How to Check if a Website Is Legit: 12 Signs to Look For (2026)

The question everyone asks too late

Almost nobody worries whether a website is legit until the money has already left their account. You find a product at a tempting price, the site looks tidy enough, the checkout works — and only when the parcel never arrives do you go back and start reading the small print you skipped.

The good news is that you can usually tell a trustworthy site from a throwaway scam in about five minutes, using nothing but a browser and a healthy dose of scepticism. Scam sites are built fast and cheap, and that shows up in a dozen small ways once you know where to look. This guide walks through twelve signs that separate a genuine business from a fake, and gives you a short routine you can run every time you shop somewhere new.

A quick word on mindset first. No single signal proves a site is safe or dodgy on its own. A brand-new domain might belong to a legitimate start-up; a padlock in the address bar means almost nothing by itself. What matters is the overall picture — several green flags together, or even one or two serious red flags. Treat the list below as a scorecard, not a pass/fail switch.

The 12-point legitimacy checklist

Run through these before you type in a card number. If you can tick most of the "good sign" column, you are probably fine. If you are hitting the "warning sign" column repeatedly, walk away.

| # | What to check | Good sign | Warning sign | | --- | --- | --- | --- | | 1 | The exact domain name | Matches the brand you expect, spelled correctly | Extra words, hyphens or a swapped letter | | 2 | Domain age | Registered years ago | Created days or weeks ago | | 3 | Ownership (WHOIS) | Traceable, consistent with the business | Hidden behind privacy on a "big brand" site | | 4 | Contact details | Real address, working phone, monitored email | Web form only, or a Gmail address | | 5 | Reviews | Detailed, mixed, spread across sites | All five stars, all posted the same week | | 6 | Payment options | Card, PayPal, familiar gateways | Bank transfer, crypto or gift cards only | | 7 | Policies | Clear returns, delivery and refund terms | Missing, vague or copied from elsewhere | | 8 | Pricing | In line with the rest of the market | Far cheaper than anywhere else | | 9 | Legal footer | Company name, registration number, VAT | No legal identity anywhere | | 10 | Reputation search | "[brand] review" turns up real history | Nothing, or warnings from other buyers | | 11 | Pressure tactics | Calm, informative | Countdown timers and "only 2 left!" everywhere | | 12 | Craft | Consistent images, working links, good spelling | Stock photos, dead links, broken English |

The rest of this article expands on the signals that trip people up most often.

Start with the address bar, not the homepage

Scammers spend their effort on the parts of a page you look at — the logo, the product photos, the reassuring badges. They spend almost none on the part you ignore: the domain name itself. That makes the address bar the single most useful thing on the screen.

Read the domain character by character

Fraudsters register lookalike domains that your eye glosses over: amaz0n-support.com, paypa1-secure.net, argos-uk-sale.shop. This trick has a name — typosquatting — and it works because your brain reads the word it expects rather than the letters actually there. Slow down and read the domain one character at a time, paying attention to numbers standing in for letters, doubled letters, and extra words bolted on with hyphens. A real retailer uses its own clean domain; it does not need -uk-official-store tacked on the end.

Also look at the ending. A well-known British shop is far more likely to sit on a .co.uk or .com it has owned for years than on a .shop, .top or .online registered last month. Unusual endings are not proof of a scam, but paired with other red flags they raise the odds.

Find out how old the site is

Age is one of the most telling signals there is, which is why it gets its own article. The vast majority of scam shops are days or weeks old — they are set up, used to harvest a wave of orders, and abandoned before the chargebacks land. A "20-year-old family business" whose domain was registered a fortnight ago is lying about one of those two facts.

You can check a domain's registration date with a WHOIS lookup, or by using a checker that surfaces domain age for you. If the site is brand new and asking for money, let that inform how much you trust everything else on it.

Test the things a scammer can't fake cheaply

A convincing template is easy to buy. A genuine trading history, real customers and a working support line are not. Push on those.

