How to Check If a Website Is Legit in 2026
(9 Things We Look at Every Time)

Last month someone sent me a link to a sneaker store. $180 Jordans for $31. "Too good to be true?" they asked.

It was registered 9 days ago. The "team" photos were from a 2019 Shutterstock pack. The business address was a virtual mailbox in Delaware with 47 other "companies." It had appeared on two scam databases the week before.

Gone in 60 seconds. That's how fast you can know.

Here's exactly what we check — and what you can do yourself before buying anything online.

1. Domain age — the single biggest signal

Scam websites are almost always new. Fraudsters register a domain, run it hard for 2–6 weeks while the money pours in, then abandon it before anyone can act.

Check any domain at whois.domaintools.com. Enter the URL. Look at "Registered On." If a store claiming to be an established brand has a domain under 3 months old — stop.

• Red flag threshold: under 6 months old
• High risk: under 90 days old
• Extreme risk: under 30 days old

2. Reverse image search the team photos

This catches more scams than any other single check. Fraudulent websites almost universally use stock photography for their "team" section. Real companies have real people.

Right-click any team photo. "Search image with Google." If the same face appears on 12 different stock photo sites — or worse, on 3 other fake companies' websites — you're looking at a scam.

3. Search for the business on your national registry

A real company in the UK is registered at Companies House. In the US, LLCs and corporations have state-level registration. In most countries there is a public business registry.

Search the exact company name. If a company claiming to have "served 50,000 customers since 2018" has no registration anywhere — it doesn't exist.

4. Check scam databases

Three that matter:

• ScamAdviser.com — aggregates signals from 40+ sources
• URLVoid.com — checks 30+ blocklist engines simultaneously
• Google Safe Browsing — check any URL at transparencyreport.google.com/safe-browsing/search

A site appearing on even one scam database is a serious red flag. Appearing on three or more is nearly conclusive.

5. Read reviews — but not on the site itself

Fake stores excel at writing fake reviews for themselves. Look elsewhere: Trustpilot, Google Reviews, Reddit, the Better Business Bureau. No reviews anywhere for a company claiming to be established? Red flag. Overwhelmingly positive with no negatives, all from recently created accounts? Also a red flag.

6. Check the SSL certificate — but understand what it means

The padlock in your browser means the connection is encrypted. It does not mean the site is trustworthy. Scammers get SSL certificates too — they're free.

What to actually check: click the padlock. If the certificate is for a completely different domain than the one you're on — leave immediately.

7. Verify the physical address

Paste the address into Google Maps. Does it show a real office building? Or a virtual mailbox service like "Suite 300, 123 Main St" that houses 200 other "businesses"?

Virtual office addresses aren't automatically scams — but combined with other signals, they're a clear red flag.

8. Test the contact channels

Send an email. Try their live chat. Call the phone number. Scam sites either have no contact info, or info that goes nowhere. A real business responds. A fake one ghosts you — or routes to a call centre that can't answer basic questions about the company.

9. Check the social media authentically

Look deeper than just presence:

• When was the account created?
• Do posts have real engagement (comments, replies) or just bought likes?
• Are there actual customer interactions, or just promotional posts?
• A page with 50,000 followers and 3 likes per post has bought followers.

The honest truth: doing all 9 checks takes 20–30 minutes

Which is why most people don't do them. They look at the site for 30 seconds and click Buy. That's exactly what scammers design for.

AI-generated websites in 2026 look indistinguishable from real ones. Professional design is no longer a trust signal. You have to look at the data behind the design.