AI & security
Website Scam Detector
The trust signals people and payment processors check before believing a site
This checks a site for the signals that separate a real business from a page built last week to take card details: is there a way to reach a human, is there a privacy policy and terms, is there a published address, does the certificate actually cover this hostname, and is the payment path served securely.
Try:
- Free, no signupNo account, no card
- No AI in the score986 deterministic rules
- Nothing publishedYour scans stay yours
- Answers in secondsQuick scan, no browser
It also looks for the patterns that consistently accompany fraudulent pages - countdown timers that reset on reload, fabricated scarcity ('12 people are viewing this'), trust badges that are flat images rather than links to a verifiable certificate, obfuscated links, and text hidden from humans but visible to crawlers.
Two honest limits. This is a signal check, not a verdict: a legitimate small business can be missing several of these, and a sophisticated fraud can pass them all. And it examines the page - it cannot tell you whether the company behind it will ship your order. Treat a low score as a reason to look harder, not as proof of anything.
Why this matters
How do you tell a real shop from a smart-looking one?
A convincing page is cheap to build. A template, a logo, a padlock in the address bar - none of it says a company is behind the checkout. The things that actually separate a real business from a page set up last week are small and easy to skip past: no way to reach a human, no address anyone could visit, a timer counting down that starts again when you reload. If the site is your own, those same gaps are what makes a first-time buyer hesitate with their card in their hand.
What it costs you when this is wrong
Card details posted in the clear
The padlock says nothing about where a form sends its data. A checkout or sign-in form whose action is an http:// URL transmits the card number or password in plain text, and the page looks identical either way. You find out from a chargeback, or from the day the browser starts blocking the submission outright.
Cautious buyers leave and never say why
No phone number, no postal address, no privacy policy: a first-time visitor has nothing to check before typing card details, so they close the tab. Nothing in your analytics separates that from a quiet day. It usually becomes visible later, when a payment provider or marketplace review asks for exactly those three things before the account can trade.
The urgency widget makes the shop look fake
A countdown that restarts on reload, and an "only 3 left" badge with no stock behind it, are two of the first things an experienced buyer uses to identify a fraudulent shop. They are usually added by a plugin, and nobody in the business ever sees the page fresh. Falsely claiming an offer is about to end is also a banned commercial practice under UK and EU consumer law, not a styling choice.
Why run it here
The page itself, not the domain record
A reputation score is built from domain-level signals - registration age, registrant privacy, server neighbours, blacklists - which is why a brand-new legitimate shop is marked down for its registration date and an aged domain covered in fake timers is not. This reads the page: 27 rules on contact route, privacy policy, terms, published address, identity markup and payment security. It holds no WHOIS, blacklist or reputation data at all, so the two answer different halves of the question.
Checked after the scripts have run
Countdown widgets, scarcity badges and trust seals are usually injected by JavaScript, so anything reading the raw response body never sees them. The page is rendered in a real browser first and the dark-pattern rules run against the resulting DOM - the page as a buyer meets it, not as the server sent it.
You can see exactly what was matched
Several of these rules are class and attribute heuristics - [class*='countdown'], img[src*='trust-badge'] - so they catch conventional implementations and miss bespoke ones. Every finding prints the selector it matched and the count it found, so you can check the reasoning rather than accept a number. Signals too ambiguous to judge, such as hidden inline content, are reported for review and excluded from the score entirely.
This check runs on its own here, and as part of the full audit alongside the other 985 rules. Either way the findings carry their evidence and their citation, and the report is never published or kept.
How to make your site look legitimate
Trust signals are what separates a real business from a template. Each one is small; their absence, collectively, is what makes a visitor hesitate at checkout.
Publish a real postal address, a working phone number and a monitored email address on a contact page a visitor can reach in one click.
Serve every page over HTTPS with a valid, unexpired certificate and no mixed content.
Add an about page naming the people or company behind the site, with a company or registration number if you have one.
Publish clear privacy, terms and — if you sell anything — refund and delivery policies.
Add Organization structured data with your real name, logo and contact details so the entity behind the site is machine-readable.
What happens when you run it
Enter your address
Just the domain is enough — example.com, with or without the https. No account, no card, no crawl of your whole site.
We render it like a visitor
Your page opens in a real browser and JavaScript runs to completion, so what gets audited is the page a person actually sees — not the raw HTML your server sent. A screenshot comes back with the report as evidence of exactly what we measured.
You get findings you can act on
Up to 986 checks run against that rendered page. Each finding names the rule, quotes the evidence found on your page, cites the public specification behind it, and says what to change. Nothing is a judgement call — run it twice on an unchanged page and the score is identical.
What runs this check
- Real browser rendering
- Live TLS handshake
Named because provenance is the product. Every finding in your report says which of these produced it, so you can check the reasoning rather than take a score on faith.
Questions
- Can this tell me if a website is definitely a scam?
- No, and no tool honestly can. It reports which trust signals are present and which are missing. A brand-new legitimate business often scores poorly; a well-funded fraud can score well. It is evidence for your own judgement, not a substitute for it.
- What does it actually check?
- Contact routes, privacy policy and terms, published physical address and identity, Organization markup, secure payment context, TLS certificate validity and hostname coverage, safe outbound links, plus dark patterns such as fake countdowns, fabricated scarcity and unverifiable trust seals.
- Do you store the sites I check?
- Your scan history is scoped to your own browser session and shown only to you. No scan report is published, and nothing you check appears in a public list.
Also checks
This page answers these searches too — they are the same job, so they share one page rather than being split across near-identical ones:
- website validator scam detector
- scam detector website
- is this website legit
- website legitimacy checker
Other checkers
- HTML ValidatorW3C markup conformance, checked by a real parser
- CSS ValidatorStylesheets parsed and checked against the W3C property grammars
- Schema Markup ValidatorJSON-LD parsed, expanded to real schema.org IRIs, and checked
- Rich Results TestWhich search features your structured data qualifies for
- AI ValidatorWhether AI models can find, read, quote and operate your site
- Broken Link CheckerEvery link on the page requested, with blocked and broken told apart
- SEO CheckerTitles, meta, canonicals, indexability and internal linking
- Accessibility CheckerTwo WCAG engines — one in a real browser, one on your markup
- Security Headers CheckerResponse headers, CSP quality, and the TLS certificate underneath
- Core Web Vitals CheckerMeasured for real, plus the page-weight causes behind the numbers
- AI Agent Readiness CheckerCan an agent find your buttons, read your labels and finish the task
- W3C ValidatorMarkup and stylesheet conformance in one pass
- Answer Engine CheckerWhether AI answer engines can quote you, and attribute it
- AI Crawler CheckerWhich AI crawlers your robots.txt actually lets in
- SSL Certificate CheckerA real handshake: certificate, expiry, protocol and cipher
- robots.txt CheckerWhat your robots.txt actually allows, group by group
- Meta Tag CheckerTitles, descriptions, canonicals and robots directives
- Open Graph CheckerHow your link looks when someone shares it
- Image SEO CheckerAlt text, dimensions, formats and lazy loading
- Mobile-Friendly TestViewport, tap targets and responsive behaviour
- Website CheckerEvery module, one scan, one prioritised fix list
Run the website scam detector now
No signup, no credit card. Quick answers in seconds; a full audit takes about a minute.
Run a free scanNo signup. No credit card. Nothing stored but the result.