Skip to content
WebsiteValidator

AI & security

Website Scam Detector

The trust signals people and payment processors check before believing a site

This checks a site for the signals that separate a real business from a page built last week to take card details: is there a way to reach a human, is there a privacy policy and terms, is there a published address, does the certificate actually cover this hostname, and is the payment path served securely.

Quick runs this page's high-signal checks in about 3 seconds, no browser. Full adds Core Web Vitals, the accessibility engines and a screenshot, and takes about a minute.

Try:
  • Free, no signupNo account, no card
  • No AI in the score986 deterministic rules
  • Nothing publishedYour scans stay yours
  • Answers in secondsQuick scan, no browser

It also looks for the patterns that consistently accompany fraudulent pages - countdown timers that reset on reload, fabricated scarcity ('12 people are viewing this'), trust badges that are flat images rather than links to a verifiable certificate, obfuscated links, and text hidden from humans but visible to crawlers.

Two honest limits. This is a signal check, not a verdict: a legitimate small business can be missing several of these, and a sophisticated fraud can pass them all. And it examines the page - it cannot tell you whether the company behind it will ship your order. Treat a low score as a reason to look harder, not as proof of anything.

Why this matters

How do you tell a real shop from a smart-looking one?

A convincing page is cheap to build. A template, a logo, a padlock in the address bar - none of it says a company is behind the checkout. The things that actually separate a real business from a page set up last week are small and easy to skip past: no way to reach a human, no address anyone could visit, a timer counting down that starts again when you reload. If the site is your own, those same gaps are what makes a first-time buyer hesitate with their card in their hand.

What it costs you when this is wrong

  • Card details posted in the clear

    The padlock says nothing about where a form sends its data. A checkout or sign-in form whose action is an http:// URL transmits the card number or password in plain text, and the page looks identical either way. You find out from a chargeback, or from the day the browser starts blocking the submission outright.

  • Cautious buyers leave and never say why

    No phone number, no postal address, no privacy policy: a first-time visitor has nothing to check before typing card details, so they close the tab. Nothing in your analytics separates that from a quiet day. It usually becomes visible later, when a payment provider or marketplace review asks for exactly those three things before the account can trade.

  • The urgency widget makes the shop look fake

    A countdown that restarts on reload, and an "only 3 left" badge with no stock behind it, are two of the first things an experienced buyer uses to identify a fraudulent shop. They are usually added by a plugin, and nobody in the business ever sees the page fresh. Falsely claiming an offer is about to end is also a banned commercial practice under UK and EU consumer law, not a styling choice.

Why run it here

  • The page itself, not the domain record

    A reputation score is built from domain-level signals - registration age, registrant privacy, server neighbours, blacklists - which is why a brand-new legitimate shop is marked down for its registration date and an aged domain covered in fake timers is not. This reads the page: 27 rules on contact route, privacy policy, terms, published address, identity markup and payment security. It holds no WHOIS, blacklist or reputation data at all, so the two answer different halves of the question.

  • Checked after the scripts have run

    Countdown widgets, scarcity badges and trust seals are usually injected by JavaScript, so anything reading the raw response body never sees them. The page is rendered in a real browser first and the dark-pattern rules run against the resulting DOM - the page as a buyer meets it, not as the server sent it.

  • You can see exactly what was matched

    Several of these rules are class and attribute heuristics - [class*='countdown'], img[src*='trust-badge'] - so they catch conventional implementations and miss bespoke ones. Every finding prints the selector it matched and the count it found, so you can check the reasoning rather than accept a number. Signals too ambiguous to judge, such as hidden inline content, are reported for review and excluded from the score entirely.

This check runs on its own here, and as part of the full audit alongside the other 985 rules. Either way the findings carry their evidence and their citation, and the report is never published or kept.

How to make your site look legitimate

Trust signals are what separates a real business from a template. Each one is small; their absence, collectively, is what makes a visitor hesitate at checkout.

  1. Publish a real postal address, a working phone number and a monitored email address on a contact page a visitor can reach in one click.

  2. Serve every page over HTTPS with a valid, unexpired certificate and no mixed content.

  3. Add an about page naming the people or company behind the site, with a company or registration number if you have one.

  4. Publish clear privacy, terms and — if you sell anything — refund and delivery policies.

  5. Add Organization structured data with your real name, logo and contact details so the entity behind the site is machine-readable.

What happens when you run it

  1. Enter your address

    Just the domain is enough — example.com, with or without the https. No account, no card, no crawl of your whole site.

  2. We render it like a visitor

    Your page opens in a real browser and JavaScript runs to completion, so what gets audited is the page a person actually sees — not the raw HTML your server sent. A screenshot comes back with the report as evidence of exactly what we measured.

  3. You get findings you can act on

    Up to 986 checks run against that rendered page. Each finding names the rule, quotes the evidence found on your page, cites the public specification behind it, and says what to change. Nothing is a judgement call — run it twice on an unchanged page and the score is identical.

What runs this check

  • Real browser rendering
  • Live TLS handshake

Named because provenance is the product. Every finding in your report says which of these produced it, so you can check the reasoning rather than take a score on faith.

Questions

Can this tell me if a website is definitely a scam?
No, and no tool honestly can. It reports which trust signals are present and which are missing. A brand-new legitimate business often scores poorly; a well-funded fraud can score well. It is evidence for your own judgement, not a substitute for it.
What does it actually check?
Contact routes, privacy policy and terms, published physical address and identity, Organization markup, secure payment context, TLS certificate validity and hostname coverage, safe outbound links, plus dark patterns such as fake countdowns, fabricated scarcity and unverifiable trust seals.
Do you store the sites I check?
Your scan history is scoped to your own browser session and shown only to you. No scan report is published, and nothing you check appears in a public list.

Also checks

This page answers these searches too — they are the same job, so they share one page rather than being split across near-identical ones:

  • website validator scam detector
  • scam detector website
  • is this website legit
  • website legitimacy checker

Other checkers

Run the website scam detector now

No signup, no credit card. Quick answers in seconds; a full audit takes about a minute.

Run a free scan

No signup. No credit card. Nothing stored but the result.