To tell if a website is legit, inspect the domain, the payment method, and whether you can verify the company off the page — then paste the URL into a threat-list checker. A clean scan is not a legitimacy stamp. Last updated: August 2026.
“Is this website legit?” is bigger than “is it on a malware list?” Lists catch known traps. Legitimacy is whether you should give this business money or a password. You can get close enough to decide. You cannot get a guarantee.
Consumer agencies keep reporting large losses to online shopping and impostor scams through the mid-2020s. As of 2026, more than 12 billion stolen credentials are also in known breach data, which is why a “please verify your account” page can look personal even when the shop behind it is fake.
How do you tell if a website is legit before you pay?
Ask four questions. One no is enough to walk away.
- Whose domain is this? The brand should be the domain, not a subdirectory on a random host.
- How do I pay? Card or a well-known checkout you already use is easier to reverse than crypto, gift cards, or a wire.
- Can I find this company somewhere else? App store, bank you already have, or a registry entry that matches the About page.
- Is this URL already flagged? Check the website.
If you only needed the malware question, how to check if a website is safe is the narrower guide. If you already think it is a trap, is this website a scam lists the patterns.
Why is a padlock not proof a website is legit?
Encryption is standard. Scam shops buy it. The padlock answers “can someone on café Wi-Fi read this form?” It does not answer “will this seller ship the shoes?”
Same for privacy policies and stock photos of offices. Templates include them.
What payment and policy clues actually help?
- A return policy with a real process beats “all sales final” on a brand-new electronics shop.
- A VAT, company number, or registration you can look up helps in some countries. A number that 404s does not.
- Prices far below every authorised seller are not a loophole. They are the product.
Social ads can point to a different domain than the profile name. Always check the domain on the page where you enter the card.
First filter: Paste the URL in the website checker →
How do data breaches change the “is it legit?” question?
A real company can be legit today and still have an old breach. That does not make the homepage a phishing page. It does mean you should not reuse the password from that era.
Example: Yahoo remains a real service and also had historic exposure. Legitimacy of the company and safety of an old password are different questions. Check your email if a site is asking you to “re-verify” after a leak you already know about.
If you reused that login, what to do if a password leaked and the password reuse change checklist are the next pages, not another purchase. For the full cleanup, use what to do after a data breach and 2FA and passkeys after a breach.
What should you do if you are still unsure?
Do not pay to resolve the doubt. Delay the purchase. Use a platform with buyer protection you already understand. Type the real brand into your browser instead of the ad.
If a message created the urgency, treat it as email scam checking plus link checking first.
Uncertainty is a valid result. Scam pages are designed to remove it.
When is a website legit enough to use?
When you started the visit, the domain is the one you meant, payment is reversible, and the URL is not flagged. Still use a unique password and two-factor authentication. Legit sites get breached too.
No checker, including ours, can promise a shop will refund you. We report what known lists show, then you decide. That is the same honest limit as our email breach check: known records, plain next steps, no fake score.