How to Check If a Website Is Safe: 8 Checks That Take Five Minutes

To check if a website is safe, verify the exact spelling of the domain, confirm the site uses a valid HTTPS certificate issued to the right organisation, look up how long the domain has existed, and run the URL through a phishing and reputation check. HTTPS alone proves nothing about honesty: most phishing sites now have a valid certificate. If the site is your own, a full website security test will also show misconfigured headers, outdated software and compliance gaps.

Every week people lose money and credentials to websites that look completely normal. The address is almost right, the padlock is there, the logo matches. The difference between a legitimate site and a convincing copy is rarely visible at a glance, but it is nearly always visible in the details: the registration date of the domain, who the certificate was issued to, what the page does with the data you type into it.

This guide covers eight checks you can run on any URL, in roughly five minutes, without installing anything. The first five work on any third-party site you are about to trust with a password or a payment. The last three are for your own website, where you can go deeper and fix what you find.

Best dark web monitoring tools at a glance

1. Read the URL character by character

Most fraudulent sites are found in the address bar, not in the page. Attackers register domains that read correctly at a glance and only break down under attention.

Four patterns account for the majority of cases. Typosquatting swaps or drops a character, so exarnple.com reads as example.com because rn looks like m in most fonts. Combosquatting adds a plausible word to a real brand, producing example-secure-login.com, which is not owned by the brand at all. Subdomain spoofing puts the real brand where you expect the domain to be, as in example.com.account-verify.net, where the actual domain is account-verify.net. Homograph attacks use Unicode characters from other alphabets that render identically to Latin letters, so the domain looks perfect and resolves somewhere else entirely.

Read the address from right to left. The part immediately before the first single slash is the real domain. Everything to the left of it is under the control of whoever owns that domain, including any brand name they put there.

2. Check the certificate, not just the padlock

A padlock means the connection is encrypted. It does not mean the site is honest. Free certificates are issued automatically in seconds, which is why the large majority of phishing pages today are served over HTTPS.

What the certificate can still tell you is who it was issued to and when. Click the padlock, open the certificate details and check three things: the Common Name or Subject Alternative Name should match the domain you are on, the validity period should not have started a few days ago on a site claiming to be an established business, and for a bank or payment provider you can reasonably expect an organisation-validated certificate that names the legal entity, not a domain-validated one that names nothing.

If the browser warns you that the certificate is invalid, expired or issued for another host, stop there. That warning is not a formality.

3. Look up the domain’s age

Fraud infrastructure is disposable. Phishing and scam domains are typically registered days or weeks before the campaign and abandoned shortly after, because they get blocked quickly.

A public WHOIS lookup shows the creation date. A domain registered last month that presents itself as a long-established retailer is one of the strongest single signals you can get. It is not proof on its own, since legitimate new businesses exist, but combined with anything else on this list it should end the conversation.

Also compare the registrant country and the registrar against what the site claims about itself. A company that describes itself as a regulated European financial institution and registers its domain anonymously through a privacy proxy is worth a second look.

4. Run the URL through a phishing and reputation check

Reputation databases aggregate reports from browsers, mail providers and security vendors. A URL that already appears in them is settled, and checking takes seconds.

ImmuniWeb’s free phishing website checker analyses the domain, the SSL certificate, page content and reputation databases in one pass, and flags typosquatting and homograph patterns as well as visual similarity to known brands. Google Safe Browsing and PhishTank are useful cross-references.

One caveat worth keeping: a clean result means the URL has not been reported yet, not that it is safe. Brand-new campaigns are clean for hours or days. Treat a clean reputation check as one input, not as an all-clear.

5. Look at what the page actually asks for

Legitimate services ask for the minimum they need. A page that wants a card number to “verify your identity” before a free trial, or a full date of birth and national ID number to release a parcel, is collecting data it has no use for.

Two more signals sit on the same page. Check whether the links in the footer go anywhere: fraudulent sites often clone a layout and leave Terms, Privacy and Contact pointing at #. And check whether the contact details are real, meaning a company registration number you can look up and an address that exists, rather than a form and a first name.

6. Test the site’s configuration and encryption

If you own the site, or you are assessing a supplier, you can go past the surface and look at how the server is actually configured. Weak configuration does not mean fraud, but it does mean the site can be attacked, and everything a visitor types into it is at risk.

ImmuniWeb’s free Website Security Test checks a site for outdated and vulnerable software, HTTP security and privacy headers, Content Security Policy, DNSSEC configuration, AI bot protection and compliance with GDPR and PCI DSS, and returns a grade with a downloadable report.

The SSL Security Test covers the encryption side for both web and email servers: certificate validity, protocol versions and cipher suites, post-quantum readiness, and compliance with PCI DSS, GDPR, HIPAA and NIST.

Both are free, run in the browser and require no account.

7. Check what the site does with visitors’ data

A site can be technically sound and still leak your data to a dozen third parties. The free Website Privacy Test shows which tracking cookies and pixels a page sets, which third-party content it loads, where its forms submit to and whether its privacy policy exists and matches its behaviour.

For a site handling payments or personal data, an unexpected third-party script on the checkout page is a serious finding. That is the exact mechanism behind web skimming attacks, where a single injected script quietly copies card details as they are typed.

8. Check for exposure you cannot see from the page

The last check looks outward rather than at the page. The free Dark Web and Threat Exposure Test searches for leaked credentials belonging to a domain, squatting and typosquatting domains registered against it, phishing and scam sites impersonating it, fake social media accounts and trademark misuse.

For your own domain this tells you whether someone is already running a campaign in your name. For a supplier, a long list of leaked employee credentials is a reasonable thing to raise before you connect their systems to yours.

Red flags, ranked

What to do if a website is not safe

If you have not entered anything, close the tab and report the URL to Google Safe Browsing and to the brand being impersonated. Most large brands have an abuse address for exactly this.

If you have entered a password, change it immediately on the real site and anywhere else you reused it, and turn on multi-factor authentication. If you entered card details, call the card issuer and ask them to block the card. Speed matters more than certainty here.

If the site is impersonating your own brand, the response is a takedown request to the registrar and the hosting provider, plus a blocklist submission. ImmuniWeb handles this as a service under Phishing Websites Takedown.

If it is your own website

The eight checks above tell you where you stand on a single day. Keeping that position is a different problem, because certificates expire, software goes out of date and new subdomains appear without anyone telling security.

ImmuniWeb® Discovery continuously discovers your internet-facing assets, monitors dark web exposure and squatting domains, and tracks your security and compliance posture over time. ImmuniWeb® Neuron scans web applications and APIs for exploitable vulnerabilities, and ImmuniWeb® On-Demand adds human penetration testing with a zero false-positive SLA.