How we score a website

Tidiness issues with no real risk: a missing favicon, no social links.

Sloppy but survivable: weak security headers, no cookie notice.

Genuine trust problems: no identifiable owner on a store, very young domain, no contact details.

Strong scam indicators: blocklist hits, malware detections, brand impersonation.

Whether abuse.ch's URLhaus or ThreatFox lists the address for serving malware. Malware still online, or seen recently at high confidence, is bad; a recent listing that is offline or low-confidence is a warning.

Whether Spamhaus's Domain Block List names the domain. A domain run for spam, phishing or malware is bad; a legitimate one that others misused is a warning.

Whether the malware-blocking public resolvers run by Cloudflare (1.1.1.2) and Quad9 refuse to look the domain up. Both refusing is bad; one is a warning. Not being blocked earns nothing, since new scams often aren't listed yet.

Bad when the network is on Spamhaus ASN-DROP, or the site's address sits in a range on Spamhaus DROP, which lists ranges hijacked or leased by criminals.

Whether the domain imitates a top website: lookalike letters, the real domain written in front of another, or the brand next to words like login or payout. The brand name alone or a one-letter typo is a warning.

Whether the site shares an analytics, ad, live-chat or payment account (Stripe, PayPal, Klarna), a CAPTCHA key, a phone number, email address, WhatsApp contact, crypto wallet or bank account, its icon, its title, its name servers, its Shopify store or its own server with sites already flagged by Google Web Risk or a threat feed. Servers behind a CDN or a site builder, which host many unrelated sites, don't count, nor do the keys and sample contact details a platform or template gives every site built with it.

Whether the homepage asks for a password, card details, a crypto wallet connection or a wallet recovery phrase. Only the recovery phrase is marked bad; the rest tell us how much an anonymous owner matters.

Traces that the pages were copied from another site: the marker a site copier or a browser's Save Page leaves, a canonical link, language versions or sitemap naming another domain, or policies that call another shop "our website". A copy of a top website that asks for a password or card details is bad; other copies are a warning. Leftover placeholder text, or one weaker trace, is context only.

A homepage that answers with a file listing instead of a web page, a trick malware campaigns use to make downloads look like local files.

We open the homepage again as someone clicking through from a Google search and as Google's crawler. Search visitors sent on to another site when direct visitors aren't is bad, the mark of a hacked site or doorway page. Gambling, pharmacy, adult or loan spam that only search traffic sees is a warning.

A homepage that sends you on to another site from inside the browser, where link checkers don't look.

A subdomain of random letters under a little-known domain that answers for any name, a way to make a throwaway address per target. A wildcard on its own is context only.

For domains under a year old: whether the ending (.top, .shop) or the registrar has a phishing rate many times that of .com, from Interisle Consulting's Phishing Landscape 2026.

For domains under a year old: whether the sites using the same name server provider were flagged by Google Web Risk, a threat feed or Spamhaus at many times the usual rate in our own reports. Big DNS providers earn no credit either way.

A homepage email address on the site's own domain when that domain has no mail server, or declares that it takes no mail.

A shop whose product photos load straight from another retailer or marketplace, such as AliExpress, Amazon or Temu, or from another Shopify store's uploads, shown as its own stock. Affiliate and deal sites that link back, marketplace sellers' own listings and brand photos at resellers are context only.

Testimonials, reviews or team photos pictured with faces from randomuser.me, pravatar.cc and other services that hand out portraits for design mock-ups. Stock models beside quotes are context, and stock photos used as decoration don't count.

Whether the company or VAT number a site shows is on the official register: Companies House, the EU's VIES service, or the French, Norwegian, Czech, Polish, Finnish, Swiss, Australian or LEI register. A number that isn't, or a company of the site's that has stopped trading, is a warning. A live registration is good when its name or listed website matches the domain, since fake shops print real companies' numbers too.

Whether a licence number the site quotes is on the FCA or ASIC register. A number the regulator doesn't know, a licence that has lapsed, a firm the FCA lists as unauthorised, or a firm that gave the regulator another website, the mark of a clone firm, is a warning. It's good when the register points to this site.

Whether an IBAN on the site passes its check, and for Polish accounts, which business Poland's VAT register says holds it. A number that fails its check, or an account held by a different business from the one the site names, is a warning. An account in another country is context.

A founding year or copyright range from years before the domain was registered, when the domain is under a year old, the web archive has nothing older, and no company record, Shopify history, verified certificate or real traffic shows an older business. Old firms often move to newer domains, so anything less is context.

More reviews in the page's markup than a domain only weeks old could have collected (at least 500, and over ten a day since it was registered), or reviews dated before the domain existed.

A premium-rate line (UK 09, US 1-900, Australian 190) or a UK 070 personal number given as the contact number is a warning. Numbers that can't exist and UK 084 and 087 service numbers are noted.

Where the site's prices, phone numbers, business address, company registration and hosting point, for comparing with where it says it is. Selling abroad is normal: a warning only when the domain's country ending, the phone numbers and the business address point to three different countries.

The names in the copyright notice, business markup and site name tag, against the domain and the registered company. Brands often trade through differently named companies; a warning only when all three of the site's own names disagree.

Whether Google's Chrome UX Report has data for the site, which it only publishes once enough real Chrome users have visited. Most small sites don't qualify, so having no data costs nothing.

How well the rest of the web links to the site, from Open PageRank's scores over Common Crawl. The million best-linked sites count as good. Most small sites have few links, so a low score or none costs nothing.

Whether Wikidata, the knowledge base behind Wikipedia, lists the site as the official website of something with a Wikipedia article. A person's site, a closed organisation's, or a listing older than a recent registration is only context, since those domains can change hands.

Whether Hacker News readers upvoted links to the site in at least two different years. Anyone can submit a link, so stories nobody noticed count for nothing, and stories from before a recent registration belong to the previous owner.

The apps a site links to itself, looked up in the App Store and on Google Play. Good when one has at least 100 ratings and its developer gives this domain as its website or shares its name. Anyone can copy the files that link them, so another developer's apps count for nothing, and most sites have no app.

For Shopify shops: the business address and shipping countries the merchant gave Shopify, and when its oldest product was listed, a date the shop can't change. Two years of listings is good; the rest is checked against what the site claims.

Security and review badges, and whether each links to a page where you can check it covers this site. Badges you can't check are a warning.

A contact page, help centre, email address or phone number on the homepage. Pages built entirely by script, which we can't read, are left ungraded.

Good when the certificate names an organisation the certificate authority checked (OV or EV), not just control of the domain.

Whether the logo a domain shows in email (BIMI) carries a mark certificate that's in date, covers the domain and comes from an authority that issues them. That authority checked the organisation and its registered trademark, or for a Common Mark Certificate a year of using the logo. A logo with no certificate, or a broken one, is context only.

Who the registration names as owner. A named organisation is a small plus. Privacy services and redaction have been the default since GDPR and cost nothing.