How to Check if a Website Is Legit Before You Trust It With Anything

Fake websites have gotten very convincing. A professional-looking design, an SSL certificate (the padlock in your browser), and a plausible domain name are no longer reliable signals of legitimacy. Attackers can set all of those up in about an hour. What they cannot easily fake is history.

Here are the checks that actually matter, in order of how quickly you can run them.

Check the Domain Age

Legitimate businesses have domains that have been registered for years. A domain registered last week is not impossible for a real company, but it is a major red flag for a site asking you to enter payment details.

Look up the domain on a WHOIS service. The 'Created' date tells you when it was first registered. If a site is presenting itself as an established retailer or service provider but its domain is three weeks old, that does not add up.

The WHOIS Lookup tool on this site gives you this information instantly for any domain.

Look at the Domain Itself

Attackers register domains that look like real ones but with small variations: paypa1.com (number one instead of letter L), amazon-secure.net, netflix-billing.com. They rely on you to glance at the URL and not read it carefully.

Before you type anything into a site, read the full domain name slowly. The legitimate domain for a major service is usually just the company name followed by .com or their country code. Any extra words, hyphens, or numbers are suspicious.

Also check for IDN homograph attacks: characters from other alphabets that look identical to Latin letters. A Cyrillic 'a' looks exactly like the Latin 'a' but it is a different character. A URL that looks like apple.com may contain non-Latin characters.

Check the SSL Certificate

Every site should have HTTPS today. But an SSL certificate alone proves nothing except that the site owner bought a certificate from a certificate authority. Attackers get SSL certificates for fake sites routinely.

What the certificate does tell you is the name it was issued to. Click the padlock in your browser address bar, then look at the certificate details. The Subject or Common Name field should match the site's domain exactly. If the certificate is issued to a completely different domain, leave immediately.

Extended Validation (EV) certificates, which show the company name in the browser bar, are harder to obtain fraudulently because they require identity verification. They are increasingly rare but still worth noting when present.

Check the WHOIS for Contact Information

Real businesses list real contact information. Look at the WHOIS registration for the domain: is there a registrant name, organization, and address? Is there an email address that matches the domain?

Many fake sites use privacy protection services to hide this information. Privacy protection is also used by legitimate sites, so this alone is not conclusive. But a domain with no organization information, a privacy proxy for contact details, and a registration date of two weeks ago is building a pattern.

Look at What the Security Headers Say

Real sites that handle authentication and payments invest in their security headers. A site with no Content-Security-Policy, no X-Frame-Options, and a missing Strict-Transport-Security header may not have had much security investment at all.

The Security Headers Checker on this site scans any URL and shows you what headers are set and what is missing. A completely bare security header profile on a site asking for your financial information is a warning sign.

Search for the Site Name Plus 'Scam' or 'Review'

Before trusting an unfamiliar retailer or service, run a quick search. Sites that are actively scamming people tend to accumulate complaints on forums, Reddit, and review aggregators relatively quickly. A search for sitename.com review or sitename.com scam takes thirty seconds.

The absence of reviews is also notable. A business that claims to have been operating for years but has no reviews, no social presence, and no forum mentions should be questioned.

The Pattern Recognition Test

Legitimate businesses look consistent. Their domain matches their company name. Their contact page has a real address. Their social media accounts have been around for more than a few months. Their SSL certificate is issued to the correct domain. Their WHOIS registration is older than the thing they are selling.

Fake sites fail at least one of these checks. Usually more than one. Run through the list in three minutes. If anything does not add up, trust that instinct.

The tools in the Network section of this site handle most of these checks: WHOIS lookup for domain age and registrant, SSL checker for certificate details, and security headers for the server configuration. None of them require any software installation.