Website checker: is this website legit?

Type any website address and see how trustworthy it looks to buyers, search engines and anti-scam services: domain age, the HTTPS certificate, email records, contacts on the page, reviews and Google Web Risk.

Free check · No account needed · Results in about 10 seconds

Check before you pay See what buyers and anti-scam services see

Example of a result

shop-example.com

High
trustLow risk

Google Web Risk0
HTTPS certificate0
Domain age0
Reviews of the domain1
Email security0

No "100% safe" promises

What we check and why

Seven groups of signals. None of them proves that a site is safe; together they show where to look closer before you pay.

Google Web Risk

Google's lists of suspected phishing, malware and unwanted software. A listed site is the clearest red flag.

Domain age and registrar

Registration and expiry dates from the domain registry (RDAP). Scam shops often use domains a few weeks old.

HTTPS certificate

Who issued it, when it ends and whether it matches the name. It proves the address, not who runs the site.

Email security

Mail servers, SPF and DMARC. Without them anyone can send email that looks like it comes from the shop.

Home page

Contacts, a street address, privacy policy, terms, the copyright year and the payment services on the page.

Hosting and name servers

Where the site is served from: a network like Cloudflare, a site builder or its own servers.

Reviews of the domain

Ratings that Google shows for the domain on review sites such as Trustpilot and Sitejabber.

How to tell if a website is legit

Use these steps before you pay a shop you have not bought from before. The checker above does the first four in a few seconds; the last two need your own eyes.

Check the domain and its ageLook at when the domain was registered and when it expires. A shop that opened three weeks ago and sells brand goods at half price is the classic pattern of a short-lived scam.
Look for HTTPS and a matching certificateThe address should open over https:// without a browser warning, and the certificate should be issued for that exact name. A valid certificate proves the address, not the owner.
Find real contact details and policiesA real shop shows an email address, a phone number or a contact page, a street address, a privacy policy, terms and a returns policy. No way to reach the seller is a reason to stop.
Check email security of the domainSPF and DMARC records stop other people from sending mail in the shop's name. Missing records do not make a site a scam, but they make fake order emails and invoices easier.
Search for reviews and scam warningsThe FTC advises: "Search online for the product or company name, plus the words 'complaint' or 'scam.'" Read the newest reviews on several sites, not only the average rating.
Never rely on one green checkPay by card or through a payment service that lets you dispute the charge. In the FTC's words, "Paying by credit card best protects you and your money in case of a scam."

No automated checker can guarantee that a site is safe.

Every signal here is public and can be faked or missing for a harmless reason. Google says the same about its own lists: some risky sites are not identified and some safe sites are identified in error. Treat the result as a reason to look closer, not as a verdict.

What the result means

High trust means nothing we checked points to a scam: an older domain, a valid certificate, contacts and policies on the page, no listing in Google Web Risk. Mixed signals means at least one warning, for example a domain younger than six months or no contacts on the home page. Low trust means several warnings together or one serious problem such as an expired certificate. Google flags this site appears only when Google Web Risk lists the address as suspected phishing, malware or unwanted software; do not enter data or download anything there.

Each signal has its own mark from 0 to 3 and one sentence that says why. "n/a" means the source gave no data: some country registries do not publish registration dates, and some sites turn automatic visits away. Missing data is never counted as good news.

If the website is yours

Buyers and anti-scam services look at the same signals. A certificate that expires on a Saturday shows a full-page warning to every visitor until someone renews it. A domain that lapses takes the site and the email down with it. A missing DMARC record lets anyone send invoices in your name, and Gmail asks bulk senders to have SPF, DKIM and DMARC.

WhatsMyRep watches your site every day as part of reputation monitoring: an alert goes out when the certificate expires within 14 days, the domain within 30 days, SPF or DMARC disappear, or Google Web Risk lists the site. The same daily check reads what Google results, reviews and AI answers say about the business. Plans start at $29 a month after a 14-day trial, see pricing.

What this checker does not do

It opens only the home page, once, without running JavaScript, so a site built entirely by scripts shows "n/a" for contacts and policies. It does not log in, fill forms or follow links deeper into the site. It does not name the owner: most registrars hide it, and we do not guess. It checks public websites only, on the standard ports, and never addresses inside private networks.

Questions, answered

Short answers about checking whether a website is legit.

Can a website checker guarantee that a site is safe?

No. It reads public signals: registration data, the certificate, email records, the home page, reviews and Google's lists. A scam can pass all of them for a while, and a real small business can miss some. Use the result to decide where to look closer, and pay by card so that you can dispute the charge.

What does Google Web Risk check?

Web Risk is Google's commercial service built on the lists of sites that Google considers suspected phishing (social engineering), malware or unwanted software. We ask it about the address you typed and about the site it redirects to. Google itself says that some risky sites may not be identified and some safe sites may be identified in error.

Why does domain age matter?

Scam shops rarely last: they register a domain, sell for a few weeks and disappear. A domain registered last month is not proof of fraud, since new businesses start every day, but together with no contacts and no reviews it is a strong warning. We read the date from the registry over RDAP; some country domains do not publish it, and then we say so.

Does HTTPS mean the website is trustworthy?

No. HTTPS means the connection is encrypted and the certificate was issued for that address. Certificates are free and automatic, so scam sites have them too. A missing, expired or mismatched certificate is a real warning; a valid one only tells you that you reached the address you typed.

What happens if SPF or DMARC is missing?

SPF lists the servers allowed to send mail for a domain, DMARC tells mail providers what to do with mail that fails the check. Without them anyone can send email that claims to come from the shop, and Gmail requires them from bulk senders. For a buyer it is a minor signal; for the owner of the site it is worth fixing today.

Can I check a site without an account?

Yes. The website checker is free and needs no account or card. A repeat check of the same site within 24 hours shows the saved result. If the site is yours, a 14-day trial watches it every day and alerts you when the certificate or the domain is about to expire, SPF or DMARC disappear, or Google lists the site.

Can I see who owns a website?

Partly. The registry shows the registration date, the expiry date and the registrar. Most registrars hide the owner's name and address for privacy, so the owner is usually redacted. Look for a company name and number on the site and check it in the official company register of the country.