Make the contact details do something

Every serious business can be reached. Look for a full postal address, a phone number and an email on a proper domain ([email protected], not [email protected]). Then test them. Paste the address into a map — does a real shop or office sit there, or is it a field, a car park, or a residential terrace on the other side of the world? Ring the number. Email a quick pre-sales question and see whether a human replies. Scam sites overwhelmingly hide behind a single web form precisely because there is nobody home.

Judge the reviews properly

Reviews are the most gamed signal on the internet, so read them like a detective rather than counting stars. A wall of five-star ratings all posted within the same few days, in oddly similar phrasing, is a manufactured reputation, not a real one — the tell-tale signs of fake reviews. Genuine feedback is messy: it is spread over months, it includes three-star grumbles about slow delivery, and it exists on places the seller does not control, such as independent review platforms and social media. If every review lives only on the shop's own site and they are all glowing, treat them as marketing.

Look at how you're asked to pay

How a site wants to be paid tells you how confident it is that you will want your money back. Legitimate merchants accept debit and credit cards and mainstream options like PayPal, because those methods come with buyer protection. Scammers steer you towards payment types that are hard or impossible to reverse: direct bank transfer, cryptocurrency, or shop gift cards. If a "retailer" only accepts bank transfer, or asks you to pay a person rather than a company, stop there. Our guide to safe ways to pay online explains which methods actually protect you when a purchase goes wrong.

The signals people miss

The legal small print

In the UK, a real trading company has a legal identity. Scroll to the footer and look for a registered company name and number, and often a VAT number, which you can check against the free Companies House register. A site selling to the public with no company details, no registered address and no VAT information anywhere is either operating illegally or is not a business at all.

Prices that are too good

Fraudsters know that a big enough discount switches off the part of your brain that asks questions. Designer goods at 80% off, the latest console at half price, a sold-out item that is mysteriously in stock — these are bait, not bargains. Cross-check the price against two or three other retailers. If everyone else is charging £200 and this site says £59, the difference is the cost of your card details.

Manufactured urgency

Countdown clocks, "14 people are viewing this", "sale ends in 9 minutes" — pressure is a technique borrowed from high-street hard-selling and turned up to eleven. Its whole purpose is to stop you doing exactly what this article recommends: pausing to check. Real shops run sales too, but a site drowning in artificial urgency is trying to rush you past its own red flags.

A five-minute routine you can actually use

You will not run a full twelve-point audit on every purchase, and you do not need to. Here is the quick version for a site you have never used before:

1. Read the domain slowly, letter by letter.
2. Check the domain age and whether the ownership is traceable.
3. Search "[brand name] reviews" and "[brand name] scam" in a separate tab.
4. Scan the footer for a real company identity and working contact details.
5. Check that you can pay by card or PayPal, not just bank transfer.

If all five come back clean, buy with reasonable confidence. If two or more raise a flag, that is your answer. For a deeper walkthrough of the warning signs, read our companion pieces on the red flags of a scam website and why an HTTPS padlock does not mean a site is safe. Our full guide to recognising a scam website pulls the whole method together.

Before you go

Try the five-minute routine today on a site you already know and trust — your bank, a shop you use every week. Seeing what a genuinely legitimate site looks like under each check calibrates your eye, so that when an unfamiliar shop fails three of the five, the contrast is unmistakable rather than a vague feeling.

Two habits make the checks stick. First, run them before you fall in love with the bargain; once you want the deal to be real, you will argue yourself past almost any warning. Second, price the cost of walking away at what it actually is: zero. Closing a tab loses you nothing, however tempting the discount was.

Manual checking works anywhere, with nothing to install — and it is the same thinking behind the CheckAScam checker we are currently building, which will run signals like these against any address you paste in (how we weigh them is documented here). Until it ships, the routine above and a sceptical eye are honestly most of the battle.