Is This Website Legit? How to Check if a Site Is Safe Before You Buy or Log In

A new online shop with prices that look a little too good, a "your parcel is on hold" text with a link, a login page that appeared after you clicked an ad. Before you pay or type a password, it is worth spending five minutes on a few checks. None of them is perfect on its own, but together they catch the large majority of obvious scams and give you a much better feeling for the rest.

One honest warning up front: no tool and no checklist can guarantee that a website is safe. Scam sites appear and disappear within days, and a site that was fine last year can be hacked today. Treat every check below as a signal, not a verdict, and let the overall picture decide.

1. Read the address, character by character

Most phishing relies on you not looking closely at the URL. Before anything else, check the domain in the address bar — the part right before the first single slash.

• Typosquatting: paypa1.com, arnazon.com (r+n instead of m), micros0ft-support.com. Swapped, doubled or look-alike letters are the classic trick.
• Brand as a subdomain: in paypal.com.account-verify.net the real domain is account-verify.net. Everything to the left of it can be chosen freely by the owner.
• Unusual extension: a familiar brand on an odd extension (.shop, .top, .xyz and many others) is not proof of fraud, but it is a reason to check harder.
• Look-alike characters from other alphabets: Cyrillic "а" or "о" can look identical to Latin ones. Browsers often show such domains in their encoded xn-- form, which is itself a warning sign.

If you arrived through a link in an email, message or ad, type the brand’s address yourself or use a bookmark instead.

2. Check how old the domain is

Scam shops usually live on freshly registered domains, because older ones get reported and blocked. Look up the registration date with the domain age checker or the full record in WHOIS lookup (modern registries answer via RDAP, the successor of WHOIS).

• A domain registered a few weeks ago that claims "20 years of experience" is a strong red flag.
• A young domain alone is not proof: every legitimate business also starts with a new domain.
• An old domain is not proof of honesty either. Expired domains are bought up and reused, and established sites get hacked.

Our article on what domain age really means explains how to read registration and expiry dates.

3. HTTPS and the padlock do not mean "legit"

The padlock only means the connection between you and the server is encrypted. It says nothing about who runs the site. Free certificates are issued automatically in minutes, and phishing pages use HTTPS as a matter of course.

What HTTPS problems do tell you: if a shop or login page has no HTTPS at all, an expired certificate or a certificate for a different domain, leave. You can see the details — issuer, validity dates, which names it covers — in the SSL checker.

4. Who is behind the site?

A real business can be identified. Look for:

• a legal company name, registered address and, in many countries, a registration or tax number — and then check it in the official company registry of that country;
• a working phone number and an email on the company’s own domain, not only a contact form or a free mailbox;
• terms of sale, a returns policy and a privacy policy written for this shop, not copied text with someone else’s name left in it;
• a physical address that is not a residential flat or a random location when you look it up on a map.

Missing details do not prove fraud, but details that do not match (a "London" shop with a company number that does not exist) are a serious warning.

5. Look for reviews off the site

Reviews on the shop’s own pages are written or selected by the shop. Search for sitename.com reviews and sitename.com scam, and check independent platforms such as Trustpilot, forums and social networks.

Keep in mind that fake reviews exist on every platform. Be suspicious of a burst of five-star reviews posted within a few days, generic texts without details, and a total absence of reviews for a shop that claims thousands of customers. Detailed complaints describing the same pattern (paid, nothing arrived, support stopped answering) are worth more than any rating.

6. Payment methods and prices

• Card or PayPal at checkout give you a route back: card chargebacks and buyer protection schemes exist precisely for "goods never arrived" cases (the rules depend on your bank and country).
• Only bank transfer, crypto or gift cards — or a request to pay "directly to the manager" — is one of the strongest scam signals. Money sent this way is very hard to recover.
• Prices far below everyone else, permanent "last 2 hours" countdowns and "only 3 left" for every product are pressure tactics. Big discounts happen, but not on everything, every day.

7. Check Google Safe Browsing and a domain trust report

Google’s Safe Browsing status can be looked up for any site at transparencyreport.google.com/safe-browsing/search. It shows whether Google currently considers the site dangerous (phishing, malware, unwanted software). A clean result means "not flagged yet", not "safe": new scam sites are often not yet in any list.

For a broader technical picture, run the domain trust check: HTTPS, certificate, security headers, DNS and mail records, basic SEO hygiene. A carefully configured site is not automatically honest, but a shop that claims to be a large brand and has none of the basics is suspicious. How to read that report is explained in the domain trust check guide. The website security scanner adds a passive check for signs of malicious code, outdated software with known vulnerabilities and listings in URLhaus.

How to check a suspicious link without clicking it

If the link came in a message, do not open it to "see what happens". Instead:

1. Look at the real target. On a computer, hover over the link; on a phone, long-press it and read the address in the preview without opening.
2. Expand short links. Shorteners hide the destination. Paste the short URL into the redirect checker: it follows every hop on our server and shows where the chain ends, without loading the page in your browser. More on reading chains: how to check redirects.
3. Ask the scanners. VirusTotal checks a URL against dozens of security vendors; URLhaus tracks addresses that distribute malware; Google Safe Browsing covers phishing. Several clean results are reassuring but still not a guarantee.
4. Go the long way. If the message claims to be from your bank or a delivery service, open their app or type their address yourself and look for the same notification there.

Quick checklist

• The domain is spelled exactly right and the brand is the real domain, not a subdomain.
• The domain is not days or weeks old — or, if it is, everything else checks out.
• HTTPS works and the certificate matches the domain (necessary, not sufficient).
• Company details exist and match the official registry.
• Independent reviews exist and do not describe the same complaint over and over.
• You can pay by card or PayPal; nobody asks for crypto, gift cards or transfers.
• Google Safe Browsing and the security scanners do not flag the site.

If you have already paid or entered a password

• Paid by card: call your bank right away, block the card if details were entered, and ask about a chargeback. Banks have deadlines, so do not wait.
• Paid via PayPal or a marketplace: open a dispute through their resolution centre.
• Entered a password: change it on the real site and everywhere you reused it, enable two-factor authentication and sign out of other sessions.
• Report the site: to Google Safe Browsing (the "report phishing" form), to the hosting provider or registrar shown in WHOIS, and to your country’s national CERT or consumer protection authority. Reports help get the site blocked for the next person.
• Keep evidence: screenshots, the URL, order confirmations and payment receipts.