How to Check If a Website Is Safe

Most advice about website safety is either “look for the padlock” or a list of things to be frightened of. Neither is much use in the actual situation, which is that you are on a page you have never seen, it is asking for something, and you have about twenty seconds of patience.

Here is a more useful order to check things in.

First: the padlock means almost nothing

The padlock in the address bar means traffic between you and the site is encrypted. That is all it means. It says nothing about who runs the site or whether they are honest, and certificates are free, so essentially every scam site has one.

Encryption without trustworthiness is a locked van with an unknown driver. Useful, but not the question you were asking.

Second: read the domain very carefully

This is where most successful deception happens, and it is the cheapest check available.

• Check the actual registered domain. In secure-login.example-bank.verify-id.com, the site is verify-id.com. Everything before it is decoration. Read right-to-left from the last dot before the first slash.
• Look for near-misses. Swapped letters, an added hyphen, .co instead of .com, a lowercase L standing in for an I.
• Be suspicious of how you arrived. Domains are most dangerous when you got there from a link in a message rather than by typing the address yourself.

Third: check the reputation elsewhere

Do not trust what a site says about itself — check what other systems say about it.

Google’s Safe Browsing site status tool will tell you whether a URL is on the list your browser already uses. VirusTotal will run a URL past a large number of security vendors at once. Both take about fifteen seconds and neither requires an account.

A clean result is not a guarantee — new scam domains are clean until they are reported — but a flagged result is close to conclusive.

Fourth: how old is it

Most fraudulent sites are new, because they get shut down and rebuilt. A shop that appears to have been trading for years but whose domain is six weeks old is telling you something.

Two ways to check without any special tools: look the site up in a web archive and see whether snapshots exist from previous years, and look for the domain registration date. A site with a decade of archived history is unlikely to be a throwaway. See how web archives actually work.

Fifth: look for signs of an actual organisation

Legitimate businesses tend to be findable. Look for a physical address, a company registration number, a phone number, a returns policy that makes sense, and a privacy policy that mentions the actual company name rather than a template placeholder.

Warning signs in the other direction: contact only via a web form, prices substantially below everyone else, aggressive countdown timers, reviews that are all five stars and all posted the same month, and payment by bank transfer or gift card. That last one is nearly decisive — legitimate retailers do not ask for it.

What to do when you are unsure

Downgrade rather than deciding. You do not have to choose between trusting a site and leaving.

• Read it without giving it anything. Browsing is low risk. Typing is where risk begins.
• Never reuse a password. This is the single highest-value habit, because it converts a breach of one site into a problem confined to that site.
• Prefer a payment method with recourse. Cards have chargeback rights that transfers do not.
• Do not follow the link you were sent. If a message claims to be from a service you use, open that service the way you normally would and check there.

The underlying principle

Safety is not a property of a site, it is a property of what you do on it. Reading an unknown page costs you very little. Handing it a password you use elsewhere is where the actual exposure comes from, and that decision is entirely yours regardless of what the padlock says.

The same instinct applies to the more general problem of working out whether a page is worth believing — see AI slop: how to spot it.