How to Check If a Website Is Safe Before Visiting

Malicious websites are everywhere — phishing pages that steal login credentials, fake online stores that take your money and never deliver, sites that install malware through drive-by downloads, and scam sites that harvest personal information.

In 2025, it's estimated that over 1.5 million new phishing sites are created every month. Many of them look convincingly legitimate, with professional designs and realistic domain names. Taking 30 seconds to verify a website before entering any personal information can save you from identity theft, financial loss, and malware infections.

A valid SSL certificate (HTTPS padlock) is the minimum bar for any legitimate website. Use LookMyIP's SSL Checker at lookmyip.com/ssl to verify:

• Is the certificate valid? An expired or self-signed certificate is a red flag.
• Does it match the domain? A certificate for "example.com" on a site at "examp1e.com" indicates spoofing.
• Who issued it? Legitimate CAs include Let's Encrypt, DigiCert, Comodo, and GlobalSign. Unknown issuers are suspicious.
• What type is it? DV (Domain Validation) certificates prove nothing about the organization — they only prove someone controls the domain. EV/OV certificates require verified identity.

Important: HTTPS doesn't mean a site is trustworthy — it only means the connection is encrypted. Phishing sites increasingly use free SSL certificates to look legitimate. HTTPS is necessary but not sufficient.

Use LookMyIP's WHOIS Lookup at lookmyip.com/whois to check the domain's registration details:

Red flags to watch for:

• Very recent registration: A domain registered days or weeks ago claiming to be an established business is suspicious. Legitimate businesses have been around for years.
• Hidden registration: While privacy protection is common and legitimate, a suspicious site with hidden WHOIS data gives you no way to verify the operator.
• Short registration period: Scam sites often register domains for just one year (the minimum). Legitimate businesses typically register for multiple years.
• Mismatched registrar location: A site claiming to be a US company but registered through a registrar in a different country may warrant extra scrutiny.

Check the domain age and combine it with other signals. A 10-year-old domain is more likely legitimate than a 10-day-old domain.

Look up the website's IP address using LookMyIP to see:

• IP reputation: Use the IP Reputation Checker (lookmyip.com/reputation) to check if the hosting IP is flagged for malicious activity, is a known proxy or VPN endpoint, or is associated with hosting abuse.
• Blacklist status: Use the Blacklist Checker (lookmyip.com/blacklist) to see if the IP is listed on spam or abuse blacklists.
• Hosting provider: Check what company hosts the site. Legitimate businesses typically use reputable hosting providers (AWS, Google Cloud, Cloudflare, etc.), while some cheap hosting providers are known for tolerating abuse.
• Geolocation mismatch: A site claiming to be a local UK business but hosted on servers in an unrelated country could be suspicious.

These checks alone don't prove a site is malicious, but combined with other signals, they help build a picture.

Before entering personal information or making a purchase on an unfamiliar website, run through this checklist:

• Does the URL look correct? Watch for typosquatting (amazom.com, paypa1.com)
• Does it have a valid SSL certificate? (Check with LookMyIP's SSL Checker)
• How old is the domain? (Check with WHOIS Lookup)
• Does the site have a physical address, phone number, and contact page?
• Are there reviews of this business on independent sites (Trustpilot, BBB)?
• Does the content have grammar errors, stock photos, and generic text?
• Is the deal too good to be true?
• Are they pressuring you with fake urgency ("Only 2 left!" "Sale ends in 5 minutes!")?
• Do they accept standard payment methods (credit card, PayPal) or only wire transfer/crypto?
• Can you find the company on social media with a real following and history?

If multiple items raise concerns, err on the side of caution and don't proceed.

Most fraudulent links are identifiable from the URL alone, provided you know where to look. The critical skill is finding the registrable domain — the part that actually determines who controls the site.

Read a URL right to left from the first single slash. Everything before that slash is the hostname; the last two labels of the hostname (or three, for suffixes like .co.uk) are the registrable domain. Nothing to the left of it, and nothing after the slash, tells you who owns the site.

Apply that to some real patterns:

https://paypal.com.secure-login.example/verify
→ registrable domain is secure-login.example. Not PayPal.

https://example.com/paypal.com/login
→ registrable domain is example.com. The path is decoration.

https://paypal.secure-billing.example/
→ registrable domain is secure-billing.example. Not PayPal.

https://accounts.google.com/signin
→ registrable domain is google.com. Genuine.

The attacker's technique is always the same: place the brand name somewhere that looks authoritative but is not the registrable domain.

Three further tricks are worth recognising.

Homograph attacks use characters that render identically to Latin ones — Cyrillic "а" (U+0430) is visually indistinguishable from Latin "a". Browsers defend by displaying such domains in Punycode (xn--pypal-4ve.com), but the defence is imperfect across scripts. If a domain looks right but the link behaves oddly, copy it into a text editor and inspect it.

