Come capire se un sito è affidabile: 9 controlli (2026)

Here's how to check if a website is legit before you hand over money, a password or your personal details.

No single tool can tell you whether a website is legit. Scam sites often switch to new domains, many have valid HTTPS padlocks, and some copy a real shop's design pixel for pixel. What works is a short routine of independent checks: each one catches a different kind of fake, and together they give you a verdict you can trust.

This guide walks through nine free checks, in the order that catches the most problems for the least effort. Most take under a minute. You don't need any paid tool, and you don't need to be technical.

Is this website legit? The 60-second version

If you only have a minute, do these four things:

• Check the address bar. Is the domain spelled exactly right, with no extra words or swapped letters?
• Run Google Safe Browsing. Paste the address into Google's free site status tool and see whether it's flagged.
• Look up the domain's age. A shop that claims to have traded for years but registered its domain last month is a red flag.
• Search the name with "scam" or "reviews". Other people's experiences usually surface quickly.

If anything looks wrong at this stage, stop. If everything looks fine, work through the full list below before you pay.

Step 1 — Read the domain name carefully

Many fake websites rely on you not reading the address. Look at the part just before the first single slash: that's the real domain. amazon.com.deals-today.shop is not Amazon; its real domain is deals-today.shop. Watch for swapped or doubled letters, hyphenated brand names (paypal-support-help.com) and unusual endings on sites pretending to be big brands.

If you arrived from an email, a text message or a social media ad, type the brand's address yourself instead of trusting the link.

Step 2 — Check Google Safe Browsing

Google's Safe Browsing site status tool tells you whether Google currently flags a site as dangerous, for example for malware or phishing. It's free and takes seconds.

A clean result is necessary but not enough. Brand-new scam sites often aren't flagged yet, so "no unsafe content found" means "not known to be dangerous", not "proven legit". Treat it as a filter, not a verdict.

Step 3 — Look up how old the domain is

Fraudulent shops are often built on freshly registered domains, because older ones get reported and blocked. A domain age lookup shows when the domain was first registered. You can use the free domain age checker, which reads registry data over RDAP (the modern replacement for WHOIS) and falls back to the Internet Archive's first snapshot when a registry hides the date.

How to read the result:

• Registered years ago and the business says the same: a good sign, though not proof, because domains do change hands.
• Registered weeks ago, but the site says "trusted since 2009": a strong red flag.
• Very new, and the business openly says it's new: fine for a start-up, but lean harder on the other checks.

Step 4 — Check HTTPS, but don't over-trust the padlock

A padlock and an address starting with https:// mean the connection between you and the site is encrypted. They do not mean the people running the site are honest. Certificates are free and automatic to obtain, so most scam sites have one too.

What a missing padlock tells you is more useful: if a site asks for card details or a password over plain http, leave.

Step 5 — Search for independent reviews and complaints

Search the site name with words like scam, reviews and complaints. Read results from several places rather than one: forums, Reddit threads, consumer-protection sites and review platforms. Be wary of a site whose only reviews are glowing ones on its own pages.

Review platforms use their own scores. Trustpilot's TrustScore is a 1-5 rating weighted towards recent reviews; ScamAdviser gives a 0-100 risk score from dozens of automated signals. Both are useful second opinions, and both can be wrong about a brand-new or very small site.

Step 6 — Check contact details and company information

A legitimate business tells you who it is. Look for a physical address, a working phone number, an email address on its own domain rather than a free webmail account, and company or registration details where the law requires them. Paste the address into a map and see whether it's a real building. Then try the contact form or email with a simple question before you buy anything expensive.

Step 7 — Read the policies and the prices

Real shops publish clear shipping, returns and refund policies. Fake ones often copy policies from elsewhere, so look for another company's name left in the text or returns addresses in a different country from the one the site claims.

Prices matter too. Big discounts on products that are normally never discounted, countdown timers on every page, and "only 2 left" on everything are classic pressure tactics.

Step 8 — Look at the site's history

The Internet Archive's Wayback Machine shows earlier versions of most websites. A shop that claims a long history should have one. If the earliest snapshot is from last month, or the domain used to be something unrelated (a dentist, a gaming blog, a parked page), be cautious.

Step 9 — Pay in a way you can dispute

If you decide to buy, use a method that lets you dispute the charge, such as a credit card or a payment service with buyer protection. Walk away from any site that only accepts wire transfers, gift cards or cryptocurrency for an ordinary purchase: legitimate shops very rarely insist on those.

If you've already been caught out, contact your bank or card provider straight away. In the US you can report it to the FTC at ReportFraud.ftc.gov; other countries have their own consumer-protection and fraud-reporting services.

If you run a website: make these checks easy to pass

Everything above is also a checklist for site owners. Visitors and review tools look at the same things, so a legitimate business can make itself easier to trust:

• Show who you are. Put a real address, phone number and domain email on a contact page, and link it from the footer.
• Keep your story consistent. If your site says "since 2015", your domain age, archive history and company records should agree.
• Publish clear policies. Shipping, returns, refunds and privacy pages written for your business, not copied from a template with someone else's name in it.
• Serve the whole site over HTTPS and fix mixed-content warnings.
• Ask real customers for reviews on an independent platform rather than only on your own pages.
• Check your own website trust score. Run your domain through the website trust score checker to see how your HTTPS, domain age, traffic rank and Lighthouse scores add up, and which slots are costing you points.

None of this makes a site legit on its own. It removes the doubts that make honest new businesses look like fakes.

What a website trust score can and can't tell you

You'll see many tools offering a "website trust score", and they measure very different things. Some are risk scores built to spot scams. Others, including the FeedPulse website trust score checker, measure site quality and longevity signals instead.

The FeedPulse score blends seven public signals into a 0-100 grade: global traffic rank (20 points), domain age (20), HTTPS (10) and the four Google Lighthouse scores for performance, SEO, accessibility and best practices (50 together). Every weight is published on the page. It is not a scam detector: it checks no blocklist and doesn't read the site's content, so a new scam site on fast hosting can score respectably. Use it to compare how established and well built two sites are, then use the checks above to decide whether one is legit.

Can a legit website fail some of these checks?

Yes. Small and new businesses often have young domains, few reviews and no Wikipedia page. That's normal, so look for consistency instead: an honest new shop says it's new, gives real contact details and answers questions. A fake one claims a history it doesn't have.

Can a scam website pass all of these checks?

Occasionally, especially if criminals take over an old, legitimate domain. That's why payment protection (step 9) matters even when everything else looks fine. No check is perfect; a routine of several catches far more than any one tool.

Is there a free website legit checker?

Not one that can give a guaranteed answer. Google Safe Browsing, a domain age lookup, review platforms and ScamAdviser are all free and each covers part of the picture. Combining them, as in the steps above, is more reliable than trusting any single "legit or not" badge, including a trust badge on the site itself, which anyone can copy.

How do I check if a website is safe to buy from?

Do the full nine checks: correct domain spelling, a clean Safe Browsing result, a domain age that matches the story, HTTPS, independent reviews, real contact details, sensible policies and prices, a consistent history, and a payment method you can dispute. If two or more checks raise doubts, buy elsewhere.

Related free tools

• Website trust score checker — a 0-100 quality and longevity grade with published weights
• Domain age checker — when a domain was first registered, from RDAP and the Internet Archive
• How to improve your website trust score — what moves each signal, for site owners
• Free Lighthouse checker — the four Lighthouse scores behind half of the trust score