How to tell if a website is safe: a 60-second checklist
Nine quick checks anyone can run before typing a password, entering a card, or clicking a suspicious link.
Look at the URL, not the page
Attackers spend real effort making a page look convincing. They spend far less on the URL. Read it slowly: is the spelling exactly right, or is it paypa1.com, arnazon-support.com, or netffix-billing.co? Look at the top-level domain too — a legitimate bank almost never operates from .top, .xyz, or .click.
If the site was linked from an email, hover the link before clicking. If it was linked from a message, long-press it on mobile. What you see should match the brand exactly.
Check HTTPS — and the certificate
The padlock icon means the connection is encrypted. It does not mean the site is legitimate. Free certificates take minutes to issue, and phishing sites use them routinely.
Click the padlock and look at who the certificate was issued to. On a bank, expect the legal entity name. On a small shop, expect at least a domain that matches what you typed.
How old is the domain?
Scam sites are almost always young. A domain registered three weeks ago that claims to sell heavily discounted electronics is a red flag. A trust checker like TrustDepth pulls WHOIS data automatically so you don't have to run the lookup yourself.
Search for independent reviews
Type the domain plus "scam", "review", or "reddit" into a search engine. A real business has a footprint. A scam usually has either nothing or a handful of angry posts describing exactly what happened to you.
Watch for pressure tactics
Countdown timers, "only 2 left in stock", surprise invoices, sudden account lockouts, requests to install remote-access software — all of these exist to short-circuit thinking. Slow down. Legitimate businesses tolerate the delay.
Run a trust check
Paste the domain into TrustDepth. In about three seconds you'll see the SSL/TLS check, WHOIS age, DNS configuration, Google Safe Browsing status, abuse blocklist lookups, and a combined 0–100 score. If the score is low, don't rationalize it — close the tab.