How to Check If a Website Is Legit or Fake: 12-Point Checklist
By Ashish Pratap · Oct 4, 2026 · 6 min read
A professional-looking website takes a scammer less than an hour to build. Templates are free, product photos can be copied from real brands, and a padlock icon costs nothing. That is why "it looks genuine" is no longer a safe test. The good news: fake websites almost always leave the same clues. This guide gives you a 12-point checklist you can run on any website in a few minutes - before you pay, sign up or type in your card details.
Why fake websites are so convincing
Most fraudulent sites are not built by experts. They are copied. A scammer registers a cheap new domain, installs a ready-made shop template, copies photos and descriptions from a real brand, and runs paid social-media ads with "70% off" or "clearance sale" banners. The site works just long enough to collect payments, then disappears and comes back under a new name.
Because they are temporary, these sites share technical and business patterns you can check - even if you are not technical.
The 12-point website legitimacy checklist
1. How old is the domain?
This is the single most useful signal. Fake shops are usually registered days or weeks before they start advertising. Run the address through the free Domain Age Checker or the WHOIS lookup. A store claiming "serving customers since 2010" on a domain registered last month is a serious red flag. A young domain is not proof of fraud - new businesses start every day - but it means you should check everything else more carefully.
2. Check the exact spelling of the address
Look for extra letters, swapped characters or added words: amaz0n-sale.shop, flipkart-offers.online, brandname-india-outlet.store. Scammers rely on you reading quickly. Type well-known brand websites yourself instead of clicking links in ads, SMS or WhatsApp messages.
3. The padlock (SSL) is necessary - but not enough
The padlock only means the connection is encrypted. Free certificates are issued in minutes to anyone, including scammers. Never enter payment details on a site without a padlock, but do not treat the padlock as proof of honesty. You can view the certificate details with the SSL Certificate Checker.
4. Is there a real address, phone number and email?
A genuine business tells you who it is. Look for a registered business name, a physical address, a phone number that actually connects, and an email address on the company's own domain (not only a Gmail address). Be cautious if the only way to reach the seller is a WhatsApp number or a contact form.
5. Read the returns, refund and shipping policies
Fake shops often copy policies from other websites - you may see a different company name, a foreign address or a currency that does not match. Missing, vague or copy-pasted policies are a strong warning sign.
6. Are the prices too good to be true?
Branded shoes for 80% off, new iPhones at half price, every product "sale ends in 10 minutes" - unrealistic discounts and countdown timers are pressure tactics. Compare the price with the brand's official website and two or three well-known marketplaces.
7. Which payment methods are offered?
Be very careful when a site offers only UPI to a personal ID, bank transfer, or a QR code sent on chat - and no cash on delivery or card payment through a known payment gateway. Card payments and established gateways give you a way to raise a dispute; a direct transfer to a stranger usually does not.
8. Search for independent reviews
Search the website name with words like review, complaint or scam. Ignore testimonials shown on the site itself - those are easy to fake. Look for reviews on independent platforms and consumer forums. No reviews at all for a shop that claims thousands of customers is itself a warning sign.
9. Look at the quality of the content
Spelling mistakes, mixed brand names, product photos with other shops' watermarks, and "About us" pages full of generic text ("We are a leading company committed to quality") are typical of template-built fake sites.
10. Check the social media links
Click the social icons. Do they go to real, active profiles with a history of posts and genuine customer comments - or to nothing, or to a page created last week with comments turned off?
11. Does the email setup look real?
Businesses that have been around for a while usually send email from their own domain with proper email authentication. A domain that cannot even receive email (no MX records) is unusual for a real shop. The Email Security Summary shows this in seconds.
12. Trust your instincts about pressure
"Only 2 left", "offer valid for 5 minutes", "pay now to confirm your order or it will be cancelled" - genuine shops rarely push this hard. Pressure is designed to stop you from doing exactly the checks on this list.
Run all of these checks in one go
Paste any shop or website address into JustChecker's free Website Trust Checker. In a few seconds you get a trust score with the reasons behind it - domain age, SSL certificate, email setup and whether the site shows real contact, privacy and returns information.
A typical example
Illustrative example based on commonly reported cases - names and details changed.
Rahul saw an Instagram ad for a well-known sneaker brand at 75% off. The website looked professional, had a padlock and showed hundreds of five-star reviews. At checkout, card payment "failed" and the site asked him to pay ₹3,200 by UPI instead. The shoes never arrived, the phone number was switched off, and two weeks later the website no longer existed. Looking back, three checks would have saved him: the domain was 9 days old, the only payment option that "worked" was UPI to an individual, and the reviews existed only on the website itself.
What to do if you think a website is fake
- Do not pay or share personal details. Close the page.
- If you already paid, call the National Cyber Crime Helpline 1930 immediately and report the transaction - the sooner you report, the better the chance of the money being stopped. Our step-by-step guide explains what to do after an online fraud.
- Report the ad on the platform where you saw it, so others do not see it.
Frequently asked questions
Is a website with HTTPS always safe?
No. HTTPS only means the connection is encrypted. It says nothing about who runs the website or whether they will deliver what you pay for.
Is a new website always a scam?
No - every business was new once. A new domain is a reason to check the other signals more carefully, not proof of fraud on its own.
Can I check a website without technical knowledge?
Yes. The Website Trust Checker runs the technical checks for you and explains each result in plain language.
What should I do if I find a scam website?
Do not engage with it, report it on cybercrime.gov.in, and report any ads for it on the platform where they appeared.
Related reading: how to spot fake online shopping websites and fake Instagram and Facebook shops.