10 ways to check if a website is safe or a scam

We’re constantly being directed to websites — from texts with appointment confirmation links or QR codes on parking signs. Because links are such a routine part of everyday lives, it's easy to do it without a second thought. But not all links are legit. Cybercriminals create fake, realistic-looking sites to trick you into handing over sensitive information, entering payment details, or clicking downloads that install malware.

And fake sites are getting even harder to detect. Scammers are increasingly using AI-powered web builders to create convincing phishing sites from simple prompts or screenshots. Our Threat Researchers have dubbed this new tactic VibeScams, because these sites pass the “vibe check,” perfectly mimicking the look, feel, and branding of trusted companies.

To highlight the scale of the threat, between January and the end of August 2025, Gen’s Cyber Safety products, including Norton 360, blocked about 140,000 unique AI-generated scam websites, averaging roughly 580 newly detected scam sites every day, according to our internal telemetry data.

Knowing what to look for is your first line of defense, so here’s exactly how to check if a website is safe.

1. Look for an SSL certificate

A Secure Sockets Layer (SSL) certificate is what encrypts the data exchanged between you and a site you visit. This helps protect sensitive information, such as passwords and payment details, from being intercepted in transit.

An SSL certificate is a basic security feature that legitimate websites are expected to have, so if one is missing, that’s a red flag. While a lack of encryption doesn't necessarily mean a site is fake, it does mean your connection is less secure.

Scammers can obtain free, valid SSL certificates for websites they control, and many do, as it makes their scams seem more trustworthy. But many others skip this step because their goal is to quickly launch large numbers of scam websites at scale — so the absence of an SSL certificate is still a strong warning sign, especially in combination with other red flags.

To check if a website has an SSL, look at the address bar when you visit a site:

• “https://” at the beginning of the URL signals encryption. The “s” stands for secure. Non-encrypted sites begin with “http://” (no “s”).
• A lock icon on the left side of the address bar signifies a secure connection. Click it for more details about the site’s security credentials.

2. Examine the URL

A close look at a website’s URL can help you find out whether you’re on a legitimate site or a fake copycat. Cybercriminals often spoof websites, creating sites that look nearly identical to real ones to steal your logins. In some cases, they’ll even register domains with common misspellings of well-known sites to catch users who mistype a URL, a tactic known as typosquatting. Always check the address bar for these common red flags:

• Misspellings or extra characters: “gooolge.com” or “arnazon.com” instead of “google.com” or “amazon.com”
• Added words or hyphens: “apple-support-login.com” instead of “apple.com”
• A different domain extension: “netflix.net” or “netflix.org” instead of “netflix.com”
• Long, confusing URLs with multiple subdomains or random strings: “login.paypal.verify-account.example.com.”

If something looks off, close the window immediately, then clear your browsing history and data to prevent being redirected there again. Report the site if you believe it’s running a scam.

3.  Look at the content and claims

Even if a URL looks legitimate, the site itself can give away red flags. Spoofed and pharming sites often contain subtle mistakes that the real site wouldn’t, like misspelled words, awkward phrasing, or mismatched logos — although thanks to AI, these slip-ups are becoming rarer.

You should also pay close attention to broken page elements. While an AI-generated scam site might look highly realistic on the surface, it’s often a house of cards that starts to crumble as you dive deeper into the website. A legitimate brand will have a deep, functional website, whereas a scam site is usually just a few pages designed to steal your data.

To verify a site’s legitimacy, try exploring beyond the homepage:

• Click the navigation links: Do pages like “About Us” or “Shipping Policy” actually load, or do they just refresh the page and do nothing at all?
• Test the footer: Check whether the social media icons actually link to the brand’s official profiles or are just static images.

Another warning sign to watch out for is a deal that seems too good to be true. If you land on a luxury retailer's website and everything is heavily discounted, don't rush to buy. Close the window, clear your cookies, history, and cache, and then visit the brand's official website by typing the URL directly into your browser. If the discounts disappear, you were likely on a fake site designed to lure shoppers with unrealistic bargains.

Look out for unrealistic claims. If you chance upon a website promising pills that will make you look ten years young for just $18.99 (dermatologists hate this simple trick), chances are you’re on an unsafe site.

Likewise, watch out for ticking timers telling you a sale will end in mere hours. Scammers love urgency, since they want you to take action before you have time to think critically.

Browse safely with Norton 360

Knowing what to look for is important, but having the right tools helps make staying safe online a lot easier. Norton 360 uses AI technology to analyze content patterns and help warn you about threats like phishing sites and scam texts before they reach you.

It also includes a Secure VPN, a Private Browser, and Dark Web Monitoring, providing a comprehensive solution to help keep your personal information and devices protected around the clock.

FAQs

How can I check if a link is safe?

If you’re using a computer, hover over the link before clicking. If the URL that appears doesn’t match where you’d expect to go, don’t click it. You can also copy the link and run it through a URL safety checker for a second opinion. When in doubt, skip the link entirely and navigate to the site directly by typing the official URL into your browser.

How do scam websites work?

Scam websites are designed to trick you into handing over personal information or account credentials, usually by impersonating something familiar and trustworthy. Phishing sites lure you into entering details like passwords or financial information that can be used to access your accounts.

What happens if you visit an unsafe website?

Most browsers will warn you before you get there, typically with a full-screen alert flagging that your connection isn't private or that you’re heading toward a deceptive site. If you proceed anyway, the consequences can be serious. Your identity could be stolen, malware could be installed on your device, or you could become the target of a scam.

Does clearing my cache get rid of viruses?

Clearing your cache won’t get rid of viruses or malware that have already been installed on your computer or phone. However, it can help remove malicious “scripts” that live inside your browser and cause annoying pop-ups or redirects.