How to Check If a Website Is Safe (7 Checks, 2026)
Every day, over 1.5 million new phishing and scam websites are created. Before you enter your email address, payment details, or any personal information on an unfamiliar site, these seven checks take under two minutes and could protect you from identity theft, financial fraud, or malware.
Quick Answer
To check if a website is safe: inspect the URL for misspellings, verify the SSL certificate belongs to the right company, run the URL through a threat checker, look up the domain registration date in WHOIS, and search for reviews externally. The fastest method is to paste the URL into SafeSearchScan's free URL Checker.
1.5M
New malicious sites created daily
83%
Of phishing sites use HTTPS
$8.8B
Lost to internet scams in 2022
Why You Can't Just Look for the Padlock
For years, browsers and security guides told people to "look for the padlock" before entering information online. That advice is now dangerously outdated. The padlock icon means the connection between your browser and the website is encrypted — nothing more. It says nothing about whether the website itself is trustworthy.
Anyone can get a free SSL certificate from services like Let's Encrypt in under five minutes. Phishing sites do this routinely. The result: a convincing fake bank website with a padlock that your browser happily displays.
The checks below go beyond the padlock to give you a complete picture of whether a site is genuinely safe to use.
The 7 Checks — In Order of Speed
Inspect the URL carefully before clicking
The URL is your first and most important signal. Attackers go to great lengths to make fake URLs look real, so you need to know exactly what to look for.
The real domain is the part immediately before the first single slash. In https://accounts.google.com/login, the domain is google.com — accounts is a subdomain (fine). But in https://google.com.accounts-verify.net/login, the domain is accounts-verify.net — and google.com is merely a subdomain of a malicious site.
Watch for these specific tricks: • Typosquatting: arnazon.com, paypa1.com, faceb00k.com • Hyphen insertion: pay-pal.com, amazon-secure.com • TLD swaps: amazon.net, paypal.co instead of paypal.com • Extra words: amazon-account-help.com, netflix-billing-update.com • Lookalike characters: rn looks like m at small font sizes (rnicrosoft.com)
Legitimate companies almost never put extra words in their domain name. "Amazon" doesn't send you to amazon-shipping-notifications.com — they send you to amazon.com.
Check the SSL certificate — but don't stop at the padlock
The padlock icon in your browser's address bar means the connection is encrypted. It does not mean the website is trustworthy. Approximately 83% of phishing websites now use HTTPS and display the padlock.
What you should actually check: click the padlock icon to view the certificate details. Look for:
- •Issued to: Does the certificate belong to the company you expect? A legitimate PayPal page will have a certificate issued to PayPal, Inc. A phishing site might have a certificate issued to a random name or "Let's Encrypt" for a suspicious domain.
- •Validity dates: Is the certificate currently valid? Expired certificates are a red flag.
- •Certificate type: Extended Validation (EV) certificates include the company's legal name. While not all legitimate sites use EV certificates, a site claiming to be a major bank that doesn't have one is suspicious.
SafeSearchScan's SSL Checker gives you a full breakdown of any site's certificate in seconds — without needing to visit the site yourself.
Run the URL through a website safety checker
The fastest and most reliable method is to paste the URL into a dedicated safety checker that queries multiple threat intelligence databases simultaneously. This catches threats that individual methods miss.
SafeSearchScan's URL Checker queries: • Google Safe Browsing — the database behind Chrome's built-in warnings • URLhaus — database of URLs used for malware distribution • PhishTank — community-sourced phishing URL database • Multiple additional threat intelligence feeds
The key advantage is that a single threat database can have gaps. A newly registered phishing site might not yet be in Google Safe Browsing but is already flagged by URLhaus. Cross-referencing multiple sources dramatically reduces the chance of a dangerous site slipping through.
This takes about 20 seconds and should become habitual before visiting any unfamiliar link — especially ones received via email, text message, or social media.
