How to Check if a Website Is Secure Before You Use It

The padlock icon in your browser bar means a site uses HTTPS. that traffic between your browser and the server is encrypted in transit. It does not mean the site is trustworthy, legitimate, or safe with your data. Phishing sites, malware distributors, and data-harvesting operations all use HTTPS. Checking a site's security requires seven checks beyond the padlock, most of which take under two minutes.

1. Verify the SSL Certificate

Click the padlock in your browser bar and select "Connection is secure" → "Certificate is valid." Check three things: the domain the certificate is issued to matches the site you are on exactly (a certificate for bank.example.com does not cover example-bank.com), the certificate has not expired, and the issuing authority is a recognised certificate authority (CA) such as Let's Encrypt, DigiCert, Sectigo, or GlobalSign.

Certificate types signal different levels of verification:

For any site handling financial transactions or sensitive data, an OV or EV certificate is more reassuring than a DV certificate alone. though a DV certificate from a reputable provider is still secure for data-in-transit purposes.

2. Check Security Headers

Security headers are HTTP response headers that tell your browser how to behave when loading the site. They protect against common attacks: cross-site scripting (XSS), clickjacking, and protocol downgrade attacks. You can check them without any technical knowledge using securityheaders.com. enter the URL and it grades the site instantly.

The key headers to look for:

A site with an A or A+ rating on securityheaders.com has implemented these correctly. A D or F rating on a site asking for your payment details is a significant warning sign. it suggests the developers have not prioritised basic security hardening.

Source: OWASP Secure Headers Project

3. Look Up the Domain Age and Registration

Phishing sites and scam operations rarely maintain a long-term presence. they spin up domains, harvest credentials, and disappear. A domain registered last week asking for your bank details is a serious red flag. Use a WHOIS lookup tool (whois.domaintools.com or the registrar's own lookup) to check when the domain was registered.

What to look for:

• Registration date: Legitimate businesses typically have domains registered months or years before the site you are visiting. A 2-week-old domain claiming to be an established bank is fraudulent.
• Registrant details: GDPR has made most registrant details private, so absence of a name is not suspicious. Absence of any contact information at all on the site itself is more concerning.
• Registrar: Bulk registrars (Namecheap, GoDaddy) are used by everyone from startups to scammers. A site using an obscure offshore registrar with a recent registration date warrants caution.

4. Check Against Reputation Databases

Several free tools aggregate reports of malicious sites, phishing pages, and known malware distributors. Run the URL through at least two:

• Google Safe Browsing: transparencyreport.google.com/safe-browsing/search. Google's own index of dangerous sites
• VirusTotal: virustotal.com. scans URLs against 80+ security engines simultaneously
• URLVoid: urlvoid.com. checks against multiple blacklists
• PhishTank: phishtank.com. community-reported phishing sites

A site flagged by even one engine on VirusTotal warrants extreme caution. A clean result does not guarantee safety. new phishing sites often evade detection for 24–72 hours after launch. but it rules out known-bad destinations.

For email links specifically: do not click directly. Copy the URL and paste it into VirusTotal first. Most credential-harvesting attacks arrive via email links to freshly registered sites that have not yet been flagged.

5. Verify Contact Information and Legal Pages

Legitimate businesses have verifiable contact information: a physical address, a phone number, a registered company number (in the UK, visible on Companies House). They have a privacy policy and terms of service. Scam sites typically have none of these, or have them copied from other sites with the company name swapped.

Check the company number if one is listed. In the UK, you can verify any registered company number instantly at find-and-update.company-information.service.gov.uk. A company claiming to be incorporated in the UK with a company number that does not appear in Companies House is fraudulent.

Run the company name and address through a search engine with the word "scam" or "review." Trustpilot, Reddit, and consumer protection forums often have reports about fraudulent operations before formal authorities do.

6. Inspect What the Site Loads

Open your browser's developer tools (F12 in Chrome, Firefox, Edge) and go to the Network tab. Reload the page and watch what loads. Legitimate sites load resources from their own domain and a small number of recognised third-party services (Google Analytics, payment processors, CDNs). A site loading scripts from dozens of unknown third-party domains is a warning sign. each of those scripts can read everything on the page, including form inputs.

Pay specific attention to the forms on login and checkout pages. Right-click and "Inspect element" on any password or card input field. The form's action attribute should point to the same domain you are on, not a third-party URL. A login form that submits to a different domain is a classic phishing indicator.

7. Check for Breach History

Before creating an account anywhere, check whether the site has appeared in known data breaches. Use haveibeenpwned.com. search your email address to see if it has appeared in breaches associated with specific services. The site also lists the largest known breaches by company.

A breach history does not mean a site is currently insecure. companies improve after breaches. What matters is how they responded: did they notify affected users promptly, reset passwords, implement two-factor authentication, and publish a post-mortem? A company that silently patched a breach and said nothing is more concerning than one that handled disclosure well.

For services that handle financial data, check the FCA register (register.fca.org.uk) to confirm they are authorised. Any company offering regulated financial services in the UK without FCA authorisation is operating illegally. and is not covered by the Financial Services Compensation Scheme if something goes wrong.

The Two-Minute Security Check

You do not need to run all seven checks every time. Use this triage based on risk:

The single most effective habit: use unique, strong passwords on every site so that a breach at one service cannot compromise others. A password manager generates and stores these automatically. you need to remember one master passphrase. The password generator and strength checker below can help you evaluate and create credentials that hold up even if a site you use is compromised.