You can check if a website is legit in under a minute. Look at the URL, confirm HTTPS, find real contact details, read independent reviews, and run the site through a free safety checker. If two or more of these checks fail, treat the site as risky.
Fake websites don’t look fake anymore. Scammers copy real store designs, steal product photos, and even fake trust badges. A polished homepage tells you almost nothing about whether a business is real. If you’re asking “is this website legit?” before you buy or share personal details, this guide walks you through the checks that actually matter, from the fastest ones to the deepest ones, so you can decide with confidence.
No single check proves a site is 100% safe. But combining several checks gets you very close, and that’s what this guide teaches you to do.
The five checks below help you verify almost any website before you buy, create an account, or share personal information. If several checks fail, it’s usually safer to leave the site.
Quick answer: the fastest way to tell if a site is legit
Check the URL for spelling tricks, confirm the site uses HTTPS, look for real contact information and policies, read reviews on independent platforms, and scan the site with a free tool like Google Safe Browsing. A trustworthy site usually passes all five checks. A risky site usually fails at least two.
Use this 5-point check first
- URL spelling and domain — Does the web address match the brand exactly?
- HTTPS and certificate — Does the address start with “https://” and show a padlock?
- Contact details and policies — Is there a real address, phone number, and return policy?
- Independent reviews — What do people say on sites the business doesn’t control?
- Safety tool scan — Does a free checker flag the site as risky?
Quick checklist box: Print or save this. Before you buy or log in anywhere new, run through all five points. Skipping even one can let a scam slip through.
Want to see this checklist applied to real sites? Browse our Recently Reviewed Websites section below.
Check the URL before you do anything else
The web address is the fastest clue to a fake site. Scammers often use a domain that looks almost right but has an extra word, a swapped letter, or an unusual ending like “.shop” or “.xyz” instead of “.com.”
Look for typo-squatting and lookalike domains
Typo-squatting means registering a domain that’s one letter off from a real brand, hoping you won’t notice. A scammer might register “amaz0n-deals.com” or “paypal-secure-login.net” to trick you into thinking you’re on the real site.
Watch for these patterns:
- Extra words added to a known brand name (brandname-outlet.com)
- Swapped or doubled letters (gooogle.com)
- A different ending than you’d expect (.shop, .xyz, .top, .info)
- A brand name used as a subdomain of something else (paypal.login-secure.com, where “login-secure.com” is the real, unrelated domain)
A domain extension alone does not determine whether a website is legitimate. Many genuine businesses use newer domain extensions, so always weigh this alongside the other checks in this guide rather than on its own.
Note: the examples above are fictional and used only to illustrate common scam patterns, not to accuse any real domain.
Confirm the domain matches the brand
Before you trust a site, compare it with the company’s official website and verified social media profiles. If you’re unsure, search the company name yourself rather than relying on a shared link.
Legit vs. suspicious URL patterns
| Pattern | Example | What it usually means |
|---|---|---|
| Exact brand match | nike.com | Likely the real company site |
| Extra word added | nike-outlet-store.com | Often a copycat or scam site |
| Swapped letters | nkie.com | Almost always a scam or typo trap |
| Unusual ending | nike-shop.xyz | High risk, verify carefully |
| Brand as subdomain of unrelated domain | nike.freeoffers.com | Not affiliated with the real brand |
Table examples are fictional illustrations of common patterns, not claims about the real brand.
See how these patterns show up in real cases in our site verdict reviews.
Confirm HTTPS, but don’t stop there
HTTPS means your connection to the site is encrypted, so data traveling between you and the site can’t easily be read by someone else. It does not mean the business behind the site is honest. Scam sites can and do use HTTPS.
What HTTPS tells you
HTTPS (shown as a padlock icon next to the address) confirms that the data you send, like a password or card number, is scrambled during transit. This protects your data from being intercepted on the way to the server.
What HTTPS does not tell you
HTTPS does not confirm the site owner’s identity, honesty, or business practices. Free certificates are easy to get, and scammers use them just as often as legitimate businesses do. Treat the padlock as one small piece of proof, not a stamp of approval.
HTTPS protects the connection between you and the website. It does not verify the honesty or legitimacy of the business operating the website.
