How to check if a website is safe

You don't need to be a security analyst to check whether a site is trustworthy. The same five signals account for the majority of confidence — or concern.

1. Check reputation

Reputation feeds aggregate observed behavior across the internet. A clean record across a panel of independent feeds is a strong positive signal; multiple listings is a strong negative one.

2. Confirm HTTPS

A site that doesn't enforce HTTPS for a login or checkout flow has bigger problems than just encryption. Always verify the certificate is valid and matches the domain.

3. Inspect security headers

Headers like CSP, HSTS, and X-Content-Type-Options reveal whether the site has been built with modern security practices. They don't prove safety, but their absence is a yellow flag.

4. Verify the domain itself

A WHOIS lookup tells you when the domain was registered, by whom, and where. Brand-new domains impersonating known services are one of the most common phishing patterns.

5. Trust your verdict

Combine the signals. If anything looks off, don't enter credentials or payment information. When in doubt, type the brand name into a search engine and reach the company through their official channel.