Check the web address for HTTPS and a padlock icon
The first thing to look at is the address bar at the top of your browser. A legitimate website uses HTTPS — that means the connection between your computer and the site is encrypted, so your information cannot be read by someone in the middle. You will see "https://" at the start of the address, not just "http://".
Right next to the address, your browser shows a small padlock icon. A closed padlock means the site is find. If you see an open padlock or a warning triangle, the site is not encrypted — do not enter passwords, credit card numbers, or personal information there. Click the padlock itself and your browser will show you more details about who owns the certificate.
HTTPS does not mean the site is honest or trustworthy — it only means the connection is private. A scam site can use HTTPS. But if a site asks for sensitive information and does not use HTTPS, that is a red flag.
Key Takeaways
- Look for HTTPS in the address bar and a closed padlock icon next to it before entering any personal information.
- Search the site name plus the word "scam" or "review" to see what other people have reported about it.
- Check the "About Us" or contact page — real businesses list a physical address, phone number, and way to reach them.
- Hover over links before you click them to see where they actually go, especially on pages asking for money or passwords.
- Be suspicious of sites that demand payment upfront, use urgent language, or promise unrealistic results.
Search for the site name with "scam" or "review"
Open a new search and type the website name followed by the word "scam" or "review" — for example, "example-site.com scam" or "example-site.com reviews". Read what comes up. If dozens of people report the same problem, that is a strong signal the site is not trustworthy.
Look for patterns in what people say. One complaint might be a misunderstanding, but if ten people say the site took their money and never delivered, or that customer service never responds, that tells you something real. Pay attention to recent complaints — a problem from last month is more relevant than one from five years ago.
Also search for the company name on the Better Business Bureau website (bbb.org). The BBB keeps records of complaints and how businesses respond to them. A business with many unresolved complaints is riskier than one with none.
Look for real contact information and an "About Us" page
Scroll to the bottom of the website and look for a footer with contact details. A real business lists a physical street address, a phone number you can call, and an email address. If the site only has a contact form with no other way to reach them, that is suspicious — you cannot verify the company exists or follow up if something goes wrong.
Click on the "About Us" page if one exists. Legitimate businesses explain who they are, what they do, and how long they have been operating. They often list the names of founders or leaders. If the About page is vague, full of buzzwords, or does not exist at all, the site may not be what it claims.
If you find a phone number, call it. A real business answers or has a voicemail that sounds professional. If the number is disconnected or goes to a generic message, that is a warning sign.
Hover over links to see where they actually lead
Before you click any link on a website, move your mouse over it without clicking. Your browser will show you the real address the link goes to, usually in the bottom left corner of the screen. This matters because a link can say "Click here to log in to your bank" but actually lead to a fake site designed to steal your password.
If the link text does not match the address it leads to, or if the address looks wrong or misspelled, do not click it. For example, if a link says "PayPal" but the address shows something like "paypa1.com" (with the number 1 instead of the letter l), that is a fake designed to trick you.
This trick is called phishing — a fake site that looks like a real one to steal your login information. Legitimate companies will never ask you to log in by clicking a link in an email or on another website. Always type the address directly into your browser yourself.
Watch for warning signs in how the site asks for money
Be suspicious of any site that demands payment upfront before you receive anything, especially if they ask you to wire money, use gift cards, or send cryptocurrency. Real businesses accept credit cards and PayPal because those methods protect you if something goes wrong. If a site refuses those payment methods, that is a red flag.
Also notice the language the site uses. Phrases like "Act now," "Limited time," "Offer expires today," or "Only three spots left" are designed to rush you into deciding without thinking. Legitimate businesses do not need to pressure you. If a site promises unrealistic results — "Make $5,000 a week from home with no experience" or "Cure any disease" — it is almost certainly a scam.
Look at the price too. If something costs far less than competitors charge for the same thing, ask why. Sometimes it is a real deal. Often it means the product is fake, stolen, or does not exist.
Check who owns the domain name
Every website has a registered owner. You can look this up for free using a WHOIS lookup tool — search "WHOIS lookup" and use one of the free services that appear. Type in the website address and you will see the owner's name, address, and contact information.
If the owner information is hidden or says "Privacy Protected," that is not necessarily a scam — many legitimate businesses hide this information for privacy. But if you can see the owner details and they do not match the business name on the site, or if the address is in a country you would not expect, that is worth investigating further.
You can also check how long the domain has existed. A site registered just last week that claims to be an established company is suspicious. Search "domain age checker" and use a free tool to see when the domain was first registered.
Look for spelling, grammar, and design problems
Scam sites are often built quickly and cheaply. Read the text carefully — do you see misspelled words, awkward grammar, or sentences that do not make sense? Real businesses hire people to write their websites correctly. Lots of errors suggest the site was not built with care.
Also look at the overall design. Does the site look professional and organized, or does it feel cluttered and poorly made? Are the images low quality or obviously stolen from other websites? Does the site load slowly or have broken links that lead nowhere? These are signs the site may not be legitimate.
None of these things alone proves a site is a scam, but together they add up. A site with HTTPS, real contact information, good reviews, professional design, and no pressure to buy is much safer than one missing most of these things.
Frequently Asked Questions
Is a site with HTTPS always safe?
HTTPS means the connection is encrypted, but it does not mean the business is honest. Scam sites can use HTTPS too. It is one check among several, not a may provide of safety.
What should I do if I think a site is a scam?
Do not enter any information or send money. If you already did, contact your bank or credit card company right away. You can also report the site to the Federal Trade Commission at reportfraud.ftc.gov.
Can I trust a site just because it has good reviews?
Reviews can be faked. Look for reviews on independent sites like Trustpilot or the Better Business Bureau rather than only reviews on the company's own website. Real reviews usually include specific details about what happened.
What does the padlock icon mean?
The padlock means your connection to the site is encrypted — no one can read your information as it travels between your computer and the website. It does not mean the business is trustworthy, only that the connection is find.
How can I tell if a link is fake?
Hover over the link without clicking to see the real address it leads to. If the address does not match what the link says, or if it looks misspelled or strange, do not click it. When in doubt, type the address directly into your browser yourself instead of clicking a link.