Is This Website Legit? 9 Checks You Can Run in 2 Minutes

Is this website legit? You can't prove it with one test, but nine quick checks will tell you a lot in about two minutes: the exact URL, the HTTPS certificate, the domain's age, contact details, policies, off-site reviews, payment options, prices and security headers. Treat each result as a signal, not a verdict.

By Gary, Greenlight My App · Updated Oct 30, 2026 · How we checked this: Tested on Oct 30, 2026, 7:02–7:06 AM ET. Our team checked the certificate, domain age (RDAP), Google Safe Browsing status and a Greenlight My App scan for our own site, greenlightmyapp.com, plus the certificate, domain age and Safe Browsing status for wikipedia.org as a well-known comparison. We also read the FTC's online shopping advice. Drafted with AI tools and reviewed by a person before publishing.

I build security checks for websites, so friends send me links all the time with one question: "Is this real?" Here's the routine I actually use. It takes about two minutes, and it works on shops, login pages and "you've won" pages alike.

Is this website legit? The 9 checks at a glance

Run these in order. The first three take about 30 seconds and catch many fake copies of real brands.

How do I check the URL for lookalikes?

Start with the address bar, not the page. Fake sites often copy a real brand's design and use a domain that is one letter off. Think bigstore.example versus bigst0re.example, or bigstore.example-deals.shop. The real name can even appear inside a longer, fake address.

How to check it:

1. Read the domain from right to left. The part just before the first single slash is the real owner.
2. If you came from an email, text or ad, close the tab and type the address you know yourself.
3. Watch for zeros instead of letter O, "rn" that looks like "m", and extra words such as "secure", "login" or "official".

Does HTTPS mean a website is safe?

No. HTTPS means the connection between you and the site is encrypted. The FTC says plainly that the "s" in https doesn't mean a site is legitimate, because scammers can encrypt sites too (FTC (external)).

Still, it's worth a click. Click the padlock (or the settings icon next to the address in some browsers), then open the certificate details. You'll see who the certificate was issued to, who issued it, and when it expires.

Worked example (our own site, Oct 30, 2026): greenlightmyapp.com shows a certificate issued by ZeroSSL, valid from Oct 16, 2026 to Jan 14, 2027. That's a normal "domain validated" certificate. It proves we control the domain. It says nothing about whether we're a good business, which is exactly why HTTPS is check 2 and not the whole test.

For comparison, wikipedia.org's certificate on the same morning was issued by Let's Encrypt and valid Oct 4, 2026 to Jan 2, 2027. Short validity periods like these are normal for automated certificates.

Red flag: no HTTPS at all on a page that asks for a password or card, or a full-page browser warning. Don't click through those warnings.

How old should a website's domain be?

There's no magic number, but a site that is days or weeks old and selling expensive items deserves a much closer look. Scam shops often appear, take orders and vanish.

How to check it: go to ICANN Lookup (external), enter the domain and read the registration date. ICANN Lookup uses RDAP, the newer replacement for WHOIS lookups.

Worked example: We looked up greenlightmyapp.com on Oct 30, 2026. The registry lists a registration date of Oct 15, 2026, so our own domain was 15 days old. By this check alone, we'd look "new". That's the point: domain age is a clue you weigh with the other eight, not a verdict on its own.

For contrast, wikipedia.org was registered on Jan 13, 2001. Age alone would rank us far below it, yet both are real. That's why domain age is one signal among nine.

How do I check a website's contact details?

A real business makes it easy to reach a person. Look for a phone number, a street address and a working email.

Then verify them somewhere else:

• Paste the street address into a map. Is it a real building, or a parking lot or a house?
• Call the number during business hours.
• Search the business name and see if the same details show up on other sites.

Red flag: a contact form and nothing else, or an address that belongs to an unrelated business.

What policies should a legit site have?

Open the privacy policy, the returns or refund policy and the terms. You don't need to read every line. You're looking for three things: they exist, they name the business, and they make sense for what's being sold.

Red flag: missing pages, placeholder text, or a returns policy that sends items to a different country than the "about us" page claims.

Where should I look for real reviews?

Not on the site itself. Search the business name plus "complaint", "review" or "scam" in a search engine, as the FTC suggests (FTC (external)). Check a few independent review sites and the Better Business Bureau's scam tips (external).

