Domain Trust Check

Website trust checker: what it actually measures

The important part first: this check looks at a site's technical hygiene. It is not an antivirus scan, a scam database or a review aggregator. It loads the page you enter plus the domain's robots.txt, sitemap.xml and DNS, and runs 15 checks. Each has a weight, and the weights add up to 100:

Enter the address with https:// or with no scheme at all. The certificate is read on the first connection, so an http:// address can fail the SSL check even if the site then redirects to https.

A high score does not mean a site is safe to pay

Scammers mastered technical hygiene long ago. A free Let's Encrypt certificate takes a minute, security headers can be pasted from any tutorial, and off-the-shelf store templates ship with Open Graph and Schema.org already in place. A phishing clone of a well-known shop can score 90+. An honest small store on an old CMS can score 50 simply because nobody turned on HSTS.

The tool does not look at domain age, reviews, complaints, company details or malware and phishing blocklists. So it can only partly answer "is this website legit?": a low score is a reason to look closer, and a high score is no guarantee. The checklist below is what settles it.

Reading the score, and how it differs from "domain trust" in SEO

The bands are 80–100 "Excellent", 60–79 "Good", 40–59 "Average" and below 40 "Poor". Under the score each check is labelled with what was found or what is missing. Large company sites usually lose points on CSP and X-Frame-Options, while small sites on website builders tend to miss HSTS, a sitemap or structured data. That is normal and says nothing about whether the owner is honest.

In SEO, "trust" usually means something else: how authoritative a domain looks to a search engine. Google does not publish such a metric, and third-party tools estimate it from the backlink profile, for example as Domain Rating. To check those domain metrics, look at referring domains and DR. The Domain Rating explainer covers what they mean and where to get them. The technical signals in this report are groundwork, but they barely move rankings on their own.

How to check if a website is legit before you buy

1. Read the address bar. Look for extra words and letters: brandname-deals.shop, brandname-outlet.top, brandname.com.secure-checkout.top, where brandname is a store you know. In the last one the real domain is secure-checkout.top; everything to the left is a subdomain the owner can name however they like.
2. Check the domain age. A shop claiming "15 years in business" on a domain registered last month is the most common sign of a fake. It takes seconds with the domain age checker.
3. Company details. A real seller lists a legal entity, a registration or VAT number and an address. Look the company up in the official business register and compare the name and incorporation date.
4. Price. 50–70% off popular items such as phones, electronics or designer clothing is almost always bait.
5. Payment. Bank transfer to a personal account, crypto, gift cards or a "safe deal service" link sent by chat: stop. Pay by credit card or PayPal so you can dispute the charge.
6. Contact. WhatsApp or Telegram only, with no phone number and no email on the site's own domain. The MX row in the report helps here: if the domain has no mail set up, "info@" addresses on that site go nowhere.
7. Reviews off the site. Reviews on the shop's own pages are written by the shop. Search the name and domain on Google Maps, Trustpilot and Reddit, adding words like "scam" or "reviews".
8. Photos and copy. A reverse image search with Google Lens quickly shows when "our warehouse" photos come from someone else's site.
9. Legal pages. Return, shipping and privacy policies copied from another store, sometimes with its name still in them, are a common giveaway.

Other places to check a website's safety

• Google Safe Browsing: the site status lookup in Google's Transparency Report (transparencyreport.google.com) shows whether Google flags the address as phishing or malware.
• VirusTotal scans a URL against dozens of security vendors at once.
• WHOIS shows the registration date, registrar and country. Hidden owner details are normal; a domain registered yesterday is not.
• The certificate: the padlock only means the connection is encrypted. Who the certificate was issued to, and when, is shown by the SSL checker.

If you have already paid a scammer, call your bank using the number on your card straight away and ask them to block the card and dispute the payment. Then report it to the police or your national fraud reporting service.

How to raise your own site's trust signals

If you own the site and want it to look trustworthy both to people and to this check, most items take under an hour. Security headers for nginx:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Content-Security-Policy-Report-Only "default-src 'self' https:; img-src * data:" always;

On Apache use Header always set in .htaccess with mod_headers enabled. Start CSP in Report-Only mode: a strict policy switched on in one go readily breaks analytics, chat widgets and payment forms. Beyond headers:

• publish robots.txt with a Sitemap: line, and the sitemap itself;
• add Organization or LocalBusiness JSON-LD with your name, address and phone, the same details shoppers look for;
• add canonical, lang, viewport, a favicon and Open Graph if any are missing;
• use email on your own domain (MX records) instead of a gmail address in your contacts.

The security headers checker shows which headers you already send and whether their values are right. What each one does is explained in the glossary entry on security headers.