Free tool
Website safe check
To check if a website is safe, look at two things: whether it is set up securely and whether it behaves like a scam. Vigilbase's free check covers the first: valid HTTPS, security headers, exposed files and server configuration. For the second, look for the warning signs listed below before you enter a password or card number.
- ISO 27001 compliant
- SOC 2 Type 2 compliant
- Preferred Cloudflare Partner
- 24/7 follow-the-sun support
Signs a website is safe
- The address uses https:// and the browser shows no certificate warning.
- The domain is spelled exactly as you expect, with no extra words, hyphens or swapped letters.
- The site lists a real company name, address and contact details.
- You reached it by typing the address or from a search result, not from an unexpected message.
Warning signs of an unsafe website
- Prices or prizes that look too good to be true, and countdown pressure to pay now.
- Payment only by bank transfer, gift card or crypto.
- A login page reached from an email or text that asks you to confirm your account.
- Pop-ups that say your device is infected and ask you to call a number or install software.
Safe signal or warning sign?
| What you see | Usually means |
|---|---|
| Padlock and https:// | The connection is encrypted. Not proof the site is honest |
| Brand name plus extra words in the domain | Warning: a common lookalike trick |
| Company name, address and phone number | A good sign, if they check out |
| Only bank transfer, gift cards or crypto accepted | Warning: payments you cannot dispute |
| Browser certificate warning | Leave the site. Do not enter anything |
What our check covers, and what it does not
The Vigilbase check tests how securely a site is configured. It is built for site owners and the teams who look after them. It does not keep a blocklist of scam sites, so a well-configured site can still be a scam. If a site fails basic checks such as HTTPS, treat it with caution.
How Vigilbase helps
Vigilbase runs security operations and website protection for businesses that would rather not build a security team.
Vigilbase Shield
Managed Cloudflare WAF, DDoS and bot protection, configured and watched by our team.
Learn moreIncident response
Help to contain, clean up and recover when something has already gone wrong.
Learn moreVigilbase OS
AI investigates every alert and brings you only verified threats, with the fix ready to approve.
Learn moreFrequently asked questions
Does HTTPS mean a website is safe?
No. HTTPS means the connection is encrypted. Scam sites use HTTPS too. It is a minimum, not proof that the site is honest.
How can I tell if a shopping site is legitimate?
Check the exact domain, look for a real company name and address, search for independent reviews, and pay by card rather than bank transfer so you can dispute the charge.
I run a website. How do I make it safe for visitors?
Fix every failed check in the scan, keep software updated, and put the site behind a web application firewall such as Vigilbase Shield.
More free tools and guides
Security handled, around the clock
Vigilbase is ISO 27001 and SOC 2 Type 2 compliant and a Preferred Cloudflare Partner, with follow-the-sun support from teams in Kenya, South Africa, the UAE and Portugal.