Look up the domain's WHOIS record
Every domain name has a WHOIS record that shows when it was registered and by whom. This is particularly useful for catching scam sites, because fraudsters routinely register new domains to avoid the bad reputation of their previous ones.
What to look for in a WHOIS record: • Registration date: Legitimate businesses rarely ask for payment on websites created less than 6 months ago. If a site claiming to be a well-known retailer was registered 3 weeks ago, it's almost certainly a scam. • Registrant country: A UK government website registered through a Chinese registrar is suspicious. • Privacy protection: Most legitimate businesses don't hide all their contact details. While personal privacy protection is normal, a "business" with completely hidden registration data is a warning sign. • Registrar: Is the domain registered through a reputable registrar?
SafeSearchScan's WHOIS Lookup shows you all this information instantly. A brand-new domain combined with an urgent request for payment or personal information should immediately raise your suspicion level to near-certain scam.
Search for the site's reputation externally
Before trusting a website you've never used, spend 45 seconds checking what others say about it. Scam sites leave traces.
Effective search queries to run: • "[site name] scam" or "[site name] reviews" — look for patterns in results, not individual complaints • "[site name] site:trustpilot.com" — check the Trustpilot rating and look at negative reviews specifically • "[site name] site:reddit.com" — Reddit communities are often first to flag scam sites • "[site name] BBB" — the Better Business Bureau flags problematic businesses
What to watch for in reviews: • A high volume of 5-star reviews posted within a very short timeframe (fake reviews) • Reviews that are vague and don't describe a real product experience • No reviews at all for a site that claims to have been operating for years • Multiple people reporting similar issues (items not delivered, difficulty getting refunds, data misuse)
One negative review rarely means much. A pattern of the same complaint from multiple people is a reliable signal.
Check the contact information and about page
Legitimate businesses are contactable. Fraudulent websites typically either have no contact information, or provide fake details that don't check out when verified.
What a legitimate site should have: • A physical address that exists and matches the claimed business location (verify in Google Maps) • A working phone number (call it — does a real business answer?) • An email address on the company's own domain, not a free webmail service like gmail.com or yahoo.com • A real "About Us" page with specific, verifiable information — not generic stock-photo text • Company registration details for the jurisdiction they claim to operate in (UK: Companies House, US: state business registry)
Red flags to watch for: • Contact form only — no phone number or address • Address is a residential property, a UPS Store mailbox, or doesn't exist • "Customer service" email is a personal Gmail address • No About page, or an About page with no specific details about who runs the company • The site is in English but the physical address is in a country with no obvious connection to the business
Trust your instincts — and the browser's warnings
Modern browsers (Chrome, Firefox, Safari, Edge) are all connected to safety databases and will show interstitial warning pages for known dangerous sites. If your browser shows a red warning page, trust it and go back.
Beyond browser warnings, pay attention to your own instincts. If something about a website feels off, it probably is. Common gut-check signals:
- •The deal is suspiciously good (70% off designer goods, lottery winnings)
- •The site appeared in an unsolicited email or text message
- •You're being asked for payment via bank transfer, cryptocurrency, or gift cards
- •There's excessive pressure to act within a time limit ("offer expires in 12 minutes")
- •The site's writing quality is poor or the design looks hastily assembled
- •The site asks for more information than is necessary (requesting your social security number to create a free account)
Scammers are constantly improving their craft, but the fundamental pressure tactics haven't changed. Any time a website creates urgency, fear, or an offer that seems too good to be true — slow down and verify before proceeding.
Check Any Website in Seconds
Paste any URL into SafeSearchScan's free URL Checker. We query multiple threat intelligence databases simultaneously — no account required.
Special Situations: When to Be Extra Careful
Links from emails and text messages
URLs received via email or SMS are the highest-risk category. Attackers specifically use these channels because they create context and urgency. If you receive a link claiming to be from your bank, courier company, or any financial service — never click it directly. Instead, type the company's known web address manually into your browser. If there's a real issue with your account, you'll see it when you log in normally.
