What a website trust score measures
A website trust score turns observable technical signals, such as HTTPS use, redirect behavior, security headers and look-alike domain names, into one number. It measures how a site is set up and whether it shows known warning signs. It can't measure whether the business behind the site is honest.
That makes a score useful for triage, to decide which links deserve a closer look. It is a weak basis for a final decision about a site you are about to pay.
How technical trust scores are usually built
Most scoring systems follow the same pattern. They collect signals in groups, score each group, weight the groups by how much they matter, and combine the results. Typical groups are:
- Transport: whether the site uses HTTPS, whether the certificate validates and whether any redirect falls back to HTTP.
- Configuration: security headers such as Strict-Transport-Security and Content-Security-Policy.
- Redirects: how many there are and whether they lead to another domain.
- Identity: URL and domain structure, such as raw IP addresses, look-alike characters or brand names placed in subdomains.
- Reputation: matches in lists of URLs reported for phishing or malware, where the scorer has access to such lists.
How MemonaIQ's trust inspector scores a site
Website Trust Inspector requests the URL from MemonaIQ's servers, follows its redirects and records what it can observe from outside. It requires sign-in and uses your daily scan allowance. The findings it shows cover:
- Whether the final page is served over HTTPS, and whether any redirect downgrades from HTTPS to HTTP.
- Whether a redirect leads to a different domain.
- Whether five headers are present: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- Whether the hostname uses Punycode, the encoding behind internationalized domain names, which look-alike domains can exploit.
- The registered domain and any subdomain, so misleading subdomain text is easier to spot.
Evidence, confidence and the 0 to 100 score
Each finding shows the evidence, when it was observed and a confidence level. Checks that couldn't run are marked unknown and left out of the score, so missing evidence doesn't count against a site.
The 0 to 100 technical trust score combines weighted internal module scores for TLS, HTTP security headers, redirects, URL structure, basic SEO signals and page content. Not every input to the score appears as a visible finding, so the findings explain most of the number but not all of it.
If no module completes, the report says there is insufficient evidence instead of showing a number. An HTTPS-to-HTTP downgrade counts as a high-risk indicator and changes the summary label whatever the score.
Reputation lookups are not part of the score today
Many trust checkers also query threat-intelligence services, which keep lists of URLs reported for phishing and malware. The inspector doesn't query any such service today. Its report states that external threat intelligence is not configured, and that check has no effect on the score.
So a clean result doesn't tell you whether the URL appears on a blocklist. Even where blocklists are used, a new phishing site can go live before anyone reports it, so an unlisted URL may not have been reported yet.
What a trust score cannot tell you
A score describes technical setup at one moment. It can't tell you whether a shop will ship your order, whether its reviews are genuine or whether a company is who it claims to be.
Signals mislead in both directions. A new, legitimate site may send few headers and score low, while a scam can run on a well-configured site with valid HTTPS. Treat a warning as a reason to look closer; on its own it does not show fraud.
Before trusting a site with money or personal data, add checks a scanner can't make. Consider how you found the link, the company's registration and contact details, and independent reviews.