Is instacart.com legit?
Instacart.com appears to be a legitimate and well-established service, backed by a strong online presence and robust security measures. While there are some minor concerns regarding numerous external scripts and hidden content, these are not significant enough to undermine its overall trustworthiness for consumers. This platform is Generally Safe for consumer use.
Food & Dining average: 83/100 · based on 15 sites
Checked: April 18, 2026 at 1:09 PM UTC · Refresh
Is instacart.com a scam? Here's what we found.
The site uses a modern TLS 1.3 connection and has a valid SSL certificate from Amazon, indicating a good baseline for secure communication. However, the high number of external scripts presents a potential, albeit moderate, vulnerability for malicious code injection, which is something to be aware of.
With a domain aged nearly 30 years and registered through a reputable registrar like Amazon, Instacart.com shows a very strong and established identity. This longevity is a significant indicator of a trustworthy and long-standing operation.
Instacart.com is a high-traffic, well-known website that is clean on DNS blacklists and has a complete branding presence, all pointing to a solid and positive reputation within its industry. Its long domain history also contributes to its standing.
The site provides clear contact information, readily accessible privacy and terms pages, and links to multiple social media platforms, suggesting a commitment to transparency. The presence of numerous hidden content elements, however, could be perceived as a minor detractor to full openness.
The presence of both a privacy policy and terms of service pages demonstrates a good level of legal compliance. This is essential for any platform handling consumer data and transactions, ensuring users understand their rights and responsibilities.
The site leverages robust email authentication (SPF and DMARC) and distributed DNS resolution, indicating a well-managed infrastructure. The main gap is the unsigned DNSSEC, which, while not uncommon, is a missed opportunity for an additional layer of security against DNS tampering.
Signals Detected
This is a well-known, high-traffic website
Site uses structured data identifying itself as: WebSite
This business has no Trustpilot presence — not unusual for smaller or newer companies
Blocks unknown crawlers by default but grants access to specific bots (473 directives)
Domain created 1996-10-31T05:00:00Z (29 years, 10 months ago)
Registered through Amazon Registrar, Inc.
Expires in 1290 days
DNSSEC status from WHOIS
Excessive number of external scripts — may indicate malicious injection
Excessive hidden content found — may indicate cloaking or deceptive content
Site has custom branding and social media metadata
Valid certificate, expires in 196 days
Certificate issued by Amazon
Connection uses TLS 1.3
Website is live and responding
Website appears to have contact information
Website has both privacy policy and terms of service pages
Website links to multiple social media platforms
Not found on any DNS blacklists
Site enforces HTTPS via HSTS
Site has Content Security Policy configured
Web server: nginx
No threats detected by Google Web Risk
Resolves to: 18.245.31.39, 18.245.31.34, 18.245.31.14, 18.245.31.91
Mail servers: aspmx.l.google.com., alt1.aspmx.l.google.com., alt2.aspmx.l.google.com., aspmx2.googlemail.com., aspmx3.googlemail.com.
Domain has SPF email authentication configured
Domain has DMARC email authentication configured
DNS providers: ns-589.awsdns-09.net., ns-132.awsdns-16.com., ns-1394.awsdns-46.org., ns-1943.awsdns-50.co.uk.
No sitemap found — common for smaller sites
Could not query Wayback Machine
Could not query certificate transparency logs
Average page load time
Embed This Badge
Stay Safe Online
Good habits to protect yourself, no matter the scan result.
Never reuse passwords across sites.
Add a second layer of security to your accounts.
Always verify unfamiliar stores before entering payment info.