# How to Check Whether a Website Is Safe Before You Click

URL: https://www.mytechnician.tech/tips/how-to-check-if-a-website-is-safe/
Published: 2026-07-27 | Author: Ankit Kumar
Tags: Online Safety, Scams, Phishing, Security, Browser
Summary: Not sure a site or link is genuine? Check the domain properly, read the padlock for what it really means, scan the URL, and spot the signs of a fake shop or phishing page.

## The Problem
Most people check the wrong thing. The padlock in the address bar means the connection is encrypted — nothing more. Certificates are free and automatic, so the overwhelming majority of phishing sites have a padlock too.

What actually tells you whether a site is safe is the **domain name**, how you arrived at it, and whether the page is asking for something a legitimate site would not ask for. Those three checks take about thirty seconds and catch nearly everything.

> **Already entered details on a site you now doubt?** Go straight to [recover a hacked email account](https://www.mytechnician.tech/tips/recover-hacked-email-account/) and change that password from a different device. **Link arrived by email or text?** See [spot and avoid phishing emails](https://www.mytechnician.tech/tips/spot-avoid-phishing-emails-scams/) and [spot scam text messages](https://www.mytechnician.tech/tips/spot-scam-text-messages-smishing/).

## Symptoms
Check a site carefully when:

* You arrived from an email, text, ad, or social media post rather than typing the address yourself.
* Prices are dramatically below everyone else's.
* The page urges you to hurry — a countdown, "only 2 left", "your account will be closed today".
* It asks for payment by bank transfer, gift card, or cryptocurrency.
* Something about the address looks slightly off.

## Step 1: Read the Domain from Right to Left
This is the single most valuable habit in this guide.

The real domain is the part immediately before the **first single slash**, read backwards from there:

* `https://accounts.google.com/signin` → the domain is **google.com**. Safe.
* `https://google.com.secure-login.info/signin` → the domain is **secure-login.info**. Not Google.
* `https://paypal-verify.com` → not PayPal. Anything before a hyphen is not ownership.
* `https://amaz0n.co.uk` → a zero instead of an "o". Look character by character.

Points to check every time:

1. Everything to the left of the real domain is a **subdomain**, and anyone can create one saying anything.
2. Watch for extra words joined by hyphens, doubled letters, and swapped characters (`rn` for `m`, `1` for `l`, `0` for `o`).
3. Check the ending. A UK bank uses `.co.uk` or `.com`, not `.top`, `.xyz`, `.shop`, or `.click`.
4. On a phone, tap and hold a link to preview the full address before opening it.

## Step 2: Understand What the Padlock Does and Does Not Mean
1. Click the padlock (or the tune icon) in Chrome or Edge → **Connection is secure** → **Certificate is valid**.
2. Check **Issued to** matches the organisation you expect. On many sites it will name only the domain, which is normal.
3. **A padlock means:** nobody on the network can read what you send.
4. **A padlock does not mean:** the site is honest, the shop will ship anything, or the company is real.
5. A missing padlock, or a certificate **warning**, is still a hard stop — never enter anything on such a page.

## Step 3: Scan the URL with a Reputation Service
Free and worth the fifteen seconds for anything unfamiliar.

1. Copy the link **without opening it** — right-click → **Copy link address**.
2. Paste it into **VirusTotal** (`virustotal.com`) → **URL** tab. It checks the address against dozens of security vendors.
3. Or use **Google Safe Browsing site status**, or **URLVoid**.
4. A handful of "suspicious" flags on a well-known site is usually noise; several vendors flagging **malicious** or **phishing** is conclusive.
5. If a link is shortened (`bit.ly`, `t.co`), expand it first at `unshorten.it` or by pasting it into VirusTotal, which resolves redirects.

## Step 4: Check How Old the Domain Is
Scam shops are typically days or weeks old. Real businesses are not.

1. Look the domain up on a WHOIS service such as `whois.domaintools.com` or `who.is`.
2. Read the **Creation Date**. A "20-year-established retailer" whose domain was registered last month is lying.
3. Privacy-protected registration is normal and not itself a red flag — the **age** is the useful signal.
4. Cross-check with the **Wayback Machine** (`web.archive.org`): a genuine business usually has years of snapshots.

