People reach for a scammer website checker, or a legit website checker, when something feels off. It might be a shop they have never used, a payment page that arrived from a message, or a link they simply want to know is safe before they type a card number. That instinct is right. What a checker cannot do is issue a final verdict that a business is honest.
A practical check is a set of public signals: the web address, the domain record, the TLS certificate, public reputation lists, company details, reviews, and the way the site asks you to pay. Several weak signals together are a reason to stop. A single clean signal, including a padlock in the address bar, is not a reason to trust the site.
We build HackerMe, a free outside-in website security scanner. The product notes later in this article are for a domain you own or have explicit permission to test. If you are trying to decide whether a stranger's shop is a scam, start with the checklist below. Do not run a vulnerability scan against a site you do not control.
Look at the address before you trust the page
The first job of any check is to confirm that you are on the site you think you are on. CISA's guidance on accessing websites securely tells people to inspect the URL for slight misspellings or the wrong domain ending. Its own example is a spoof of cisa.gov that might use cesa.gov, or a .com in place of .gov.
Look at the registrable domain, not only the start of the address. A page that looks like checkout.brandname.example-payments.net belongs to example-payments.net, not to the brand in the subdomain. Extra words, hyphens, and lookalike characters are common tricks. If the link arrived in a message, do not rely on the visible text of the link. CISA's phishing advice is to treat untrusted shortened URLs as a warning, and not to click a link in a suspicious message at all. Search for the company and type the official address yourself, or find another way to contact them.
Some real sites also contain open redirects that send a visitor onward to a third-party URL. A familiar domain in the first part of a long link is not proof that the destination is the same organisation.
Check the domain record and the age of the name
Open the domain in ICANN Lookup. This is the official lookup service for registration data. You are looking for a registration or updated date, the registrar, and the name servers, and for whether those facts fit the story the website tells.
A brand-new domain is not automatically a scam, and an older domain is not automatically safe. What matters is the mismatch. A site that claims to be a long-established retailer, bank, or government office, but was registered days ago, is a reason to stop and verify the organisation another way.
Many records now hide the registrant's personal contact details. That is often a privacy service, not a cover-up, so a redacted WHOIS record is not, on its own, evidence of fraud. Thin public data just means you should put more weight on the other checks in this guide.
Read the certificate, not only the padlock
A site that asks for a password or a payment should use HTTPS. The UK government's Stop Think Fraud guidance says that if there is no padlock and no https in the address bar, or if the browser says the connection is not secure, you should not use the site. CISA gives the same baseline: prefer https://, and do not ignore browser warnings about an insecure connection.
Then go one step further than the lock icon. CISA's advice is to select the padlock next to the URL and check that the certificate is not expired, that it was issued by a legitimate certificate authority, and that it was issued to the person or organisation that owns the website. In its shopping guidance, CISA also warns that attackers may obtain a certificate for a malicious site to appear more authentic, and that you should review the “issued to” information. Some attackers place a fake padlock graphic on the page itself, so use the browser's own control in the address bar, not an icon in the page content.
Stop Think Fraud is explicit about the limit: a closed padlock and https mean the connection is encrypted. They do not guarantee that the website is legitimate or reputable. Which is safer, HTTP or HTTPS? explains that distinction in more detail. Encryption does not prove that the shop behind the certificate is the business it claims to be.
Check public reputation lists
For a reputation check, use a public list that publishes how it works. CISA recommends Google Safe Browsing when you cannot verify a certificate yourself. Google's Site Status tool, part of the Safe Browsing Transparency Report, lets you look up whether Safe Browsing currently treats a site as dangerous.
Use the result as one input, not as a verdict. A warning is a reason to stop. A clean result only means this particular list has not currently classified the site as dangerous. A newly built scam site may not be listed yet, and Safe Browsing is aimed at malware, phishing, and similar web threats, not at every kind of bad business practice. HackerMe does not run a public malware or blacklist check, so it is not a substitute for this lookup.
Look for real company and contact details
Stop Think Fraud flags sites with very little information on “About us” or “Contact us” pages, and sites that have no returns policy, privacy policy, or other terms. CISA's shopping guidance says that before you give personal or financial information you should verify that you are dealing with a reputable, established vendor, and that you should note phone numbers and physical addresses in case a transaction goes wrong.
