How to check if a website is legit: a step-by-step checklist

You found a shop with exactly the jacket you wanted, at a price that makes you hesitate. Or someone sent you a link to an investment platform, a ticket reseller or a "support" page. Before you type a card number or a password, it takes about five minutes to find out whether the site is real. This checklist walks you through those five minutes in the order that catches most fakes fastest.

You don't need any technical knowledge. You need a little patience and the willingness to walk away if something doesn't add up.

The 30-second version

If you only have half a minute, do these three things:

• Paste the address into a scam checker. On websurely.com you get a Scam Score from 0 to 100 built from how long the website has existed, how popular it is, whether trusted security databases list it, whether its name imitates a well-known brand, its secure connection, where it's hosted and red flags on the page itself.
• Look at the address bar, not the page. Is the domain spelled exactly like the brand you expect? Is it the brand's real domain or something like brand-outlet-sale.shop?
• Check how you would pay. If the only options are bank transfer, crypto or gift cards, stop. Real shops almost always accept cards or PayPal.

If anything feels off after those three steps, keep reading before you pay.

Step 1: Read the domain name properly

The domain is the part right before the first single slash, and the part that really counts is the last two pieces: in shop.example.co.uk it is example.co.uk, in login.paypal.com.secure-check.net it is secure-check.net. Everything to the left of that is decoration the owner can choose freely.

Watch for these tricks:

• Extra words around a brand: nike-outlet-store.com, amazon-refund-center.net. Big brands rarely use hyphenated add-on domains for their shops.
• Swapped or doubled letters: paypa1.com, amazom.com, rnicrosoft.com (an r and an n look like an m).
• Unusual endings: a well-known brand selling from .top, .shop, .xyz or .store when its real shop lives on .com or a country domain.
• The brand name in a subdomain: apple.com.account-verify.info belongs to account-verify.info, not to Apple.

Our guide to look-alike domains and typosquatting explains these patterns in more detail.

Step 2: Find out how old the website is

Scam shops live fast. Many are registered, advertised hard on social media for a few weeks, and abandoned once payment providers or ad networks shut them down. A domain that is only days or weeks old is not proof of fraud, but combined with deep discounts it is the single most common pattern we see.

You can look up the registration date with ICANN's free lookup tool (lookup.icann.org) or simply check the site on websurely.com, where the website's age is shown on every report. Read Is it safe to shop on new websites? for what a young domain does and does not tell you.

Step 3: Check who runs it

A real business tells you who it is. Look for:

• A company name and full postal address, not just an e-mail form. In the EU and UK, online shops are legally required to name the seller; in Germany this is the "Impressum".
• A company registration or VAT number you can search in the official register of that country.
• A phone number that actually connects to someone.
• Terms and conditions, a returns policy and a privacy policy that mention the same company name. Copy-pasted legal text with another shop's name left in, or placeholders like [Company Name], is a giveaway.

Search the company name together with the word "scam" or "reviews". If the address on the site turns out to be a residential house, a shopping centre or a different company entirely, you have your answer.

Step 4: Look at payment and checkout

How a site wants to be paid tells you more than how it looks.

A common trick: the checkout shows card logos, but when you try to pay, "card payment is temporarily unavailable" and you are asked to transfer money instead. Don't. And never pay a "PayPal" request sent to you as Friends and Family when you are buying something.

Step 5: Judge the prices and the pressure

Real shops have sales. Scam shops have permanent, store-wide discounts of 60 to 90 percent on items that are normally never discounted, such as current-season sneakers, new game consoles or premium kitchen machines.

Pressure tactics go hand in hand with fake prices:

• Countdown timers that restart when you reload the page
• "Only 2 left in stock!" on every product
• Pop-ups saying someone in your city just bought this
• "Closing down" or "warehouse clearance" sales that never end

We cover these patterns in Fake online shops: 12 warning signs and in our piece on outlet and closing-down scam shops.

Step 6: Check reviews the right way

Reviews on the shop's own page are worthless as evidence; they can be invented in seconds. Look outside the site instead:

• Search for the domain name (not the shop's display name) plus "reviews" or "scam".
• Look at independent review platforms, but be careful with a sudden burst of five-star reviews all written in the same week.
• Check whether real customers mention receiving their goods. "Fast delivery!" posted before the shop is even a month old doesn't add up.
• Look at the report page for the site on websurely.com, where community members can leave reviews and report scams.

No reviews at all is common for brand-new shops. That alone isn't damning, but it means you are trusting the shop blind.

Step 7: Look at the technical basics

Two quick checks:

• The secure connection (the padlock). A missing or broken padlock is a bad sign, but the padlock alone means nothing more than "the connection is encrypted". Scam sites get one for free in minutes, just like everyone else.
• Links that work. Click "About us", "Contact" and the social media icons. Dead links, social icons that point to the platform's homepage and "Lorem ipsum" text are typical of thrown-together fake shops.

Step 8: Use a scam checker as a second opinion

Doing all of the above by hand takes time. That's why we built websurely.com. Paste any link on the homepage and we check, in one go:

• how long the website has existed
• how popular it is, because very popular websites are rarely scams
• whether it appears in more than a dozen trusted security databases that are updated around the clock
• whether the name imitates a well-known brand
• whether it has a secure connection (the padlock) and where it's hosted
• red flags on the page: missing company details, crypto-only payment, countdown pressure, extreme discounts
• confirmed scam reports from other visitors

The result is a Scam Score with a risk level: Low, Uncertain, Suspicious or High. The score is an automated estimate and is labelled BETA, so use it alongside your own judgement. Here is exactly how the Scam Score is calculated, including its limits.

You can also browse our directory of websites we've already checked and the list of websites we rate as safe. If you want this check to happen automatically, the free websurely.com browser extension shows the rating of every site you visit right in your toolbar.

The printable checklist

Before you pay on a site you don't know, you should be able to answer yes to most of these:

• The domain is spelled correctly and belongs to the brand or shop I expect.
• The domain is more than a few months old, or I have another good reason to trust it.
• The site names a real company with an address I could verify.
• I can pay by credit card or with a buyer-protected method.
• The prices are good but believable, and there is no countdown pushing me.
• Independent sources mention this site and real deliveries.
• A scam checker shows no serious warning signs.

If you said no to two or more, take a break and look for the same product at a retailer you already know.

What to do if it's too late

If you have already paid or entered your password, act now rather than waiting for the parcel. Our step-by-step guide What to do if you've been scammed online covers the first hour, and How to get your money back explains chargebacks and bank recalls. You can also report the website so other people are warned, and browse the latest scam websites other visitors have flagged.

Check a website now

Not sure about a site right now? Paste the link on websurely.com and get a free Scam Score in seconds. No account needed.