How websurely.com calculates the Scam Score

When you check a website on websurely.com, you get a Scam Score from 0 to 100 and a risk level. This article explains, in plain words, what goes into that number, what it's good at, where its limits are, and what site owners can do if they think we got it wrong.

We'd rather you understand the score than blindly trust it. So here's the honest version.

The short version

• The Scam Score is an automated estimate, not a verdict. It's labelled BETA because we keep improving it.
• It combines many checks into one number: how long the website has existed, how popular it is, whether trusted security databases list it, whether its name imitates a well-known brand, whether it has a secure connection, where it's hosted, warning signs on the page and confirmed reports from our community.
• Higher means riskier. 0 means no warning signs at all; 100 means about as risky as it gets.
• Nobody can pay for a better score. Business verification confirms who runs a website, but it never changes the score.
• Site owners can request a free manual review, and a real person will look at it.

What the risk levels mean

What we look at, and why it matters

How long the website has existed

Scam shops and phishing pages usually live for only a few weeks before they disappear and reopen under a new name. A website that has existed for many years has had time to build a reputation. So a very new website raises the score, and a long-established one lowers it. Age alone is never the whole story, which is why we explain it in more detail in Is it safe to shop on new websites?.

How popular it is

Websites that millions of people visit every month are rarely scams, because scams get noticed quickly at that scale. Very popular websites therefore get a lower score. A website almost nobody visits isn't automatically suspicious, but it gets a little less benefit of the doubt.

Whether it's listed as dangerous

We compare every site against more than a dozen trusted security databases that are updated around the clock. They collect phishing pages, malware sites, fake shops and crypto scams reported by security researchers and organisations around the world. A listing from a highly reliable source is one of the strongest warning signs there is.

We're careful here, too: very popular websites sometimes appear on such lists because one page or one user's content was abused, not because the whole site is a scam. We take that into account so a single bad page doesn't brand a well-known website as fraudulent.

Whether the name imitates a well-known brand

We look for names that imitate famous brands, banks and services: typos, swapped or look-alike letters and brand names hidden inside longer addresses. A website pretending to be a brand it isn't gets a strong warning. More in Look-alike domains and typosquatting explained.

A secure connection (the padlock)

A website without a working secure connection raises the score. But the padlock only means the connection is encrypted; scam sites have it too. So it can count against a site, but it never proves one is safe.

Hosting and registration details

We look at where the website is hosted and how it is registered, for example whether it uses a web address ending that is often abused, or is only registered for the shortest possible time. These are small hints on their own, but they help in combination with everything else.

Warning signs on the page itself

We read the website's homepage and look for the patterns we see again and again on scam sites:

• no company name, address or contact details
• no privacy policy
• payment by crypto or gift cards only
• countdown timers and fake scarcity
• discounts that are too good to be true
• promises to multiply your crypto or guaranteed investment returns
• login forms that send your details somewhere else
• leftover template text

What our community reports

Visitors can report a scam website. Reports are checked by our moderators, and only confirmed reports raise a site's score. Reports from members with a good track record count for a little more. Reviews are shown on each website's report page so you can read other people's experiences.

How it adds up

Each check either raises the score, lowers it, or has no effect. The result is one number between 0 and 100.

Two principles matter:

• Unknown isn't bad. If we can't find out something, for example because a website hides its details or doesn't respond, we don't count that check against it. We only score what we actually know.
• Warning signs don't stack endlessly. Related checks are combined sensibly, so one issue doesn't get counted several times over.

On each public report page you'll see the score, the risk level, a short verdict and the key facts behind it: how long the website has existed, how popular it is, the security database result, the country where it's hosted and who it's registered with. You can find report pages for thousands of websites in our directory, and see the overall picture on our statistics page.

What the Scam Score can't do

We think it's important to be clear about this:

• It's an estimate, not a fact. The score is an automated opinion based on public information. It can be wrong in both directions.
• Brand-new scams can look clean. A scam site that was set up yesterday may not be in any security database yet and might show few warning signs. If something feels wrong, trust that feeling.
• Honest new shops can look risky. A genuine small business that just launched has no track record, and that shows in the score.
• We check websites, not people. We can't tell you whether a seller on a marketplace or a person in a chat is honest.
• Things change. A safe website can be hacked, and a scam site can disappear. Reports are refreshed regularly and whenever someone checks a site again after a while.

That's why the score is labelled BETA and why every report suggests using it together with your own judgement and safe payment methods. Our guide How to check if a website is legit shows the other checks worth doing.

Why verification never changes the score

Some site owners can verify who they are: a check that confirms the real company behind a website. That's useful information for visitors, and it's shown separately on the report.

But verification never changes the Scam Score. Not by a single point. If it did, the score would become something businesses could buy, and it would be worthless to you. The score is based only on what we can observe about the website, so you can trust that a low score was earned, not paid for.

How site owners can request a manual review

Automated checks get things wrong sometimes, especially for new or unusual websites. If you run a website and think its rating is wrong:

1. Go to request a free manual review.
2. Tell us which website it is, how you're connected to it and what you think is wrong.
3. Add evidence if you have it, such as company registration documents.

A moderator, a real person and not an algorithm, reviews the report and your evidence, usually within a few working days. If we got something wrong, we correct the report and mark it as manually reviewed. The review is free, and paying for anything never influences the outcome.

The fastest way to a better score is the same as the way to a trustworthy shop: show your company details clearly, offer safe payment methods and keep prices honest. As your website gets older and builds a good track record, its score improves on its own.

Get the score wherever you browse

The free websurely.com browser extension shows the Scam Score of every website you visit as a coloured badge in your toolbar. It only sends the website's name to us, never the full page address or what you do on the site.

Check a website now

Curious what the Scam Score says about a site you're about to use? Check it on websurely.com. It's free, needs no account and takes a few seconds.