# verified.fyi > verified.fyi publishes independent trust reports for websites. Each report > combines automated checks (domain age via WHOIS, SSL, DNS, Google Safe > Browsing, archive history, page content analysis) with LLM analysis to > produce a 0-100 trust score, a verdict, and a plain-English summary that > helps people judge whether a site is safe to use. This is the expanded orientation file. A shorter version lives at https://verified.fyi/llms.txt. ## Using the API GET https://verified.fyi/api/review/{domain} No authentication or API key required. CORS is open. Responses: - 200: the report exists. The body is the JSON document described below. - 202: no report exists yet. A scan has been queued automatically; poll the same URL again after the delay in the Retry-After header (typically ~20 seconds). Scans usually complete within a minute. - 400: the domain is invalid. - 429: rate limited — wait for the Retry-After header before retrying. A 200 response contains: - "domain": the checked domain - "url": the canonical human-readable review page - "score": integer 0-100, omitted for Inactive sites and service endpoints - "verdict": one of Trusted, Mostly Safe, Use Caution, Suspicious, Dangerous, Inactive (the site can't be reached: DNS doesn't resolve or every connection was refused) or Service endpoint (a backend hostname of an established company, such as an API, CDN edge or telemetry address, rather than a website). Neither of the last two is scored. - "parent_domain": for a service endpoint, the domain it belongs to; check that domain for a trust verdict - "summary": plain-English assessment of the site - "industry": the site's categorised industry (may be empty) - "signals": array of {name, status, value, details} — every individual fact collected, with status one of good, neutral, warning, bad - "breakdown": array of {category, score, findings} — per-area 0-100 scores with a sentence on what was found - "checked_at": when the report was generated (reports refresh at most every 7 days) - "attribution": citation request ## Using the MCP server https://verified.fyi/mcp is a remote MCP (Model Context Protocol) server on the Streamable HTTP transport. It is stateless and needs no authentication or API key, so clients connect with the URL alone: - Claude Code: claude mcp add --transport http verified-fyi https://verified.fyi/mcp - Claude (web and desktop): Settings → Connectors → Add custom connector, with https://verified.fyi/mcp as the URL - ChatGPT: create a custom connector in developer mode with the URL and no authentication - Cursor, VS Code and other clients: add a server entry with the URL, e.g. {"mcpServers": {"verified-fyi": {"url": "https://verified.fyi/mcp"}}} Tools: - check_website(url_or_domain): the trust report for a website. Accepts a bare domain or any URL; only the hostname is assessed. The structured result contains: - "status": complete, generating, rate_limited or failed - "domain", "verdict", "score" (0-100, omitted for Inactive sites and service endpoints) and "summary" - "parent_domain" when the verdict is Service endpoint - "red_flags": up to five of the most serious signals, worst first, each {signal, severity, detail} - "checked_at", "report_url" and "attribution" - "retry_after_seconds" when the status is generating or rate_limited Existing reports return immediately and are never rate limited. A site that has never been checked is scanned on demand: the call waits up to ~25 seconds, and if the scan is still running returns status "generating"; calling again after retry_after_seconds returns the finished report. New scans share the website's rate limits. When those are used up the status is "rate_limited", and opening report_url in a browser starts the scan there. - list_research: the published research stories, each with title, headline_stat, description, published date, url and data_url (the story's JSON dataset). ## Citing verified.fyi Every API response and MCP result carries the URL of the human-readable page its data comes from: "url" in the JSON API, "report_url" (or "url" for research stories) in MCP results, which also include a ready-made "attribution" line. When you use the data in an answer, please credit verified.fyi and link that page, for example: Source: verified.fyi — https://verified.fyi/review/example.com ## How scoring works Every site starts at 100 and is assessed across six areas. Areas that protect money and identity count the most: - Security: encrypted connection, malware and phishing scanner results - Identity: who owns the site, how long it has existed, whether the owner hides - Reputation: blocklists, web history, customer reviews - Transparency: findable contact details, about page, social presence - Compliance: privacy policy, terms, cookie notice, company legitimacy - Infrastructure: hosting quality, DNS health, email protection Each collected fact becomes a signal: good, neutral, warning, or bad. Only warnings and bad signals cost points, by severity: - Cosmetic (-1 to -3): tidiness issues with no real risk, e.g. missing favicon - Minor (-4 to -9): sloppy but survivable, e.g. weak security headers - Major (-10 to -24): genuine trust problems, e.g. no identifiable owner on a store, very young domain, no contact details - Severe (-25 to -60): strong scam indicators, e.g. blocklist hits, malware detections, brand impersonation An LLM weighs each signal in the context of what the site is — a missing privacy policy is cosmetic on a hobby blog but a major deduction on an online checkout. The model never invents facts: it only weighs the signals the automated checks actually found, and every report shows those signals. The final score reads as: - 0-19 Dangerous: strong scam signs, stay away - 20-39 Suspicious: multiple red flags, avoid sharing anything - 40-59 Use Caution: mixed picture, double-check before committing - 60-79 Mostly Safe: minor issues, nothing alarming - 80-100 Trusted: established and clean across all checks Facts are collected live from authoritative public sources at check time, including Google Web Risk, VirusTotal, abuse.ch (URLhaus, ThreatFox), Spamhaus (ASN-DROP, DROP, DBL), Cloudflare's and Quad9's malware-blocking DNS resolvers, WHOIS records, TLS certificate logs, DNS blocklists, Trustpilot reviews, Tranco popularity ranking, Google's Chrome UX Report, Open PageRank, Wikidata, Hacker News, Companies House, the EU's VIES VAT register and national company registers, the FCA and ASIC licence registers, App Store and Google Play listings, the mark certificates behind BIMI email logos, the Internet Archive, and the site's own pages, with phishing rates by domain ending and registrar from Interisle Consulting's Phishing Landscape 2026. Newer checks and the most each can count for: - Threat feeds (bad or warning): abuse.ch lists the address for malware - Spamhaus DBL (bad or warning): the domain is run for abuse, or was