How to check if a website is legit

Updated · 6 minute read · By the IsSiteLegit team · How we write our guides

To check if a website is legit, look at five things before you pay or type in a password: the exact web address, how old the site is, whether it is on a security blacklist, who runs it, and how it wants you to pay. No single check proves a site is honest, but scam sites almost always fail two or three of them. It takes about five minutes by hand, or about 20 seconds with a free checker.

The quick version

  • Read the address letter by letter. Look-alike names such as paypa1.com or amazon-deals.shop are the most common trick.
  • A website that is only a few weeks or months old is the biggest single warning sign for a shop.
  • If a security blacklist lists the site, don't use it.
  • A real business tells you who it is: a company name, an address and a way to contact a person.
  • Only pay with a card or a payment service that offers buyer protection. Bank transfer, crypto and gift cards are red flags.
  • The padlock in your browser does not mean a site is honest. Scam sites have one too.

Is the web address exactly right?

Start with the address bar, not the page. Scammers copy the look of real websites perfectly, but they can't use the real address. Check the part just before the first single slash: that is the website you are actually on. In https://www.paypal.com.account-help.net/login the real website is account-help.net, not PayPal.

Watch for swapped letters (amaz0n, rnicrosoft with "r" and "n" instead of "m"), extra words (nike-outlet-sale) and unusual endings (.shop, .top, .xyz instead of .com). Our guide on checking a link before you click shows how to read an address step by step.

How old is the website?

Fake shops usually live for a few weeks: they take orders, never deliver, and reopen under a new name. So a site whose address was registered recently is a strong warning sign, especially if it claims to have been in business for years. You can look up the registration date yourself with the official ICANN Lookup tool (type the address and look for the "created" date).

A new website is not automatically a scam. Honest businesses launch every day. But a brand-new site combined with huge discounts or strange payment methods is a pattern worth walking away from.

Is the site on a security blacklist?

Security companies keep lists of websites caught spreading malware or stealing passwords (phishing). If a site is on one of these lists, don't open it, log in or pay. You can check one of the biggest lists with Google's Safe Browsing site status page. IsSiteLegit checks several lists at once.

Not being on a blacklist doesn't prove a site is safe: new scam sites often aren't listed yet. That is why the other checks matter.

Can you tell who runs it?

A trustworthy website says who is behind it. Look for a company name, a street address, a phone number and an email address that uses the site's own name (not only a free Gmail or Outlook address). Then check that the details make sense together: the same company name on every page, an address that exists in a map app, and a phone number from the same country.

For shops, also look for a returns policy, terms and conditions and a privacy policy. Missing pages, or pages that still mention a different shop's name, are a sign the site was put together quickly from a template.

How does it want you to pay?

This is the most important check, because it decides whether you can get your money back. Pay with a credit card, or a payment service with buyer protection, so you can dispute the charge if nothing arrives. If a site only accepts bank transfer, cryptocurrency, gift cards or money-transfer apps, don't buy: those payments are very hard to reverse. Be especially careful if a card payment "fails" and you are asked to pay another way instead.

What do other people say about it?

Reviews on the website itself are easy to fake. Search for the site's name together with words like "reviews", "complaints" or "scam" and read what people say on independent sites and forums. A pile of reports about orders that never arrived is a clear signal. Having no reviews at all is not proof of a scam, but it means you are trusting a site nobody can vouch for.

Does the padlock mean a website is safe?

No. The padlock (HTTPS) only means the connection between you and the site is encrypted, so others can't read what you send. It says nothing about who is on the other end. Security certificates are free and automatic, and most scam sites have one. A site without a padlock is a reason not to type anything into it; a site with one still needs the other checks.

Does a professional-looking design mean it's real?

No. Scam sites often copy the photos, logos and even the text of real shops, and some are built with the same shop software honest businesses use. Judge a site by its address, age, payment methods and owner details, not by how polished it looks. Adverts are not a recommendation either: platforms don't check the shops that advertise on them.

Check a website for free in 20 seconds

Enter the address on IsSiteLegit. We look up the registration date, several security blacklists, look-alike brand names, the security certificate and when the site was first seen online, how popular it is, and the site's own pages (contact details, policies, payment methods, extreme discounts and pressure tactics). You get a verdict, a trust score from 0 to 100, and every piece of evidence behind it, so you can judge for yourself. It's an automated assessment, not a guarantee — here is exactly how the score works. To see what results look like, browse popular websites we've checked.

Common questions

What should I do if a check says "Use caution"?

Read the warning signs the result lists, and decide whether they matter for what you are about to do. Buying a cheap item with a credit card is a small risk; sending a bank transfer or your ID documents is a big one. When in doubt, buy from a shop you already know.

Can a legit website be brand new?

Yes. Every website was new once. A new site with clear owner details, normal prices, and card or PayPal payments can be perfectly honest. Be careful when a new site also has extreme discounts, no contact details or unusual payment methods.

I already paid a website I don't trust. What now?

Call your bank or card provider straight away, using the number on your card. Our step-by-step guide explains the rest: what to do if you paid a scam website.

Sources and official tools

Check a website now

Free. We show every piece of evidence we find, so you can judge for yourself.

See real results

More guides