To check if a website is safe, copy the full URL and look it up on known phishing and malware lists before you log in or pay. Then look at the domain spelling yourself. A padlock and a clean list result do not prove the site is legitimate — they only mean it is encrypted and not already on those lists. Last updated: August 2026.
You do not need a security degree to decide whether to trust a page. You need the real address, one list lookup, and a short list of human checks. That is the whole method.
As of 2026, more than 12 billion stolen credentials sit in known breach datasets. Verizon’s 2024 Data Breach Investigations Report again found stolen or guessed logins in a large share of web-application breaches. That is why fake login pages work: they harvest the password you already reuse.
How do you check if a website is safe in practice?
Work in this order. Skip the click until you have done the first two.
- Copy the real destination. Hover or long-press the link so you see the full URL, not the display text. Type the domain into your address bar if you meant to visit a company you already know.
- Look the URL up. Paste it into a website scam checker. We compare it with industry-standard phishing and malware lists. We do not visit the page as you.
- Read the domain out loud. One swapped letter, an extra hyphen, or a
.coinstead of.comis enough. Scam pages copy logos. They rarely copy the exact domain. - Ask why you are here. If an email, text, or pop-up created the urgency, slow down. Real companies do not need you to “verify in the next 10 minutes” from a random tab.
If the checker flags the address, stop. If it does not, keep the human checks. Lists lag.
What does a padlock actually tell you?
HTTPS and the padlock mean the traffic is encrypted between your browser and the server. That is good. It is also cheap. Criminals buy certificates the same way everyone else does.
Do not treat the padlock as a trust badge. Treat it as “this page is not sending your password in the clear.” You still have to decide whether that server should have your password at all.
What warning signs mean a website is not safe?
One sign can be a glitch. Several together mean leave.
- The domain is almost right.
paypa1.com,apple-support-id.net, extra words before the real brand. - The page demands a password or card out of the blue. You did not start a login. A message did.
- The English is rushed, the logo is fuzzy, or the design is a near-copy of a bank or shop you know.
- It asks for a one-time code, remote-access software, or crypto payment to “unlock” an account.
- Pop-ups claim your device is infected and a technician must connect. Close the tab. Real antivirus vendors do not hijack your browser.
If you already typed a password, change it on the real site from a bookmark, then check whether that password appears in known leak data.
Have the URL in front of you? Paste it in the free website checker → — no signup, we do not load the page as you.
Why do leaked emails make unsafe websites more dangerous?
Phishing is not random. After a data breach, attackers often have your address, and sometimes your name or old password. They send “your account was locked” notes that look personal because they already know who you are.
That is why a website check and an email check belong together. The link is one question. Whether your inbox is already on a target list is the other.
See if your email appeared in a known breach →
If a password was exposed, follow what to do if your password was leaked and the password reuse change checklist. Turn on two-factor authentication — or use 2FA and passkeys after a breach — so a harvested password is not enough. For the full list, read what to do after a data breach.
When is a clean checker result still not enough?
A clean result means the address is not on the lists we query right now. It does not mean:
- the shop will ship what it sold
- the login page is the real company
- a subdomain has not been hijacked
- the page will stay honest tomorrow
Brand-new scam shops, especially stores pushed in social ads, often have no list history yet. For those, the domain age, the reason you arrived, and whether you can pay with a method you can reverse matter more than a green label.
If you are trying to decide whether a business is real, read how to tell if a website is legit. That is a bigger question than a malware list.
What should you do after you check a website?
- Flagged: close it. Change any password you typed. Check email and password exposure. Do not call numbers on the page.
- Clean, but you were pushed there by a message: type the real domain yourself or use a bookmark. Then check if the email is a scam.
- Clean, and you typed the address yourself: still use a unique password and 2FA. A safe transport layer does not fix a reused login.
Major sites you already use can have old breaches even when today’s homepage is fine. If you are wondering about a service you have had for years, the breach directory and pages like LinkedIn explain what was exposed historically — that is a different question from “is this URL a phishing trap today.”