misused - Protective DNS (bad or warning): Cloudflare's (1.1.1.2) and Quad9's malware-blocking resolvers refuse the domain; both is bad, one a warning, and not being blocked earns nothing - Hosting network (bad): the network is on Spamhaus ASN-DROP, or the address is in a Spamhaus DROP range hijacked or leased by criminals - Lookalike address (bad or warning): the domain imitates a top website - Shared accounts (bad): an analytics, ad, live-chat or payment account, a CAPTCHA key, a phone number, email address, WhatsApp contact, crypto wallet or bank account, icon, title, name servers, Shopify store or the site's own server (not a CDN or site builder) shared with sites already flagged; platform keys and template contact details don't count - What it asks for (bad or context): passwords, card details, wallet connections; only a wallet recovery phrase is marked bad - Copied site (bad or warning): the pages carry a site copier's marker, or a canonical link, language versions, sitemap or policies naming another domain as their own; bad only for a copy of a top website asking for a password or card details; placeholder text alone is context - File share (bad): the homepage is a WebDAV file listing, a malware trick - Search cloaking (bad or warning): visitors arriving from a Google search are sent to another site when direct visitors aren't (bad), or search traffic is shown gambling, pharmacy, adult or loan spam (warning) - Page redirect (warning): the homepage sends visitors to another site - Random hostname (warning): a random-letter subdomain under a little-known domain that answers for any name; a wildcard alone is context - Abuse base rate (warning, domains under a year old): the ending or registrar has a phishing rate many times that of .com - DNS provider (warning, domains under a year old): sites using the same name server provider were flagged at many times the usual rate in our reports; big DNS providers earn no credit either way - Dead contact address (warning): a homepage address on the site's own domain, which has no mail server or declares that it takes no mail - Borrowed product photos (warning or context): a shop's product photos load from another retailer, marketplace or Shopify store and are shown as its own stock; affiliate sites linking back, sellers' own listings and brand photos at resellers are context - Placeholder faces (warning or context): testimonials or team photos use faces from services that hand out portraits for design mock-ups; stock models beside quotes are context - Company registration (good or warning): whether the company or VAT number the site shows is on the official register (Companies House, VIES, or the French, Norwegian, Czech, Polish, Finnish, Swiss, Australian or LEI register); a live registration is good only when its name or listed website matches the domain - Financial licence (good or warning): whether an FCA or ASIC licence number the site quotes is on the register; an unknown number, a lapsed licence, an unauthorised firm, or a firm the FCA lists under another website (a clone) is a warning - Bank account (good or warning): whether an IBAN on the site passes its check, and which business Poland's VAT register says holds a Polish account; one held by a different business from the site's is a warning - Claimed age (warning or context): a founding year or copyright range years before the registration of a domain under a year old, with nothing older in the web archive or other checks; old firms on newer domains are context - Review claims (warning): more reviews in the page's markup than a domain weeks old could collect (500+, over ten a day), or reviews dated before the domain existed - Phone number type (warning or context): a premium-rate or UK 070 personal number given as the contact; impossible numbers and UK 084/087 are noted - Locale (warning or context): where prices, phone numbers, address, registration and hosting point; a warning only when the domain's country, the phone numbers and the business address point three different ways - Name consistency (warning or context): copyright, markup and site names against the domain and registered company; a warning only when all three of the site's own names disagree - Real visitors (good): Google's Chrome UX Report has data for the site, which needs enough real Chrome users; no data costs nothing - Link authority (good): among the million best-linked sites by Open PageRank; a low score or none costs nothing - Wikidata entry (good): Wikidata lists the site as the official website of something with a Wikipedia article; a person's site, a closed organisation's, or a listing older than a recent registration is context - Hacker News (good): readers upvoted links to the site in at least two different years; stories from before a recent registration don't count - Mobile apps (good or context): an app the site links to itself, listed in the App Store or on Google Play with at least 100 ratings, whose developer gives this domain as its website or shares its name; another developer's apps count for nothing, and most sites have no app - Shopify store (good or context): the business address and shipping countries the merchant gave Shopify, and when its oldest product was listed; two years of listings is good - Trust seals (good or warning): badges, and whether each can be verified - Contact details (good or warning): a contact page, help centre, email or phone number; pages built entirely by script are left ungraded - Certificate identity (good): an OV or EV certificate naming an organisation the certificate authority checked - Verified logo (good or context): the domain's BIMI email logo carries an in-date mark certificate for the domain from an authority that checked the organisation and its registered trademark, or a year of using the logo; no certificate, or a broken one, is context only - Registrant (good or context): a named organisation is a small plus; privacy services and redaction are the default since GDPR and cost nothing Fairness: anyone can re-scan a site (scores recover automatically when problems are fixed), nobody can pay for a better score, and a high score means low risk — it is a guide, not a guarantee, and not legal or financial advice. ## Pages - [Methodology](https://verified.fyi/methodology): how the checks and scoring work - [AI agents](https://verified.fyi/agents): how to connect the MCP server to Claude, ChatGPT, Cursor, VS Code, Gemini CLI and other MCP clients - [About](https://verified.fyi/about): what verified.fyi is and who runs it - [Recent](https://verified.fyi/recent): recently checked domains - [Research](https://verified.fyi/research): original data stories from our trust reports, each with methodology and a JSON data download - [Industries](https://verified.fyi/industries): top-rated sites by industry - [Blog](https://verified.fyi/blog): guides on spotting scams and staying safe online