Wondering “is this website legit?” Use this repeatable fake website checker guide to inspect the domain, link behavior, contact details, payment options, reviews, and policies before you log in, download anything, or enter payment information.
Overview
A polished design is not proof that a website is trustworthy. Fraudulent stores and phishing pages can copy logos, product photos, checkout layouts, and even the wording of legitimate businesses. A safer approach is to evaluate several independent signals before taking action.
No single test can guarantee that a site is safe. HTTPS protects the connection between your browser and the site, but it does not prove who operates the domain. A domain that has existed for years may still be compromised, while a new domain may belong to a legitimate new business. Treat website checking as a risk assessment rather than a pass-or-fail verdict.
Start with the exact address. Check the spelling of the domain, the ending after the final dot, and any unusual characters. Scammers may use a lookalike address, extra words, substituted letters, or a long subdomain designed to resemble a familiar brand. If a link arrived by email, text, social media, or a QR code, avoid relying on the link alone. Search for the organization independently or type a known address manually.
For a deeper walkthrough, see our fake website checker guide. The checklist below is designed for quick, repeatable decisions.
Checklist by scenario
Before buying from an unfamiliar online store
- Inspect the domain: Look for misspellings, unnecessary words, unusual country-code endings, or a domain that does not match the store name.
- Check the business identity: Look for a specific company name, physical address, working email address, and a phone number. Test whether the contact information appears consistent rather than copied or incomplete.
- Read the policies: Review shipping, returns, refunds, cancellations, and privacy information. Generic text, contradictory terms, awkward phrasing, or policies that name a different business are warning signs.
- Evaluate the price and urgency: An unusually low price, countdown timer, or message claiming that only a few items remain should increase caution. Do not let a promotion shorten your checking process.
- Review payment choices: Be cautious if the site insists on cryptocurrency, bank transfer, gift cards, or another payment method that offers limited recovery options. A checkout page showing familiar logos is not, by itself, proof of authorization.
- Search for independent experiences: Look beyond testimonials published on the site. Search the exact domain name with terms such as “complaint,” “refund,” or “review,” and compare multiple sources. Reviews can be fabricated, so look for specific, consistent details rather than star ratings alone.
Before logging in or responding to a message
- Compare the address with the expected service: A page asking for bank, email, payment, or social media credentials should be opened through the official app or a bookmark, not through an unexpected message.
- Check the request: Urgent warnings about account closure, parcel delivery, refunds, failed payments, or security problems are common phishing themes. Verify the issue through a separate channel.
- Watch for redirects: A link may pass through several addresses before reaching its final page. Do not enter information until you understand which domain is requesting it.
- Inspect the form: Be especially cautious when a page requests more information than the stated task requires, such as identity documents, full payment details, security answers, or an account password that should not be needed.
Before downloading software or scanning a QR code
- Confirm that the download comes from the software maker’s known website or the official app marketplace, and check the developer name carefully.
- Do not install a browser extension, mobile app, or desktop program merely because a pop-up says your device is infected or that an update is urgent.
- Treat QR codes as links you cannot easily preview. Check the destination after scanning and before signing in, paying, or installing anything.
- Do not grant unusual permissions, disable security settings, or provide remote access to resolve a claimed problem.
Our fake app warning guide covers download checks in more detail. For pop-ups and remote-access requests, review the tech support scam warning signs.
What to double-check
Domain age and registration details
A domain lookup can show registration information and, where available, an approximate creation date. A recently created domain is not automatically malicious, but it deserves more scrutiny when paired with copied branding, deep discounts, or pressure to pay. Privacy-protected registration is also not a verdict; many legitimate operators use it. Use domain information as one clue among several.
HTTPS and browser warnings
Look for HTTPS and the browser’s security indicator, but do not treat them as a trust certificate. If the browser displays a warning about malware, an invalid certificate, or a deceptive page, stop. Do not bypass the warning simply to view a product or complete a purchase.
Contact details and company claims
Copy the address, phone number, or company name into a separate search rather than trusting the site’s own claims. Check whether the details point to a real, relevant business and whether different pages agree. A contact form without a clear business identity is weaker evidence than independently verifiable contact information.
Redirects and shortened links
Shortened links can conceal the destination, and a legitimate-looking starting page can redirect elsewhere. To check a link safely, use a link-scanning service you trust, expand shortened URLs where possible, and inspect the final domain without signing in. Do not paste private, password-reset, or one-time-use links into public scanners.
Checkout and account behavior
Before paying, confirm that the total, currency, shipping terms, and merchant name are clear. Be cautious if the checkout unexpectedly switches domains, asks you to contact a personal email address, or requests payment outside the site. Never send additional fees to release a refund or shipment without independently verifying the transaction; this pattern is also discussed in our guide to refund scam tactics.
Common mistakes
- Trusting the padlock: HTTPS indicates an encrypted connection, not an honest operator.
- Relying on one online scam checker: A clean result may reflect incomplete data or a site that has not yet been reported. Compare signals and apply your own judgment.
- Assuming search placement equals legitimacy: Search results, advertisements, and social posts can lead to impersonation pages. Verify the address before proceeding.
- Reading only the homepage: Fraudulent sites often look convincing until you inspect the return policy, company details, checkout flow, or support channels.
- Using the same password: If you enter a password on a suspicious page, change it from the genuine service, beginning with any account that reused it. Enable multifactor authentication where available.
- Continuing after a warning sign: Several small concerns can become a strong reason to stop. Save evidence, close the page, and verify through an independent route.
If you already entered credentials or payment details, act promptly: contact the relevant financial provider through its official contact method, change exposed passwords, review account activity, and preserve messages, receipts, URLs, and screenshots. See what to do after a phishing scam and how to report a scam.
When to revisit
Use this checklist whenever you encounter a new store, login page, seller, download, payment request, or QR code. Recheck a site even if it was safe before: domains can change ownership, websites can be compromised, and scam campaigns can copy a legitimate brand after a link is shared widely.
Revisit your personal process before seasonal shopping periods, major sales, travel bookings, tax or account deadlines, and any workflow that introduces a new vendor or platform. Also update your preferred link-scanning, password-management, and browser-safety tools when their features or interfaces change. Keep a short version of the checklist nearby:
- Confirm the exact domain independently.
- Check the site’s identity, policies, and contact details.
- Review payment methods, prices, redirects, and reviews.
- Scan or inspect the link without entering private information.
- Stop when several warning signs appear, and verify through a separate channel.
A website does not need to look obviously fake to be unsafe. Taking a few minutes to verify the address and the request is usually easier than recovering an account, disputing a payment, or replacing exposed personal information.
