How to check whether a website is legitimate and safe
7 short checks you can do yourself
No single check proves that a website is safe, so you combine a few short checks: type the address yourself instead of clicking a link, check that the domain is spelled correctly, look the site up in free checking tools, check company details and payment methods, and do not enter sensitive details when in doubt. The padlock next to the address shows that the connection is encrypted, not that the site is trustworthy.
Last updated: 28.10.2026 | Written and reviewed by the PhishingU team
7 checks before you enter details or pay
1. Type the address yourself
If you reached the site from a message, email or ad, do not continue from there. Open a browser and type the address you know, or search for the company name. This skips impersonating links.
2. Check that the domain is spelled correctly
Impersonators rely on small changes: a swapped letter, a digit in place of a letter, an extra hyphen or a different ending. Read the whole address, not just the beginning.
3. Do not rely on the padlock alone
The padlock in the address bar means that the connection to the site is encrypted. An impersonating site can obtain one easily, so it says nothing about trustworthiness.
4. Look the site up in free checking tools
You can enter an address in Google's Safe Browsing transparency report or in a scanning service such as VirusTotal. A clean result is not a guarantee, because a new site may not have been flagged yet.
5. Check company details and ways to get in touch
Look for a company name, address, phone number and business details that you can verify in an outside source, not only on the site's own contact page. A phone number and an address you can verify count in the site's favor, but are not proof.
6. Look at the payment methods
A site that asks for payment only by bank transfer, gift card or digital currency, and not by a recognized payment method, is a warning sign. Paying by credit card can sometimes let you ask your card issuer to reverse a charge, subject to its terms.
7. When in doubt, do not enter sensitive details
Do not enter a password, card number or documents on a site you could not verify. If you already did, change the password immediately, contact your card issuer and report it to the relevant party.
What a check like this cannot tell you
A new, legitimate site may look suspicious, and an elaborate impersonating site may pass every check. The checks reduce the risk and do not remove it. For a big decision, such as a significant payment, confirm through a second channel as well, for example a phone call to a number you found yourself.
And what does the PhishingU free check examine?
Our free check examines your own organization's domain, not a third-party site. It reads public DNS records to give an initial indication of whether your organization could be impersonated by email (SPF, DKIM, DMARC), and shows basic information about the domain that is visible from the outside. It does not determine whether another site is legitimate or safe, and it does not replace an expert review.
SPF record: what it is and how to write oneFrequently asked questions about website trustworthiness
Want to check your own organization's protection?
An initial check at no cost and no commitment, on your organization's domain.