Do that verification off the page you already distrust. A contact number or chat widget that lives only on the suspicious site can be part of the pitch. CISA's phishing guidance is to look up the company another way: go to a verified site you found yourself, or use a channel you already know. Policies copied in generic language, with no company name or no way to exercise a stated return or privacy right, should be treated as decoration rather than as protection.
Read reviews in more than one place
Stop Think Fraud recommends checking reviews on several sites, and names examples such as Trustpilot, Feefo, and Sitejabber. That advice is useful because testimonials hosted only on the site you are investigating are the easiest kind to invent.
Look for a pattern across sources, and pay attention to recent, specific accounts of delivery, refunds, and customer service, not only to a star rating. If you cannot find any independent discussion of a shop that claims a large catalogue and aggressive discounts, treat that absence as a warning.
Watch the payment request
Stop Think Fraud lists two payment-related warning signs that often appear together: bargain prices on high-value items, or investment returns that look too good, especially when the language is designed to hurry you; and a request to pay by bank transfer instead of a credit card, a debit card, or a trusted third-party payment provider.
CISA recommends using a credit card for online purchases where you can, because legal limits on liability for fraudulent credit-card charges are often stronger than the protection attached to a debit card. It also warns people not to send sensitive information by email, and not to use a link in an unsolicited payment message. Type the official site yourself if you need to check an order.
If a site refuses card or well-known checkout tools, insists on a bank transfer, and pressures you to decide immediately, stop. Stop Think Fraud notes that artificial intelligence can now help criminals produce professional layouts and graphics, so a tidy design is not evidence that the shop is real.
Notice ordinary phishing signs
CISA's phishing guidance lists urgent or emotionally loaded language, especially threats of dire consequences if you do not act at once; requests for personal or financial information; untrusted shortened URLs; and addresses or links that are slightly wrong. Poor spelling used to be a reliable tell, but CISA notes that AI-written messages may now be grammatically clean, so the other signs matter more.
If the page arrived from a message, follow that same advice: do not click the link, do not call the number in the message, and do not reply. Find the organisation independently. Delete the message rather than using an “unsubscribe” link you do not trust.
If a site you already use starts to look wrong
The checklist above is for a site you do not yet trust. If it is your own website, and customers are reporting odd pages, unexpected redirects, or browser warnings, the site may have been changed without your permission. See how to tell if your website has been hacked and work from a copy of the logs and files rather than guessing in the live admin panel. If it is a vendor you already use, contact them through a channel you already have, not through the new link that caused the doubt.
What HackerMe's free outside-in scan actually checks
We build HackerMe. If you run a website and want an outside view of the same class of technical signals a careful visitor cares about, you can run the HackerMe scammer website checker on a domain you own or have explicit permission to test. That wording is a search phrase, not a promise. The scan does not declare a business legitimate or fraudulent.
The free Quick engine, as listed on HackerMe's pricing page on 13 November 2026, is an unauthenticated outside-in scan. The public engine card lists security headers, SSL/TLS, port scanning, and known CVEs. The same page's module table also includes, on that free engine, exposed sensitive files and DNS records, among other outside-in checks. A typical use is to see whether your own site presents a current certificate, sends basic security headers, or has left a sensitive file reachable from the public internet.
Two limits matter if you arrived here looking for a legit website checker. The report is not a scam verdict, and a site can have a valid certificate and still be run to take money and disappear. SPF, DKIM, and DMARC checks are listed on the EASM engine, not on Quick. The public pricing page does not list malware scanning or public-blacklist lookups; use Safe Browsing or another public list for those questions. A free website security scan is a useful extra for a site you are allowed to test. It is not a licence to probe a stranger's shop, and it is not a guarantee that your own site is safe.
How to decide
Walk away, or at least do not pay or sign in, when several of these are true: the address does not match the organisation you intended to reach; the browser will not show a trusted HTTPS connection on a payment or login page; Safe Browsing warns you; the domain age or certificate identity clashes with the story on the page; you cannot confirm a real company through an independent channel; or you are being hurried into a bank transfer or another payment method with little protection. If the signals are mixed, type a known official address, use a number you already trust, or wait. A scammer website checker is most useful when it helps you stop in time, not when it produces a score you then have to believe.