How to inspect certificate details
Click the padlock or lock icon in your browser’s address bar, then look for “Certificate” or “Connection is secure.” This shows who issued the certificate and sometimes the organization it was issued to. Most scam sites use a basic certificate with no organization name listed, which isn’t proof of a scam by itself but is worth noting alongside other checks.
Warning box: HTTPS is necessary, but it is never enough on its own. Never assume a site is safe just because the address starts with “https://”.
Verify the business behind the website
A legitimate business is easy to reach and easy to verify. Look for a real address, working phone number, support email, and clear policies. If any of these are missing or vague, treat that as a warning sign.
Check contact information
A trustworthy site usually lists:
- A physical business address (not just a P.O. box)
- A working phone number
- A support email that matches the site’s domain (not a free Gmail or Yahoo address)
- A contact page that actually works, not a dead link
Review policy pages
Real online stores publish clear policies because they’re often legally required to, and because it builds buyer trust. Check for a privacy policy, shipping policy, return or refund policy, and terms of service. Vague or missing policies are a common scam signal, especially on sites selling physical products.
Cross-check company details
Search the business name along with words like “reviews” or “complaints.” Check if the address shows up on Google Maps as a real location. Look up the phone number to see if it’s linked to other unrelated businesses, which can be a sign of a shell operation.
Checklist for online stores:
- Physical address listed and appears on Google Maps
- Phone number works and matches the business
- Support email uses the company’s own domain
- Return and refund policy clearly stated
- Shipping timelines and costs are specific, not vague
These checks focus on online stores; B2B and SaaS sites need different signals.
Curious how specific stores measure up? Check our individual site reviews for detailed breakdowns.
Read reviews the right way
On-site reviews are weak proof because the business controls what gets shown. Reviews on independent platforms carry more weight because the business can’t easily delete or edit them.
Separate on-site reviews from independent reviews
A five-star rating on a company’s own homepage proves very little. Instead, search for the business name on independent review platforms, in community forums, or in Google’s own review panel. If a business has no presence anywhere except its own site, that absence is itself a signal worth noting.
Spot suspicious review patterns
Fake reviews tend to share a few traits. Watch for:
- Generic praise with no specific details (“Great product, fast shipping!”)
- Similar wording repeated across many reviews
- A cluster of five-star reviews posted within days of each other
- No mix of ratings at all, including no 3- or 4-star reviews
- Reviewer accounts with no other review history
Trustworthy vs. fake-review signals
| Signal | Trustworthy | Likely fake |
| Detail level | Specific, mentions product or experience | Vague, generic praise |
| Rating spread | Mix of 5-star, 4-star, and some lower | Almost all 5-star |
| Timing | Spread out over months or years | Bunched together in days |
| Reviewer history | Reviewer has posted other reviews | Single review, new account |
| Wording | Varied phrasing across reviews | Repeated phrases or templates |
For a deeper, platform-by-platform method… see our guide on how to check a website’s reviews before trusting it.
Use safety tools to check reputation
A website safety checker scans a site’s history and flags known scam patterns, malware, or blocklist entries in seconds. No single tool catches everything, so using two or three together gives a more reliable picture.
Google Safe Browsing
This free tool checks whether a web address has been flagged for hosting malware, phishing pages, or other unsafe content. It’s a good first scan because it draws on data from billions of pages Google has already crawled.
URLVoid
URLVoid checks a domain against multiple blocklist and reputation databases at once, giving you a quick sense of how many security vendors consider the site risky.
ScamAdviser
ScamAdviser combines domain age, hosting location, and other technical signals into a single trust score, which is useful for a fast overall read on unfamiliar sites, especially online stores.
Other checkers
Resources like Get Safe Online offer broader guidance on online safety and can help you interpret what a risky scan result actually means for your next step. Government resources such as the FTC’s scam reporting site and CISA also publish current scam patterns worth checking if something feels off.
Which tool to use for what
| Tool | Best for | What it won’t tell you |
| Google Safe Browsing | Malware and phishing flags | Business legitimacy or review quality |
| URLVoid | Cross-checking multiple blocklists at once | A full trust score |
| ScamAdviser | A quick overall trust score for stores | Guaranteed accuracy on brand-new sites |
| Get Safe Online | General safety guidance and next steps | Site-specific technical scanning |
See how these checks apply in practice in our website reviews.
