Workflow
Trust Score Analysis
Before entering details on an unfamiliar website, check its technical signals and its reputation, and understand what each can and can’t tell you.
An unfamiliar shop, a login page linked from an email, a site that a search ad sent you to: before you enter a password or card number, it’s worth a minute to look at how the site is set up.
Technical signals won’t prove a site is honest. They can show warning signs that are hard to see from the page itself.
Signals worth checking
- Does the site use HTTPS, and does the plain-HTTP version redirect to it?
- Does the link redirect somewhere other than the domain you expected?
- Does the hostname imitate a known brand with extra words or look-alike characters?
- Has a threat-intelligence or reputation service flagged it?
- Does it send the basic security headers a maintained site usually has?
Reading the result sensibly
Weigh the evidence, not just the score. A redirect to an unrelated domain or a reputation flag is a strong signal to stop. A few missing headers on a small business site is not. Combine the results with other checks: how you found the site, independent reviews and the company’s registration details.
A quick check
- Copy the link without opening it, if it came from an email or message
- Look it up on a reputation service such as Google Safe Browsing’s site status page
- Paste it into the Website Trust Inspector (free account needed)
- Look first at redirects to other domains and any drop to plain HTTP
- Read the evidence for anything marked as a risk
- If in doubt, go to the company’s site by typing its address yourself
Limits to keep in mind
A clean result means no technical warning signs were found. It is not a guarantee that a business is genuine.
The Trust Inspector doesn’t check reputation lists, so look those up separately; a list only knows about sites that have been reported.
Common questions
- Does the padlock mean a site is safe?
- No. The padlock means the connection is encrypted. Scam sites can and do use HTTPS; it only stops others reading the traffic in transit.
- What should I do if a site looks suspicious?
- Don’t enter details. If it imitates a company you use, contact that company through its official site or app, and report phishing to your email provider.