## Step 5: Look for the Things Fake Shops Cannot Fake
1. **A real postal address and phone number** on the contact page — then search that address. Fake shops reuse addresses that turn out to be car parks or unrelated buildings.
2. **A company registration number** where the country requires one. Look it up in the official register.
3. **Working links.** Fake sites leave Terms, Returns, and Privacy pages empty or copied word for word from another shop — paste a sentence into a search engine and see how many sites have it.
4. **Consistent English and correct branding.** Mixed currencies, mismatched logos, and stock photos of "our team" are all warnings.
5. **Reviews off-site.** Search "*sitename* reviews" and "*sitename* scam". Trust Trustpilot and Reddit threads more than the testimonials on the site itself.
6. Full checklist for buying: [avoid online shopping scams](https://www.mytechnician.tech/tips/avoid-online-shopping-scams/).

## Step 6: Judge What the Page Is Asking For
Legitimate organisations do not do these things:

* Ask for a password, PIN, or full card details by email or text link.
* Ask for payment by **bank transfer, gift card, or cryptocurrency** for a normal retail purchase.
* Ask you to install a "security tool" or a remote-access program to fix a problem — see [avoid tech support scam calls](https://www.mytechnician.tech/tips/avoid-tech-support-scam-calls/).
* Ask for a code sent to your phone in order to "verify" you. That code is your 2FA code and giving it away hands over the account: [set up two-factor authentication](https://www.mytechnician.tech/tips/set-up-two-factor-authentication-2fa/).

When paying, use a **credit card** or PayPal. Both give you a route to reclaim money; a bank transfer does not.

## Step 7: Reach the Site the Safe Way Instead
The reliable defence is to stop following links at all.

1. Type the address yourself, or use a bookmark you saved when you first signed up.
2. Open the company's official app rather than a link in a message.
3. If an email says there is a problem with your account, log in the way you normally do and check for the notice there. It will be absent if the email was fake.
4. Be careful with **search ads** — the top result is often a paid ad impersonating the brand. Scroll to the organic result, or check the domain before clicking. Related: [avoid malware in fake downloads](https://www.mytechnician.tech/tips/avoid-malware-fake-downloads/).

## Step 8: Turn On the Protection Your Browser Already Has
1. **Chrome:** go to `chrome://settings/security` and select **Enhanced protection**.
2. **Edge:** `edge://settings/privacy` → turn on **Microsoft Defender SmartScreen**.
3. **Firefox:** `about:preferences#privacy` → tick both options under **Deceptive Content and Dangerous Software Protection**.
4. In Windows: **Windows Security** → **App & browser control** → **Reputation-based protection** → turn on **Check apps and files**, **SmartScreen for Microsoft Edge**, and **Phishing protection**.
5. Consider a filtering DNS resolver such as Quad9 or Cloudflare `1.1.1.2`, which blocks known malicious domains for every device: [how to change DNS servers in Windows 11](https://www.mytechnician.tech/tips/how-to-change-dns-servers-windows-11/).
6. Keep the browser updated — most drive-by attacks target versions months out of date: [keep your devices updated safely](https://www.mytechnician.tech/tips/keep-your-devices-updated-safely/).

## What Not to Do
* **Don't trust the padlock on its own.** It is the most misunderstood symbol on the web.
* **Don't judge a site by how professional it looks.** Templates are cheap and real sites are copied wholesale.
* **Don't tap "unsubscribe" in a suspicious email** to test whether it is real — it confirms your address is live.
* **Don't enter real details "just to see".** If you want to test a form, you have already decided you do not trust it.

## Still Not Working?
If you have already entered a password, change it immediately from a different device and turn on two-factor authentication. If you entered card details, call your bank's fraud line using the number on the back of the card — not any number from the site or email.

If you downloaded and ran a file from the site, scan the PC: [remove viruses and malware in Windows 11](https://www.mytechnician.tech/tips/remove-virus-malware-windows-11/), and check for browser changes: [how to remove a browser hijacker](https://www.mytechnician.tech/tips/remove-browser-hijacker-search-redirect/).

Related: [protect your privacy on social media](https://www.mytechnician.tech/tips/protect-privacy-on-social-media/) and [set up account recovery options](https://www.mytechnician.tech/tips/set-up-account-recovery-options/).

---
Source: https://www.mytechnician.tech/tips/how-to-check-if-a-website-is-safe/ — My Technician, free Windows 10/11 troubleshooting guides.
More guides: https://www.mytechnician.tech/llms.txt