Is grubhub.com legit?
Grubhub.com is a trusted platform with robust technical foundations and a long-standing online presence. While the site could improve on readily available contact and social media information, its core security and infrastructure are in excellent shape.
Food & Dining average: 83/100 · based on 15 sites
Checked: April 28, 2026 at 11:00 AM UTC
Is grubhub.com a scam? Here's what we found.
The site uses a modern TLS 1.3, has a valid SSL certificate from a reputable issuer, enforces HTTPS with HSTS, and has Content Security Policy and clickjacking protection, indicating a strong security posture. Google Web Risk also finds the site clean.
With a domain age of over 23 years, the site has a well-established online identity. It is registered through a corporate domain registrar, an expected practice for a large business.
The website has a very high Tranco rank, indicating significant traffic and recognition, and is not found on any DNS blacklists, reinforcing its positive reputation. The lack of a Trustpilot profile is not a significant negative for a business of this scale.
While legal pages are present and the site has basic branding, the absence of easily accessible contact information and social media links on the homepage reduces overall transparency for users seeking support or engagement.
The presence of both a privacy policy and terms of service pages demonstrates a commitment to legal and user protections, which are essential for compliance.
The site benefits from robust DNS resolution, comprehensive email authentication with DMARC records, and efficient page load times, indicative of a well-maintained and reliable infrastructure.
Signals Detected
This is a well-known, high-traffic website
No structured data markup found
Domain created 2002-11-06T15:52:27Z (23 years, 9 months ago)
Registered through GoDaddy Corporate Domains, LLC
Expires in 1288 days
DNSSEC status from WHOIS
This business has no Trustpilot presence — not unusual for smaller or newer companies
crt.sh returned status 429
Valid certificate, expires in 209 days
Certificate issued by GlobalSign nv-sa
Connection uses TLS 1.3
Site has a favicon but no social sharing metadata
robots.txt has 18 directives
Site enforces HTTPS via HSTS
Site has Content Security Policy configured
X-Frame-Options: SAMEORIGIN
Web server: openresty
No threats detected by Google Web Risk
Website is live and responding
No obvious contact information found on homepage
Website has both privacy policy and terms of service pages
No social media links found on homepage
No sitemap found — common for smaller sites
Resolves to: 151.101.1.160
Mail servers: aspmx.l.google.com., aspmx4.googlemail.com., alt1.aspmx.l.google.com., alt2.aspmx.l.google.com., aspmx2.googlemail.com., aspmx5.googlemail.com., aspmx3.googlemail.com.
Domain has DMARC email authentication configured
DNS providers: dns1.p03.nsone.net., dns2.p03.nsone.net., dns3.p03.nsone.net., dns4.p03.nsone.net., ns01.5naans.com., ns02.5naans.com., ns03.5naans.com., ns04.5naans.com.
Could not query Wayback Machine
Not found on any DNS blacklists
Fast page load
Stay Safe Online
Good habits to protect yourself, no matter the scan result.
Never reuse passwords across sites.
Add a second layer of security to your accounts.
Always verify unfamiliar stores before entering payment info.