VerigrityVERIGRITY GUIDE
Website Trust Checklist: 20 Things to Check Before You Buy
No single signal proves a website is trustworthy, and no single warning sign proves it's a scam. Trust is built from a pattern of small observations. This checklist walks through twenty things worth checking before you pay, register, or share personal information with an unfamiliar site — organized so you can scan the important ones first.
Before anything else
Two quick rules:
- No single item on this list is decisive. Even a scam site can pass most of these checks. Use the checklist to slow down and gather information, not as a pass/fail test.
- If the deal looks unusually good — 70% off, limited time, exclusive access — apply every item below with extra care. Urgency is a tactic.
The identity of the site
1. Read the domain carefully
Find the last dot before the first slash. That's the actual domain. Look for:
- Correct spelling of the brand name (paypa1 vs paypal, rnicrosoft vs microsoft)
- No hyphens splitting a well-known name (pay-pal.com)
- No unusual TLD for a known brand (microsoft.tk)
- No
xn--prefix on a Latin-script brand
2. Check the URL bar, not the page design
Attackers can copy a real site's logo, fonts, and layout within minutes. The URL bar is the one place they can't fake. Before you log in or pay, glance at the address bar and confirm the domain matches the brand.
3. Check whether HTTPS is in place
Absence of HTTPS on a site asking for any information is a warning. Presence is baseline — it means the connection is encrypted, not that the site is honest.
4. Verify the certificate covers the domain
Click the padlock icon in your browser and inspect the certificate. Confirm the subject matches the domain you're on, the issuer is a real authority (Let's Encrypt, DigiCert, Sectigo, Cloudflare, etc.), and the dates are valid. A certificate for a different domain is a red flag.
The business behind the site
5. Find a real contact method
Look for a phone number, a physical address, or an email. Not just a "contact form" — a form is a black box. A legitimate business will usually list something you can verify independently. Try the phone number, or search for the address on a mapping service.
6. Read the About page
Who runs the site? Is there a real person or company named, with a story that makes sense? Or is the About page a paragraph of generic marketing copy with no identifiable author?
7. Look for the business registration
In many jurisdictions, businesses are required to publish a registration number (company number, VAT ID, EIN, or equivalent). If the site claims to be a company but shows no registration, ask why. Not every small site has one, but a pattern of missing information is worth noticing.
8. Search for the business name independently
Open a new tab and search for the exact business name plus the word "review" or "scam." Look at results from sources you didn't get to through the site itself. If the only results are the site's own pages, that's suspicious for a business claiming to be established.
9. Check social media presence
Established businesses usually have some social presence — even a dormant one. A complete absence, or an account with no history, is a signal worth noting. It's not decisive on its own.
What the site tells you about itself
10. Read the privacy policy
Does it exist? Is it specific about what data is collected and how it's used? Generic privacy policies copied from a template are common and don't tell you much — but a missing privacy policy on a site asking for personal data is a serious gap.
11. Read the terms of service
Especially the sections on refunds, cancellation, dispute resolution, and governing law. A site that requires arbitration in a foreign jurisdiction for a $20 purchase is a signal that the operator has thought about how to avoid liability.
12. Check the refund policy
Before you pay, know what happens if you want your money back. Common patterns:
- Clear, reasonable refund window (30 days, no questions) — normal
- Refunds only for defective products — common, worth understanding
- No refunds at all — a warning for high-priced items
- "Contact us for refunds" with no policy — worth asking before paying
13. Look for the pricing details
Is the price clear? Or does it only appear at checkout, with additional fees added along the way? Hidden fees, mandatory subscriptions, or a total that changes at the last step are all red flags.
The payment
14. Check the payment destination
Who are you actually paying? If the site claims to be a known company but the payment goes to a different name, stop. Compare the recipient name on the payment page with the business name you believe you're dealing with.
15. Prefer payment methods with recourse
Credit cards, PayPal Goods & Services, and similar methods offer dispute mechanisms. Bank transfers, wire transfers, cryptocurrency, and gift cards generally do not. A site that only accepts irreversible payment methods is riskier.
16. Be wary of unusual payment requests
Legitimate businesses don't usually ask for payment by gift card, wire transfer, or cryptocurrency for ordinary purchases. These methods are common in scam campaigns because they're hard to reverse.
17. Watch for unusual urgency
"Your account will be closed in 24 hours." "Only 2 left at this price." "Confirm now or lose access." Real businesses rarely use this kind of pressure. Artificial urgency is one of the strongest predictors of scam behaviour.
After you've decided to engage
18. Use a unique password
Never reuse a password from another site. If the site is compromised, a unique password limits the damage. A password manager makes this easy.
19. Enable two-factor authentication if offered
2FA doesn't make a site trustworthy, but it protects your account if the site's password database is later breached.
20. Save evidence
Screenshot the product page, the price you saw, and the order confirmation. If you later need to dispute a charge, this documentation helps.
How to use this checklist
You don't need to check every item for every site. Match the depth of your check to the stakes:
- Reading an article: items 1–4 are enough.
- Signing up for a free account: items 1–9 plus 10.
- Buying something small: items 1–17.
- Buying something expensive or sharing sensitive information: all 20 items, plus independent verification of the business through at least one source outside the site.
No checklist can guarantee safety. What it can do is slow you down enough to notice things that a fast decision would miss. That's most of the value.
Frequently asked questions
How many items can I skip?
For low-stakes decisions (reading an article), you can skip most. For anything involving payment or personal data, work through the full list — especially items 5, 6, 8, 14, 15, and 16.
What if the site passes everything on the checklist?
That's a good sign, but not a guarantee. Scam operators can invest significant effort in presenting a legitimate-looking site. If something still feels off — an unusually good deal, an unexpected request, a business model that doesn't quite make sense — trust that feeling and investigate further.
How long does this take?
For a low-stakes site, about 2 minutes. For a purchase, 10–15 minutes. For a high-stakes decision, as long as it takes to feel confident.
Do I need to do all of this for sites I already know?
No. This checklist is for unfamiliar sites. Once you trust a site, you don't need to re-verify it every visit — though it's worth noting that trusted sites can be compromised, so keeping an eye on the URL bar and payment recipient is still worthwhile.
Run the free Website Trust Checker