Check domain age and ownership
A domain’s registration date, visible through a WHOIS lookup, shows how long a website has existed. Very new domains deserve more caution, especially if they’re already selling products or asking for payment.
Review WHOIS data
A WHOIS lookup shows when a domain was registered, sometimes who registered it (unless privacy protection hides this), and where it’s hosted. Many free WHOIS lookup tools exist online and take just seconds to use.
Many legitimate businesses use domain privacy services, so hidden ownership alone is not a red flag. It only becomes worth extra caution when it’s combined with a very new registration date and no other verifiable business details.
Understand what domain age means
A domain registered last month isn’t automatically a scam. New businesses launch websites every day. But a brand-new domain combined with big discounts, urgent countdown timers, and no independent reviews is a common scam combination worth taking seriously.
Domain age alone proves nothing. It only becomes useful evidence when you combine it with the other checks in this guide.
Check the site’s history and social presence
A site’s past versions and its social media activity can reveal a lot in just a few minutes. A sudden change from an unrelated blog into a store, or social profiles with no real activity, are both signs worth investigating further.
Check the website in the Internet Archive
The Wayback Machine stores snapshots of websites over time. Search the domain there to see how long the site has existed and how it has changed.
- Has the site existed for years, or did it appear recently?
- Did it suddenly change from an unrelated blog or template into an online store?
- Was the domain previously used for something completely different?
A site that abruptly pivoted into selling products right before a big sale event is worth extra scrutiny.
Archived snapshots may not exist for newer websites, so the absence of archived pages is not automatically a warning sign on its own.
Check social media presence
Real businesses usually have active, verifiable social media accounts. Look for:
- Profiles that link back to the website (and vice versa)
- A realistic follower count with genuine engagement, not just bulk numbers
- Recent posts, not a page that’s gone silent for months
- Replies to customer questions or complaints, not just promotional posts
Scam sites often display social media icons that either link nowhere or lead to empty, inactive profiles. Clicking through to check is worth the extra few seconds.
Spot scam patterns most people miss
Beyond the basic checks, scam sites often share visual and behavioral patterns: stolen product photos, unrealistic discounts, urgency tactics, and payment methods that are hard to trace or reverse.
Common visual and content red flags
- Product photos that look professionally shot but don’t match the site’s quality claims (often stolen from the real brand)
- Spelling and grammar mistakes in product descriptions or checkout pages
- Logos or branding that look slightly off compared to the real company
- Discounts of 70% or more on every single item, with no exceptions
Unrealistic pricing
If a brand-new phone that normally costs $999 is listed for $89 on a site you’ve never heard of, treat that as a major warning sign rather than a lucky find. Prices far below the normal market rate are one of the most reliable scam signals, even when everything else on the site looks polished.
Checkout and payment red flags
- Payment options limited to bank transfer, cryptocurrency, or gift cards, with no credit card or PayPal option
- Countdown timers claiming a deal ends “in 10 minutes,” even when you return hours later and it still says 10 minutes
- Unexpected extra fees appearing only at the final checkout step
- Pop-ups claiming you’re “the last person” to get a deal
Trust badge and design traps
Some scam sites display security badges or “verified” seals that link to nothing, or that copy the look of real certification logos without any actual certification behind them. A trust badge that isn’t clickable, or that links to the site’s own homepage instead of an outside verification page, isn’t proof of anything.
Table 4: Red flags vs. green flags
| Red flags | Green flags |
| Only bank transfer or crypto accepted | Recognized payment methods with buyer protection |
| Countdown timer never actually expires | No artificial urgency tactics |
| No physical address listed | Verifiable address on Google Maps |
| All reviews are five stars | Mixed, detailed reviews over time |
| Domain registered days ago, big claims | Domain age matches business history |
Build a trust ladder before you decide
Not all checks carry equal weight. This is the core of any real website trust check: design and on-page claims are the weakest evidence, while independent tools and cross-checked business details are the strongest. Use this ladder to weigh what you’ve found instead of treating every signal as equally important.
Lowest-confidence signals
A site’s design, its written claims about itself, and any badges it displays on its own pages. These are easy to fake and prove very little on their own.
