look for the business behind the site. A real company usually has a legal name, a physical address and a phone number that someone answers. In the US you can look up a company in the business registry of the state where it says it is based; most countries have an equivalent public register. Search the site's name together with reviews or scam, and read what appears on sites the business does not control. A brand-new shop whose only reviews are five-star ones on its own pages tells you nothing.

Paying safely: choose methods that let you dispute a charge

How you pay matters as much as where. Credit cards give the strongest protection in many countries. In the US, the Fair Credit Billing Act lets you dispute credit card charges for goods that never arrive or are not as described. In the UK, Section 75 of the Consumer Credit Act makes the card provider jointly liable for credit card purchases between £100 and £30,000. Debit cards usually offer a chargeback through the card scheme, which is helpful but not a legal right, and the rules vary by bank.

Established payment services such as PayPal have their own buyer protection programs when you pay for goods through their checkout. Read the terms, because sending money as a payment to friends or family usually gives up that protection, which is exactly why scammers ask for it.

Be very wary of any shop that asks for a bank transfer, a wire transfer, gift cards, cryptocurrency or a money transfer service such as Western Union. Those payments are hard or impossible to reverse. A legitimate retailer will take a card.

How to report a scam website

Reporting a scam site helps get it taken down and warns others, even if you did not lose money. If you have paid, contact your bank or card provider first, as quickly as you can, and ask about a chargeback or dispute.

• United States: report fraud to the Federal Trade Commission at ReportFraud.ftc.gov, and internet crime to the FBI's Internet Crime Complaint Center at ic3.gov.
• United Kingdom: report fraud to Action Fraud in England, Wales and Northern Ireland, or to Police Scotland by calling 101. Suspicious websites can also be reported to the National Cyber Security Centre through its online form.
• Canada: the Canadian Anti-Fraud Centre. Australia: Scamwatch, run by the ACCC. In the European Union, contact your national police or consumer authority; the European Consumer Centres Network helps with cross-border purchases.
• Everywhere: report phishing pages to Google Safe Browsing so that Chrome, Firefox and Safari can warn other visitors, and report abuse of the domain to the registrar shown in the result.

Checking your own business website

Customers increasingly run these checks on the businesses they buy from, so it is worth seeing how your own site looks. A legitimate business can trip warnings for simple reasons: a new domain, no phone number or address on the homepage, no link to a privacy policy, or a trading name that differs from the domain. Each is easy to fix.

Show your business name, address and phone number on the site, link your privacy policy and terms from every page, keep your certificate renewing automatically and redirect HTTP to HTTPS. If your server shows up on a spam blocklist, find out why: a compromised mailbox or contact form is a common cause. Our full website audit checks the technical side in more depth.

Examples you can copy

paypa1-secure-login.com
  → digit 1 in place of the letter l
  → "secure" and "login" added to a brand name

paypal.com.account-help.net
  → the real domain is account-help.net
  → everything before it is a subdomain the owner chose

Domain age:        registered 12 days ago   (high risk)
Certificate:       valid, 89 days left      (pass)
HTTP → HTTPS:      redirects                 (pass)
Contact details:   none on the homepage      (warning)
Policies:          none linked               (warning)
Scam wording:      "80% off", "only 3 left" (info)

Next step: check Safe Browsing, search for reviews,
and do not pay by bank transfer or gift card.

Common mistakes to avoid

Frequently asked questions