Keep in mind that reviews can be faked in both directions. A handful of very similar five-star reviews posted the same week is a warning sign. No reviews at all just means you know less.

Which payment methods are safest?

Go to checkout and look at the payment options before entering anything.

Dispute rights depend on your card issuer, bank or payment service and their deadlines, so ask them directly.

The FTC recommends paying by credit card when you can, because it gives you the most protection if something goes wrong (FTC (external)).

How do I spot too-good-to-be-true prices?

Copy the exact product name into a search engine and compare two or three other stores. A price far below everyone else is the most common bait, especially with a countdown timer or "almost sold out" banner pushing you to hurry.

Real sales exist. The question is whether the price makes sense next to the other eight checks.

What do security headers tell you about a site?

Security headers are instructions a site sends your browser, such as "always use HTTPS" (HSTS), "run my own scripts, not injected ones" (Content Security Policy) and "don't let other sites frame me" (clickjacking protection). Well-run sites usually set several of them.

Missing headers don't make a site a scam. Plenty of honest small businesses never set them. But a shop that takes card payments with none of them is one more signal to weigh.

Worked example: on Oct 30, 2026, greenlightmyapp.com sent HSTS, a Content Security Policy, X-Frame-Options, X-Content-Type-Options, a referrer policy and a permissions policy. If you're curious what each one does, see what is HSTS and X-Frame-Options explained.

One line in our test run warned that plain HTTP didn't redirect to HTTPS. That came from our test machine's network, which blocks plain-HTTP requests, not from the site, so we've left it out of the takeaway.

Which free website checkers can I use?

A clean result from a checker means "nothing known yet". It doesn't mean "safe".

Tested on Oct 30, 2026: Google's Safe Browsing report said "No unsafe content found" for greenlightmyapp.com. For wikipedia.org it said "No available data". That doesn't mean Wikipedia is unsafe, and it doesn't mean it's verified. It means the report had nothing to show. Read a blank result as "unknown", never as a verdict either way.

What if I already paid a scam website?

Move fast. Here's the order I'd follow:

1. Call your card issuer or bank. Ask to stop or dispute the payment and replace the card if you entered its number.
2. Change passwords you typed on the site, and any account that reuses them. Turn on two-step sign-in. Our guide on what to do if your email shows up in a breach walks through this.
3. Report it to the FTC at reportfraud.ftc.gov (external). If it involved the internet, the FBI's IC3 (external) also takes reports.
4. Keep records: screenshots, order emails and the exact URL.

For founders: will visitors trust your site?

Flip the checklist around. Your visitors are running these same checks on you. A new domain, a contact form with no address and missing security headers can make an honest product look shaky.

The parts you control:

• Show a real contact method and a clear privacy policy and terms.
• Keep HTTPS on everywhere, and add HSTS.
• Add a Content Security Policy and clickjacking protection.
• Make sure no API keys or secrets leak into your frontend code. If you're not sure, read how to tell if your API key was stolen.

Run a free Greenlight scan to see which security headers your site sends and what to fix before visitors start checking.

FAQ

Is HTTPS enough to know a website is safe? No. HTTPS means your connection is encrypted, so others on the network can't read what you send. It doesn't tell you who runs the site or whether they're honest. The FTC notes that scammers can encrypt sites too. Treat the padlock as one check out of nine.

Are website safety checkers accurate? They're useful but incomplete. Tools like Google Safe Browsing flag sites already known for malware or phishing. A brand-new scam shop may not be listed yet, so a clean result means "nothing known so far". Combine a checker with the manual checks above before you pay.

What if I already paid a website I now don't trust? Call your card issuer or bank right away and ask about stopping or disputing the charge. Change any password you used on the site. Then report it at reportfraud.ftc.gov and keep screenshots of the order, emails and URL in case you need them later.

How old should a domain be before I trust it? There's no fixed rule. A domain registered days or weeks ago that sells expensive goods deserves extra checks. Plenty of honest businesses are new, though, so weigh domain age with contact details, reviews, payment options and prices rather than using it alone.

---

Want to see what visitors see when they check your site? Run a free Greenlight scan (external) to check your security headers and catch exposed keys before launch.