Typosquatting relies on a single character: goggle.com, arnazon.com (r-n rather than m), micros0ft.com.

Subdomain takeover produces genuinely dangerous links, because the domain really does belong to the organisation. A forgotten CNAME pointing at a decommissioned cloud service can be claimed by anyone who registers that service name, giving an attacker a legitimate subdomain with a valid certificate.

Check anything suspicious with the WHOIS lookup — a registrable domain created eleven days ago, claiming to be an established brand, settles the question.

The padlock is the most misunderstood security indicator on the internet, and the misunderstanding is actively exploited.

What HTTPS proves: the connection is encrypted, and the site presenting the certificate controls the domain name in the address bar.

What it does not prove: that the site is honest, that the business is real, that your data will be handled properly, or that the domain is the one you meant to visit.

Certificates are free and issued in seconds through automated validation. A phishing site gets one as easily as a bank does — by the usual estimates, the large majority of phishing sites now use HTTPS, precisely because users were taught to look for the padlock. Advice to "check for the padlock" is now closer to harmful than helpful, because it converts a meaningless signal into reassurance.

What the certificate *can* tell you, if you inspect it rather than glancing at the icon:

Age. A certificate issued four days ago for a site claiming to be an established retailer is a strong signal. Check with the SSL certificate checker.

Validation level. Domain Validated certificates prove control of the domain only. Organisation Validated and Extended Validation certificates involve verifying a real legal entity, which is meaningfully harder to obtain fraudulently. Browsers no longer display the distinction, so you must open the certificate to see it.

The SAN list. A certificate covering fifty unrelated hostnames suggests shared infrastructure, which is normal for a CDN and suspicious for a bank.

Certificate Transparency history. Every publicly trusted certificate is logged. Searching crt.sh for a domain shows every certificate ever issued for it and when — which reveals whether the domain has a long history or appeared last week.

The reliable inference is one-directional: no HTTPS means do not enter anything. HTTPS present means nothing on its own.

The safest inspection is one that does not load the page. Several checks work entirely from outside.

Reputation and blocklists. Google Safe Browsing, which powers the interstitial warnings in Chrome, Firefox and Safari, can be queried through the Transparency Report. VirusTotal aggregates roughly seventy engines and covers both URLs and the hosting IP. URLVoid and Sucuri SiteCheck cover overlapping ground.

Domain age and registration. A WHOIS lookup gives the creation date, registrar and nameservers. Domains under 30 days old used for anything transactional deserve strong suspicion. Privacy redaction is normal and not itself a red flag — most legitimate small sites use it.

Hosting reputation. Resolve the domain and check the address with the IP reputation checker and the blacklist checker. A site hosted on an address with active abuse reports is a meaningful signal, though shared hosting means the reports may belong to a neighbour.

Redirect chain. Shortened and tracking links hide their destination. Trace them without following in a browser using the redirect checker, or:

curl -sIL https://short.example/abc | grep -i '^location:'

Response headers. The header checker reveals the server software, security header posture and hosting platform. Absent security headers on a site handling payments is a sign of general carelessness.

DNS history. Passive DNS services show whether a domain has pointed at many different addresses recently, which is characteristic of fast-flux hosting.

For actually opening something questionable, use an isolated environment: a virtual machine, a disposable browser profile, or a service like urlscan.io which loads the page in a sandbox and returns screenshots, the full request chain and any resources loaded. That last option is usually the right answer — you get to see the page without the page seeing you.

Is a site safe if it has a padlock and no browser warning?

No. The padlock proves encryption, not honesty, and browser warnings only fire for sites already reported to Safe Browsing — which by definition excludes anything new. Phishing campaigns are typically short-lived precisely to stay ahead of blocklists.

I entered my password on a suspicious site. What now?

Change that password immediately, starting with the real site. Change it anywhere else you reused it, which is the part that causes the most damage. Enable two-factor authentication if it is not already on. Check the account's active sessions and sign out of all of them, and review recent activity. If it was a financial account, contact the provider directly using a number from your card, not from any email.

Are URL shorteners safe?

They are neutral, but they hide the destination, which is why phishing uses them heavily. Expand before clicking with the redirect checker or by appending + to a bit.ly link to see its preview page.

How can I tell if an online shop is legitimate?

Domain age is the strongest single indicator. Then: does a physical address and phone number exist and check out; are prices implausibly low; is the only payment option a bank transfer, gift card or cryptocurrency; is the returns policy specific or boilerplate; do reviews appear on independent sites rather than only on the shop itself. Reverse image search on product photos frequently reveals them lifted from a legitimate retailer.

Does antivirus catch malicious websites?

Partially. Most suites include web filtering that blocks known-bad domains, which is the same reactive model as Safe Browsing and has the same gap for new sites. It is a useful layer and not a substitute for reading the URL.