Skip to content
WebAuditOS
Start free audit

Test your website now

Free, no card. We read only public pages.

Run free audit →

Security

How can you tell if a website is safe?

The checks that tell you whether a website is legitimate before you buy or sign up: the address, reputation, company details, payment options and red flags.

To tell if a website is safe, check that the address is spelled exactly right, look up the domain in Google's Safe Browsing status page, search for independent reviews and complaints, confirm a real company name, address and contact details, and pay only with methods that offer buyer protection. A padlock alone only proves the connection is encrypted.

Published · Last updated

By Michal Měřínský. Audit methodology.

The padlock is not enough

HTTPS certificates are free and issued automatically, including to scam sites. A padlock means your connection to the site is encrypted. It does not mean the site is honest. Use it as a minimum, not a verdict.

Checks before you buy or sign up

  • The address: look for misspellings, extra words and unusual endings, such as paypal-secure-login.example. Type important addresses yourself instead of following links from messages.
  • Safe Browsing: Google's Transparency Report lets you check whether a site is currently flagged as dangerous.
  • Reputation: search the site's name with words like scam and reviews. Look at independent review sites, not testimonials on the site itself.
  • Company details: a legal company name, a physical address, a working phone number or email, terms and a privacy policy. Missing details are a strong warning sign.
  • Domain age: very new domains selling high-demand products at low prices are a common scam pattern. WHOIS lookups show when a domain was registered.
  • Payment: card payments and established payment services offer buyer protection. Bank transfers, crypto and gift cards do not.

Red flags

  • Prices far below every other shop.
  • Pressure: countdown timers, only two left, act now.
  • Requests for passwords, codes or payment details by email or chat.
  • Copy that reads translated or copied, with product photos found elsewhere.
  • No way to contact anyone except a form.

If a message pushes you to a login page, close it and go to the site directly. Most account takeovers start with a convincing link.

If you are a site owner

Visitors run these same checks on you. Show your company name, address and contact details clearly, link a privacy policy and terms, use HTTPS everywhere, and show real customer evidence such as case studies or reviews on independent platforms. Missing trust details cost conversions even on perfectly legitimate sites.

What a scan can and cannot tell you

WebAuditOS checks the trust basics a site owner controls: HTTPS, links resembling contact information, linked privacy policy and terms, and links to trust signals such as case studies or reviews.

It does not judge whether a business is honest, check reviews or blocklists, or detect scams. For a site you are thinking of buying from, use Safe Browsing, independent reviews and payment protection.

A site can pass every technical check and still be a scam. Technical health and honesty are different questions.

Short answers

Does HTTPS mean a site is safe? No. It means the connection is encrypted.

How do I check if a website is legit? Address, Safe Browsing status, independent reviews, company details and payment protection.

Is a new domain always a scam? No, but combined with low prices and pressure tactics it is a warning sign.

What should I do if I paid a scam site? Contact your bank or card issuer immediately and report the site.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

Security

How do you secure a website?

The security basics every website needs, in order: HTTPS, updates, authentication, secrets, headers, backups and monitoring.

HTTPS and TLS

What is HTTPS, and does your website need it?

HTTPS encrypts the connection between a browser and your site. What it protects, why every site needs it, and how to switch from HTTP safely.