Not all trust signals are created equal. Some are meaningful, some are theatrical, and some are actively misleading. Here's an evidence-based ranking of what to check.
“Look for the padlock.” “Check for trust badges.” “Read the reviews.” “See if they have a privacy policy.”
You’ve heard this advice a hundred times. But have you ever stopped to ask: which of these signals actually predict whether a website is trustworthy?
The answer is more nuanced than most safety guides suggest. Some trust signals are reliable indicators. Others are security theater — present on legitimate sites but trivially easy for scammers to fake. And a few are actually inverted: their absence is more informative than their presence.
This article ranks the most commonly cited website trust signals by how useful they actually are, based on how hard they are to fake and how well they correlate with legitimate operations.
These signals require significant resources, time, or identity verification to obtain. They’re hard to fake and strongly correlate with legitimate websites.
A domain registered 8 years ago that has hosted consistent content throughout its lifetime is very different from a domain registered last week. Domain age is one of the hardest things for a scammer to fake — they can’t go back in time.
Why it matters: Scam operations are ephemeral. They register, exploit, and abandon domains quickly. The average phishing domain is detected and blocked within 24-48 hours. A domain that’s been continuously operational for years has survived that gauntlet.
How to check: Use WHOIS lookup tools. Look for the creation date. Also check the Wayback Machine to see if the site has hosted consistent content over time.
Caveat: Some scammers buy aged domains (previously used for other purposes) to inherit their history. Always cross-reference with content history.
Properly configured DNS records — SPF, DKIM, DMARC, MX, TXT records — indicate that someone has invested time in setting up the domain’s email infrastructure correctly. This is boring, technical work that scammers rarely bother with.
Why it matters: Legitimate businesses set up email authentication to ensure their emails reach customers. Scammers who send phishing emails don’t need their domain’s email infrastructure to be properly configured — they send through other channels.
How to check: Use DNS lookup tools to check for SPF and DMARC records. Their presence doesn’t guarantee legitimacy, but their absence on a business site is suspicious.
If a website claims to be operated by a company, that company should exist in public business registries. This is verifiable, hard to fake, and a strong indicator of legitimacy.
Why it matters: Registering a business requires identity verification, a physical address, and in most jurisdictions, ongoing compliance. Scammers can register shell companies, but this adds cost, complexity, and a paper trail.
How to check:
Caveat: Business registration confirms the company exists, not that the website is operated by that company. Cross-reference the business name and address against the website.
A legitimate business has a digital footprint beyond its own website: social media accounts, mentions in news articles, reviews on independent platforms, listings in business directories, and references from other legitimate sites.
Why it matters: Building a genuine external presence takes time and organic growth. Scammers can create social media accounts instantly, but those accounts will have low engagement, recent creation dates, and few followers from the target audience.
How to check: Google the company name. Look for mentions on LinkedIn, Crunchbase, industry directories, and news sites. Check social media accounts for real engagement (comments, interactions, content history), not just follower counts.
These signals are meaningful but either easier to fake or less consistently present on legitimate sites. Use them as supporting evidence, not standalone proof.
Having these legal pages is expected for any legitimate business website. But their presence is low-signal because:
How to use this signal: Don’t just check for presence — check for specificity. A real privacy policy references the actual data collection practices of the site (what data, why, how long, who has access). A copied template will be generic and may reference features the site doesn’t have.
A physical address, phone number, and email address. More complete is better.
How to use this signal:
Red flags: No contact information at all. Only a web form. Address that resolves to a virtual office or coworking space when the company claims to be a large operation.
Real businesses produce content over time — blog posts, documentation, help articles, case studies. The depth and history of this content is a trust signal.
How to use this signal:
Red flags: All content published in the same week. Content that reads like it was generated to fill space rather than serve customers. No help documentation or FAQ that addresses real customer questions.
HTTP security headers (HSTS, X-Frame-Options, Content-Security-Policy, X-Content-Type-Options) indicate that the site’s operators have configured their server with security best practices.