Shopping sites you've never heard of
Thousands of scam shopping sites operate by appearing in paid search ads, showing attractive products at steep discounts, collecting payment, and then either delivering counterfeit goods or nothing at all. Before buying from any unfamiliar retailer: check the domain registration date (any site less than 6 months old deserves extreme scepticism), search "[site name] reviews scam" on Google, and verify the return policy and contact details are real.
Sites asking for sensitive information
Any site requesting your social security number, passport number, or full bank account details should be verified thoroughly before you comply. Government services in most countries have well-known, official domains (gov.uk, usa.gov) — verify you're on the official domain before entering sensitive information. Legitimate services rarely need your full financial account number — only the last four digits at most.
QR codes at physical locations
QR code fraud has grown significantly, particularly in car parks, restaurants, and public spaces where fake QR code stickers are placed over legitimate ones. Before scanning a QR code, check that the sticker hasn't been placed over something else. After scanning, always check the URL in your browser before proceeding — use the same checks above. SafeSearchScan's QR Scanner lets you analyse QR code destinations safely.
Check Who Owns Any Website
SafeSearchScan's free WHOIS Lookup shows you when a domain was registered, who owns it, and where — in seconds.
WHOIS Lookup Free →Quick Safety Checklist
Run through these before entering any personal information
The URL domain looks correct — no misspellings or extra words
The SSL certificate is valid and issued to the right company
The URL checker shows no threats
The domain was registered more than 6 months ago
External reviews are genuine and from real customers
The site has verifiable contact information
There is no excessive urgency or pressure to act immediately
Check Any Website — Free Instant Safety Scan
Google Safe Browsing + URLhaus + PhishTank + SSL check + WHOIS age. Takes 20 seconds.
Check a Website Free →Frequently Asked Questions
Does HTTPS mean a website is safe?
No. HTTPS means the connection between your browser and the site is encrypted — it does not mean the site itself is trustworthy or legitimate. Phishing sites routinely use HTTPS. About 83% of phishing sites now use HTTPS, according to the Anti-Phishing Working Group. Always check more than just the padlock icon.
How can I check a website without visiting it?
Use SafeSearchScan's URL Checker — paste the URL and it will analyse the site against multiple threat intelligence databases without sending your browser there. You can also check the domain's WHOIS record and SSL certificate details without loading the page.
What makes a website URL suspicious?
Warning signs in a URL include: misspellings of known brands (amaz0n.com, paypa1.com), extra words added to real brand names (amazon-secure-login.com), subdomains used to mimic real domains (amazon.com.phishing-site.net), very long URLs with many dashes, and recently registered domains. If the URL looks odd in any way, do not proceed.
Is it safe to enter my payment details on a site I've never used before?
Only if you have verified it through multiple checks: the URL is correct, the SSL certificate is valid and issued to the right company, the site has been online for more than a year, there are genuine reviews on independent platforms, and the contact information is real and verifiable. When in doubt, use a virtual card or pay through a trusted intermediary like PayPal which offers buyer protection.
Can Google tell me if a website is safe?
Google Safe Browsing is one signal worth checking — you can use Google's Transparency Report at transparencyreport.google.com/safe-browsing to check any URL. However, it only catches sites Google has already flagged. New malicious sites often go undetected for days or weeks. SafeSearchScan checks against multiple threat intelligence feeds simultaneously for broader coverage.
Related Articles
Is This Link Safe to Click?
Five methods to check any URL before opening it
How to Spot a Phishing Email
9 warning signs to check every time
Clicked a Suspicious Link?
Step-by-step guide for the next 60 minutes
How to Tell If an Email Is a Scam
8 red flags in scam emails
What Is Ransomware?
How it works and how to protect yourself
Is This File Safe to Open?
5 checks before opening any file