How to tell if a website is legit
No single sign proves that a website is honest, and no single sign proves that it is a scam. Look at several things together, and choose a way to pay that you can dispute.
Short answer. Check how old the address is, whether the site gives a real postal address, whether its badges and social links lead anywhere, and whether it lets you pay by card. Then search for the site's name with the word "scam" or "reviews" on other sites. Run the checks on an address or a message: our checker does the first steps for you and shows the normal causes beside every concern.
Start with the address
Read the address before anything else. The part that decides who owns a site is the name just before the ending (.com, .co.uk, .in): example.com in shop.example.com/sale. Words before it, or after a slash, can be anything. Our guide to look-alike addresses shows the common tricks.
Then find out how old the address is. Many fake shops use an address that is only days or weeks old. A new address is also normal for a new, honest business, so weigh it with the rest.
Contact details
Look for a postal address, a phone number and an email address. Citizens Advice lists "no postal address" as a sign that you may not be dealing with a real company (Citizens Advice, read 29 October 2026).
- Search for the postal address. A home address, an empty plot or another company's office is worth knowing.
- Check that the email address uses the site's own name. A shop that answers only from a free webmail address is common for very small sellers, and also for fake ones.
- A contact form alone gives you no way to reach anyone if something goes wrong.
Normal causes. Some honest sites that sell nothing (a blog, a club) give no postal address. Some sellers working from home leave it off for safety.
The padlock (https)
The padlock, or "https" at the start of the address, means the connection between you and the site is encrypted. It does not tell you who runs the site or whether it will send what you pay for.
Anyone can get a certificate in minutes, free: Let's Encrypt describes itself as "a free, automated, and open Certificate Authority" (read 29 October 2026). Fake shops use https as often as real ones.
What does matter: never enter card details or a password on a site that shows a certificate warning, or that works only over plain http.
Trust badges
A trust badge (a "secure checkout" seal, an antivirus logo, a review-site rating) is only a picture. Anyone can copy it onto any page.
A real badge usually links to the issuer's own site, where a page confirms the shop by name. Click it. If nothing happens, or it opens a page on the shop's own site, the badge proves nothing.
Normal causes. Some small shops add badge pictures from their shop software without knowing they should link anywhere. A badge with no link is worth knowing, not proof of a scam.
Social links
Follow the shop's social links. A link that goes to the network's home page (facebook.com, instagram.com) and not to a profile is a common mark of a site built from a template and never finished.
When a link does go to a profile, look at its age and its comments. A profile with few posts, all from the last few weeks, or comments switched off, is worth weighing. Customers' complaints often appear in the comments first.
Template text and copied pages
Read the returns, delivery and privacy pages. Fake shops often copy them from a template or from another shop and forget to change them. Look for:
- Placeholder text such as "[Store name]", "Your company" or "Lorem ipsum".
- Another company's name or email address.
- A returns address in a different country from the one the shop claims to be in.
- Laws or regulators from a country the shop does not trade in.
Copy an unusual sentence from the "About us" page into a search engine, in quotes. If it appears word for word on other shops with other names, they may be run by the same people.
Look outside the site
Everything on a website is written by its owner. Look for what other people say:
- Search for the shop's name, or its address, with the word "scam" or "reviews".
- Read reviews on sites the shop does not control, and read the newest one-star reviews first.
- Be wary of prices far below every other shop. A big discount on a sought-after item is the most common lure.
How you pay
How a site asks you to pay is one of the strongest signs you can check. A shop that accepts only bank transfer, crypto, a money transfer service, a payment app or gift cards leaves you with little chance of getting money back. The FTC says: "Never pay someone who insists that you can only pay with cryptocurrency, a wire transfer service like Western Union or MoneyGram, a payment app, or a gift card" (FTC, read 29 October 2026). More in our guide to bank transfer, crypto and gift card payments.
Where a product helps
No product can tell you whether a shop will send what you paid for. A fake shop and a new honest shop can look the same to every automatic check.
What protects you most is how you pay. A card or a payment service with a dispute process gives you a way back if nothing arrives. Ask your card provider what protection your card gives in your country.
Free protection is already in your browser. Chrome's Safe Browsing warns about "sites, downloads, and extensions that have been identified as dangerous" (Google, read 29 October 2026). Security software adds similar lists. Both catch known sites only, so a fake shop that opened this week is often on no list.
About this guide
Our checks that this guide explains: Contact details, Secure connection, Trust badges, Social links, Template text. Each quote was read on the source's own page on the date shown. Legit Signals has no affiliate links: no company pays to be named here.
Last reviewed: 29 October 2026. Spotted an error? Tell us