How to use this signal: Use a security scanner to check response headers. Their presence suggests technical competence and attention to security. Their absence doesn’t prove the site is a scam, but it suggests the operators either lack technical expertise or don’t prioritize security.
These are the signals most commonly cited in safety advice, but they’re nearly useless for distinguishing legitimate sites from scams because they’re trivially easy to fake.
As covered in detail in our separate guide, HTTPS is free, instant, and universal. Every phishing site has it. Its presence tells you nothing about trustworthiness.
Verdict: Necessary but not sufficient. Treat as baseline infrastructure, not a trust signal.
“Verified by Visa,” “McAfee Secure,” “Norton Secured,” “BBB Accredited,” “Trustpilot 5 Stars” — these badges are displayed prominently on many sites. But most of them are either:
How to use this signal: Don’t trust the badge image. If a badge links to a verification page on the issuer’s site, click it and verify. Many fake badges either don’t link anywhere or link to a self-hosted page designed to look official.
Facebook, Twitter, Instagram, LinkedIn icons in the footer are expected on modern sites. Scammers include them too.
How to use this signal: Click through. Do the social media accounts exist? Do they have real engagement? Were they created recently? Icons that link to nonexistent accounts or empty profiles are red flags.
Quotes from “satisfied customers” displayed on the company’s own website. These are entirely self-curated and provide zero independent verification.
How to use this signal: Ignore them entirely unless they link to verifiable external profiles or third-party review platforms. Even then, check whether those external reviews are themselves legitimate.
Logos of CNN, Forbes, TechCrunch, etc. displayed with text like “As seen in.” On legitimate sites, these sometimes link to actual articles. On scam sites, they’re just logo images.
How to use this signal: Click the logos. If they link to real articles on the media outlet’s site that actually mention the company, that’s meaningful. If they’re just images, ignore them.
Sometimes the absence of a signal is more telling than its presence. These are things that legitimate sites have and scam sites often don’t bother with.
If a business website has no physical address anywhere — not in the footer, not on the contact page, not in the Terms of Service — that’s more informative than having one (which could be fake). Legitimate businesses have locations. The complete absence of any location information is a red flag.
If a product or service has hundreds of reviews and they’re all 5-star with zero criticism, that’s suspicious. Real businesses have dissatisfied customers. Perfect ratings across hundreds of reviews often indicate review manipulation.
E-commerce sites that sell products but have no return policy, refund policy, or shipping information. Legitimate stores provide this because consumer protection laws require it. Scam stores omit it because they never intend to process returns.
No single trust signal is conclusive. The key is to combine multiple signals and look for consistency.
The consistency test: Legitimate websites have a consistent identity across all signals. The business name on the site matches the business registry, which matches the social media profiles, which matches the domain registration, which matches the SSL certificate organization field. Scammers create consistency in the most visible layer (the website design) but often fail to maintain it across less visible layers (DNS, business registration, external presence).
The resource test: Ask yourself: “How much time and money would it take to fake all of these signals?” If the answer is “a lot,” the site is more likely legitimate. If the answer is “a few hours with free tools,” proceed with caution.
The negative evidence test: Instead of looking for positive signals (which scammers provide deliberately), look for the absence of negative signals. Run the site through a trust scanner. Check blacklist databases. Search for the domain plus “scam” or “fraud.” If nothing negative surfaces after thorough searching, that’s more reassuring than a dozen trust badges.
Most website safety advice is stuck in 2015. The padlock, trust badges, and on-site testimonials are all security theater in 2026. The signals that actually matter — domain history, DNS infrastructure, business registration, external presence, and content depth — require more effort to check but provide far more reliable signal.
The next time you need to assess whether an unfamiliar website deserves your trust, skip the badges and check the infrastructure. That’s where the real signal lives.
Disclaimer: This article is for educational purposes and does not constitute professional security or legal advice.
Check any website in 10 seconds
Paste a URL. Get a full trust audit — domain reputation, fraud signals, monetization analysis.
Run a free scan