FREE TOOL

Website Trust Checker

Get a free Verigrity Trust Score for any website. Reviews HTTPS, TLS, DNS, security headers, policy pages and other observable signals.

What this tool checks

HTTPS and TLS certificate validity
HTTP response and redirect behavior
Security headers (HSTS, CSP, X-Frame-Options and more)
Presence of privacy, terms and contact pages
DNS A and MX records

What a Verigrity Trust Score is

The Verigrity Trust Score is a 0–100 summary of observable signals collected from a website when you submit a URL. It is not a certification, and it is not a guarantee. It is a starting point — a way to slow down and look at what a site actually shows you before deciding whether to buy, register, or share information with it.

The score combines technical signals (HTTPS, TLS certificate, security headers, DNS records, redirect behavior) with transparency signals (whether the site publishes a privacy policy, terms, and contact details). Sites that check more boxes score higher.

What goes into the score

Each scan starts with a base of 35 points and adds or removes points based on what the site actually shows:

HTTPS protocol — adds 20 points. A site that doesn't use HTTPS leaves the connection between you and the server open to inspection on shared networks.
Server responds with a 2xx or 3xx status — adds 8 points. A site that returns errors or blocks automated requests is harder to assess.
Two or fewer redirects — adds 5 points. More than four redirects subtracts 8. Long redirect chains can hide the true destination of a link.
Security headers — up to 15 points, at 3 points each. These headers tell the browser how to protect visitors. Missing them isn't malicious, but their presence indicates care.
Privacy policy signal — adds 3 points if the site mentions or links to a privacy policy.
Terms signal — adds 2 points.
Contact signal — adds 2 points.
Page title missing — subtracts 3 points. Pages with no title are often unfinished or templated.
Punycode hostname (xn--) — subtracts 5 points. Punycode can be used for homograph attacks that mimic a legitimate domain visually.

What each signal means

HTTPS and TLS certificate

HTTPS encrypts the traffic between your browser and the server. A valid TLS certificate confirms that the server controls the domain and that the connection is encrypted. It does not confirm that the site is honest or safe — scam sites routinely have valid certificates.

HTTP response and redirects

A site that responds with a normal 200 or 301/302 status is well-configured. Sites with many redirects, or that respond only to certain requests, can be harder to trust because the destination of a link isn't always obvious.

Security headers

Headers like HSTS, CSP, X-Frame-Options and others tell the browser how to protect visitors. A site with 4–6 of these headers in place is generally well-maintained. Zero headers may indicate a site that hasn't been updated in years, or that runs on a platform that doesn't set them by default.

Privacy policy, terms, and contact

Legitimate businesses usually publish a privacy policy, terms of service, and a real way to contact them. Their presence is a positive signal — but their absence is not proof of anything. Many small legitimate sites skip them, and many scam sites include them without meaning them.

DNS records

The domain's A records (IPv4 addresses), MX records (mail servers), and NS records (nameservers) reveal how a domain is set up. A domain with no MX records can't receive email — a red flag for a site claiming to be a business. A domain with consistent, reputable nameservers (Cloudflare, AWS, Google) is generally more established than one with unusual or changing DNS.

Page title and content

A page with a real title and substantive content signals a site that has been maintained. A page with no title or very little content may be an under-construction page, a placeholder, or a scam landing page.

What a Verigrity Trust Score is not

Not a security audit. The scan doesn't run malware detection, penetration testing, or CVE lookups.
Not business verification. The score doesn't confirm that the business behind the site is registered, licensed, or real.
Not fraud determination. A high score does not mean a site is honest; a low score does not mean it's a scam.
Not a legal opinion. The score isn't a compliance statement, a GDPR assessment, or a consumer-protection determination.

How to use the score responsibly

The score is most useful when you treat it as the first step of research, not the last. A responsible use looks like this:

Run the scan. Note which signals were present and which were missing.
Look at the missing signals. A missing privacy policy on a site asking for personal data is worth attention. A missing MX record on a site claiming to be a business is worth attention.
Read the site itself. Does the content look substantive? Are the policies readable? Is there a real contact method?
Search independently. Look for the business name on independent sources. Search for the domain name alongside "scam" or "review." Check the business registration in the relevant jurisdiction.
Verify payment details separately. Never wire money, enter card details, or share credentials based on a scan alone.

Why we don't guarantee anything

Verigrity is a tool for helping people notice observable signals — not for making decisions on their behalf. Websites can be compromised, change their behavior, hide their true intent, or operate legally while still being dishonest. A single scan can't see any of that.

Every scan should be one input among many. If a score looks reassuring but something else about the site feels off, listen to that. If a score looks low but you have independent reason to trust the site, that independent evidence matters more.

Limitations

This tool reports observable signals only. It is not a security audit, a business verification, or proof of fraud. Always verify independently.

← Back to all Verigrity tools