Medium-confidence signals
HTTPS, published policies, and on-site reviews. These take more effort to fake, but scammers with resources can still replicate them.
Highest-confidence signals
Independent reputation tools, WHOIS data, and cross-checked business details that appear the same across multiple outside sources. These are the hardest signals to fake convincingly.
Decision box:
- Go — Passes checks at all three levels, especially the highest-confidence ones.
- Caution — Passes low- and medium-confidence checks but fails or lacks highest-confidence verification. Dig deeper before entering payment details.
- Avoid — Fails two or more checks at any level, especially highest-confidence ones.
This ladder is the core framework for this guide. The red flag table above and the exit plan below both build on it rather than introducing new rules.
What to do if the website still feels suspicious
If your gut says something is off, don’t enter payment details. Search for independent mentions of the site first, and walk away if the evidence conflicts.
Stop before entering payment details
Close the tab before typing a card number or password if two or more checks from the trust ladder above have failed.
Search for independent mentions
Search the business name plus “review” or “scam” in a search engine. Check forums or community discussion boards, since real complaints tend to surface there faster than on review platforms a business can influence.
Walk away if the evidence conflicts
One strong positive signal, like a working phone number, does not cancel out several red flags, like no independent reviews and crypto-only payments. When the evidence conflicts, treat the failed checks as the deciding factor.
On mobile specifically: it’s harder to see the full URL or spot a fake padlock icon on a small screen. Before checking out on your phone, tap the address bar to expand and read the full URL, rather than trusting how it looks at a glance.
Recently Reviewed Websites
Browse our website reviews to see how we apply these checks to real websites.
Browse our site verdicts
Browse by category
FAQs about checking website legitimacy
Is HTTPS enough to trust a website?
No. HTTPS only proves your connection is encrypted, not that the business behind the site is honest. Always pair it with the other checks in this guide, especially contact and reputation checks.
How do I know if an online store is safe?
Check the URL for spelling tricks, confirm real contact information and policies, read independent reviews, and run the domain through a free safety tool like Google Safe Browsing. Two or more failed checks means you should be cautious.
What is the best free website checker?
It depends on what you need. Google Safe Browsing is best for malware and phishing flags, URLVoid is best for cross-checking blocklists, and ScamAdviser is useful for getting a quick overall trust score for unfamiliar websites.
How can I tell if a website is fake?
Look for a misspelled or unusual domain, missing or vague contact information, reviews that all sound the same, and payment options limited to bank transfer or cryptocurrency.
What should I do if I already clicked a suspicious site?
Close the site without entering any personal or payment information. If you already entered data, change any reused passwords and monitor your bank statements for unusual activity.
How do I check a website’s reviews before trusting it?
Search for the business name on independent review platforms instead of trusting only the testimonials shown on the site itself. Look for a natural mix of ratings and reviews spread out over time, not a cluster of identical five-star posts.
What’s the difference between a scam site and a low-quality site?
A scam site is built to deceive you into losing money or data, often through fake products, fake urgency, or untraceable payment methods. A low-quality site may be genuine but poorly built, with slow shipping or weak customer service rather than outright fraud. Our full breakdown of the difference between a scam site and a low-quality site covers how to tell which one you’re actually dealing with.
Can scam websites appear in Google Search?
Yes. Google removes many harmful websites, but scammers continuously create new domains faster than every one can be caught. A website appearing in search results is not proof that it’s trustworthy, so it’s still worth running the checks in this guide.
Final checklist before you trust a site
Before entering payment or personal details anywhere new, run this 60-second check. If two or more items fail, don’t proceed.
- URL matches the brand exactly, no extra words or swapped letters
- HTTPS padlock is present and certificate looks legitimate
- Real contact details and clear policies are listed
- Independent reviews exist and look natural, not templated
- A safety tool scan shows no major red flags
Final decision rule
If two or more of these checks fail, don’t enter your payment details. Search for the business independently first, or choose a verified alternative instead.
Your next step: Before your next online purchase or login, run the site through Google Safe Browsing first. It takes under 10 seconds and catches many of the riskiest sites immediately.
This guide helps you assess risk, but no method guarantees complete safety. When in doubt, verify independently before entering payment or personal information.
Research sources referenced in this guide: