← Guides

How to Check if a Website Is Real Before You Buy

We run automated trust checks on online stores and currently hold results for 10,502 of them (last recomputed 2026-08-10). That gives an unusual vantage point on this question: instead of repeating the standard checklist, we can measure how well each item on it actually separates one store from another.

The short version is that most of the popular advice does not discriminate. Below is what the data says, then a checklist of the things that do.

Three checks people rely on that barely work

1. “Look for the padlock”

Of the 10,413 stores where we could complete a TLS handshake, 99.4% presented a valid certificate. Certificates are free and automatic on every major platform, so the padlock tells you the connection is encrypted — nothing more. It says nothing about who is on the other end. A fraudulent store has one too.

2. “Check that it has a returns and shipping policy”

We could not find a returns policy on 64.14% of stores, or a shipping policy on 66.53%. Missing policy pages are the norm, not the exception — 2,259 stores (21.5%) published none of the four we look for. Treating that as a red flag would flag a large share of ordinary small shops.

A caveat we would rather state than hide: this measures what an automated checker can find. Some of these pages exist behind JavaScript, in checkout, or under names we do not recognise. Read these as a floor on what is published, not a count of what exists.

3. “See how old the domain is”

Domain age is the check most often cited, and it is weaker than its reputation. The median store we measured is 8.9 years old and only 2.68% are under a year — but the correlation between age and our overall trust score is just r = 0.144, which is very weak. Age is also frequently unavailable: 27.86% of domains (2,926 of 10,502) publish no creation date, because many country registries do not release one.

What actually discriminates

Check what the page code does, not what it claims

This is the check almost nobody performs and the hardest one to fake. Writing “trusted by 50,000 customers” costs nothing. But a “Sarah from Leeds just bought this” notice, a stock counter, or a countdown has to be implemented — and how it was implemented is visible in the code the site sends your browser.

Open developer tools, find the file behind the widget, and look at where its numbers come from. A genuine counter fetches from a server. A fabricated one looks like Math.floor(Math.random() * 40) + 5, or a hardcoded list of first names, or a countdown whose deadline is computed as Date.now() + 3600000 — meaning it restarts for every visitor and the “offer ends” claim is never true for anyone.

Worth knowing what this does not prove: plenty of honest shops run a real countdown to a real fixed date, and reading the clock is how any timer renders time remaining. The signal is the deadline being derived from your clock, not the timer existing.

Look for a record of the site that the site did not write

Everything on a storefront is authored by its owner. The useful question is whether anything independent has a record of it. The Internet Archive is the easiest check: paste the domain into web.archive.org and see how far back captures go and how continuous they are. A domain registered years ago but only captured twice is a different proposition from one captured every month since 2014.

When nothing external has any record — no archive history, no third-party reviews, no social accounts — that combination is itself the finding. It does not prove wrongdoing, but it means there is nothing to check the store's claims against.

Check for a real address and a working mail setup

A postal address is the single most-missing signal in our data: 81.86% of stores publish none. It is missing often enough that its absence is not damning on its own — but combined with no contact page (12.88% of stores) and no social presence (27.68%), you are looking at a business with no reachable human.

Pay with something that has recourse

This is the one that actually protects you, and it does not require judging the store at all. A credit card or a payment method with buyer protection gives you a dispute route. Bank transfer, crypto and gift cards do not.

A checklist worth using

1. Open the code behind any urgency or “someone just bought” widget and see whether its numbers come from a server or from Math.random().
2. Check the Internet Archive for how far back, and how continuously, the site has existed.
3. Look for something about the business written by someone other than the business.
4. Find a postal address and a contact route, and test that the contact route works.
5. Search the store's name with “refund” or “didn't arrive” rather than “reviews”, which surfaces its own marketing.
6. Pay by a method with buyer protection.

How we measured this

These figures come from automated checks on 10,502 independent online stores, last recomputed on 2026-08-10. Percentages are stated against the number of stores where the check completed, which is noted wherever it differs from 10,502.

This is not a random sample of all e-commerce. It is 85.43% WooCommerce, an artefact of how the domains were discovered rather than a fact about online stores generally, so platform-linked figures should not be read as industry averages. We also exclude any signal we could not fetch rather than scoring it as a failure — a check we could not complete is reported as unknown, never guessed.

Nothing here is a judgement about any particular business, and we do not label businesses as scams. See our methodology, or read the underlying data studies in Research.