How to Tell if a Website Is Secure
A website is secure when the address starts with https, the certificate genuinely belongs to that exact domain, and the page does not ask you to do anything a real business would not. The padlock alone proves none of that. It only means the connection is encrypted, and criminals encrypt their connections too. The seven checks below take about two minutes and cover both halves: the technical connection and the behaviour of the site.
First, the padlock myth
For years people were told to "look for the padlock". That advice is now actively harmful. TLS certificates are free and issued automatically within minutes, so the overwhelming majority of phishing pages have one. A padlock on a fake banking login means your credentials are encrypted while they travel to the criminal who built it.
The padlock answers one narrow question: can someone sitting between you and the server read this traffic? It answers nothing about who owns the server. Treat HTTPS as a minimum requirement, never as a verdict.
The seven checks
1. Read the domain character by character
This catches more attacks than every other check combined. Look at the part immediately before the first single slash: in https://accounts.google.com.verify-login.net/ the real domain is verify-login.net, not Google. Watch for inserted words, hyphens, doubled letters, and swapped characters such as rn for m or a digit 0 for the letter O.
2. Confirm HTTPS is actually present
Not "the page loaded", but the address genuinely begins with https://. If your browser shows "Not secure", do not type anything into that page. You can confirm a certificate independently with our SSL certificate checker.
3. Open the certificate and check who it was issued to
Click the padlock, then the connection or certificate details. You want the certificate issued to the exact domain you are on, still inside its valid dates, and signed by a recognised authority. A certificate issued to a different domain is a red flag that no amount of professional design cancels out.
4. Never click through a certificate warning
Browser interstitials such as "Your connection is not private" exist for exactly this moment. On a site where you plan to log in or pay, that warning is the end of the conversation. Close the tab.
5. Check security headers
Headers such as HSTS, Content-Security-Policy and X-Frame-Options show that someone competent configured the server. Their absence is not proof of danger, but a payment site missing all of them is a site not being maintained by professionals. You can inspect them with our security headers checker.
6. Watch the behaviour, not just the technology
Secure sites do not force downloads, do not open a chain of pop-ups, and do not demand a password on a page you reached from an unexpected email. If a page pressures you with a countdown or claims your account will be closed in minutes, that urgency is the attack.
7. Check the domain's age and reputation
A domain registered weeks ago that is already taking card payments deserves scepticism. Age and blacklist history are the fastest way to separate an established business from a disposable storefront. Our domain age checker and free website safety check cover both automatically.
Secure versus safe, side by side
| Question | "Secure" answers it? | What actually answers it |
|---|---|---|
| Can someone intercept my data? | Yes | HTTPS and a valid certificate |
| Is this the real company's site? | No | Exact domain spelling, official links |
| Will they deliver what I paid for? | No | Reputation, reviews, trading history |
| Is this a phishing page? | No | Domain check plus how you arrived at the page |
Frequently asked questions
How can you tell if a website is secure?
Confirm the address starts with https and the domain is spelled exactly right, then open the certificate details and check it was issued to that domain and has not expired. Then judge behaviour: no forced downloads, no password request on a page reached from an unsolicited message, no mismatch between link text and destination.
Does the padlock mean a website is safe?
No. The padlock means the connection is encrypted, nothing more. Certificates are free and issued in minutes, so most phishing pages have one. A padlock on a fake login page just means your password is encrypted on its way to a criminal.
What is the difference between a secure website and a safe website?
Secure describes the connection: is data encrypted in transit. Safe describes the operator: will this business take your money and deliver. A site can be perfectly secure and still be a scam.
How do I check a website's SSL certificate?
Click the padlock to the left of the address bar and open the connection or certificate details. Confirm it was issued to the exact domain you are on, is within its valid dates, and comes from a recognised certificate authority.
Is a website without HTTPS always dangerous?
Not always, but never enter data on one. Reading a plain page over http exposes only that you visited. The moment there is a login, payment or contact form, missing HTTPS means anyone on the same network can read what you submit.
Check any site automatically
Our scanner runs the technical half of this list for you, including certificate validity, security headers, domain age and blacklist history, and returns a 0 to 100 safety score with the reasoning shown.
Fraud analysts and cybersecurity researchers specializing in online scam detection, phishing analysis, and victim fund-recovery guidance. About our team →