How to Check if a Website Is Legitimate: 7 Free Checks
7 free ways to check if a website is legitimate: Safe Browsing status, WHOIS age, SSL details, blacklists and more β no tools to install, 5 minutes.
π Table of contents
In short: you can verify whether a website is legitimate in about five minutes, for free, with seven checks: Safe Browsing status, domain age via WHOIS, SSL certificate details, contact reality, content fingerprints, payment-method sanity, and an external scanner's verdict. The padlock alone tells you almost nothing - most phishing sites have one. The combination of these checks catches the overwhelming majority of fakes.
Every week, someone in Bangladesh loses money to a cloned e-commerce site, a fake courier-fee scam, or a phishing page dressed as a bank. Meanwhile, legitimate small businesses suffer because customers cannot easily tell them apart from the counterfeits. This guide is for both sides: check a site before you pay, and if you run a site, know exactly what your customers are (or should be) checking - then pass those checks visibly.
Check 1: Google Safe Browsing Status (60 Seconds)
Google's Transparency Report (search "Google Safe Browsing site status") gives you the verdict that powers browser warnings: no data available, some risky content, or dangerous. If the site is flagged, stop here - the question is answered.
This check is free, needs no account, and reflects continuous scanning of billions of pages. It is the single fastest legitimacy signal.
Limitation: a clean verdict means "no known malware/phishing today" - a brand-new scam site may not be flagged yet. That is what the next checks cover.
Check 2: Domain Age and Registration (60 Seconds)
A store claiming "serving customers since 2015" whose domain was registered three weeks ago is lying about something important. WHOIS lookups (any free WHOIS site) show the creation date. For .com.bd domains, registration runs through BTCL with documentation requirements - which makes squatting slightly harder than anonymous .com registrations.
Red flags: registered in the last 60 days, hidden behind a recently-created privacy service combined with other flags, or a domain registered for the minimum single year by a business claiming permanence.
Check 3: SSL Certificate Details - Not Just the Padlock (60 Seconds)
The padlock means encrypted connection. Phishing sites have valid certificates - they are free and instant. Click the padlock and inspect the certificate:
- Issued to: a certificate for
paypa1-secure.comclaiming to be PayPal tells you everything. - Organization: legitimate businesses often use certificates with validated organization identity (OV/EV), not just domain validation (DV).
- Issuer sanity: unknown or self-signed certificates on a site asking for money = walk away.
For a deeper look, a free SSL check shows expiry, chain validity, protocol versions and cipher strength - weak configuration often correlates with neglected infrastructure.
Check 4: Contact Information That Reaches Humans (90 Seconds)
Legitimate businesses want to be found. Scam sites minimize contact surface.
- A real address? Search it - does it exist, and does it match the business?
- A phone number? Call or at least check the country code matches the claimed location.
- Email response? Send a pre-sales question; a business that ignores pre-sales questions will ignore post-sales problems.
- Social accounts with history and two-way customer conversations, not follower-count-only facades.
In Bangladesh specifically: does the store list a working delivery-coverage list, and do its bKash/Nagad merchant names match its legal name? Mismatches there are a classic scam fingerprint.
Check 5: Content Fingerprints (60 Seconds)
Cloned sites copy legitimate ones imperfectly. Signs of copying: identical product photos with inconsistent watermarks, text in broken English that does not match the claimed location, prices too good to be true (30-70% below market for in-demand goods is bait), and legal pages (Privacy/Terms) that mention another company's name - a copy-paste artifact scammers routinely miss.
Reverse-image-search one or two product photos. If they belong to a dozen different stores, you are not looking at a real inventory.
Check 6: Payment Method Sanity (60 Seconds)
The payment ask is the scam's endgame:
- Legitimate: card payments via recognized gateways, bKash/Nagad merchant payments to verified merchant accounts, cash-on-delivery for physical goods.
- Red flag: personal bKash/Nagad numbers (personal, not merchant), bank transfers to personal accounts, cryptocurrency only, gift cards, or "pay a small courier fee to release your prize." Any "prize" that requires payment is a scam, full stop.
COD is your friend: ordering with cash-on-delivery lets the market test the seller for you.
Check 7: An External Scanner's Verdict (2 Minutes)
Run the site through a free security scan. A scan shows what infrastructure the site runs on and how well it is maintained: valid TLS, proper headers, no exposed admin panels, no exposed source code.
Interpretation nuance: a poorly-secured site is not necessarily a scam - plenty of honest businesses run sloppy infrastructure. But combined with other flags (new domain + personal payments + bad English), a technically-neglected site completes the picture. And a site that scores well on security headers, TLS and configuration is demonstrating operational competence - the opposite pattern of hit-and-run scams.
If YOU Run the Website: Pass These Checks Visibly
Every check above is one your customers may run. Being verifiable is a competitive advantage:
- Register your domain long-term, through BTCL for .bd where appropriate
- Use an organization-validated certificate; let the padlock actually say something
- Publish real contact details and answer them
- Keep your security posture clean - some customers do check
- Use merchant bKash/Nagad accounts in your legal name, and say so on the payment page
Trust is a checklist now. Make sure your business ticks every box, and make the ticking visible.
The 5-Minute Routine, Condensed
Before paying an unfamiliar site: Safe Browsing (1 min) β WHOIS age (1 min) β certificate details (1 min) β contacts and payment sanity (2 min). Five minutes, zero cost, and the large majority of scams fail at least two of the four. The ones that pass all four while being fake are rare enough - and expensive enough to build - that they target bigger fish than a routine purchase.
Security engineer building 2MNY β 292 free website-security checks β and the open-source Website Vulnerability Scanner. I find exposed secrets, misconfigurations and real vulnerabilities, then explain how to fix them in plain language.
1 How can I tell if an online store is a scam?
Combine WHOIS age (registered last month = red flag), Google Safe Browsing status, the padlock's certificate details (who is it actually issued to), contact information that reaches humans, and payment methods (legitimate stores offer buyer-protected options, not only bank transfers). One check alone can be fooled; the combination rarely is.
2 Does a padlock icon mean a website is safe?
No. The padlock means the connection is encrypted - nothing more. Phishing sites get valid free certificates in minutes. Always open the certificate details and check the organization, and combine the padlock with Safe Browsing status and domain age before trusting a site.
3 What is Google Safe Browsing?
Google's system continuously scans the web for malware, phishing and unwanted software. Its verdicts power the warnings in Chrome, Firefox and Safari. You can check any site's status through Google's free Transparency Report - no account needed.
4 How do I check if a .com.bd or .bd website is legitimate?
The same checks apply, plus one advantage: .bd domains are registered through BTCL with documentation requirements, which raises the bar compared to anonymous .com registrations. Still verify Safe Browsing status, certificate details and working contact information before transacting.
