Is This Website Safe? How to Check a Site Before You Trust It

A website can look convincing while asking you to do something risky. Before you sign in, pay or download, pause and verify both who is asking and what they want you to do. An unexpected account warning needs a different check from a shop purchase or a software download.

If you have already paid or entered sensitive information, go straight to the response steps below. Securing your account or contacting your bank matters more than finishing a website check.

Start with the address and the request

Read the whole address: a familiar brand name can appear in a misleading subdomain. For examples, see how to spot a fake link. HTTPS encrypts the connection; it does not prove the operator is honest, as the FTC explains. An older domain is not proof either: auDA documents abuse of hacked business websites. Treat domain history as context, not a verdict.

Before you sign in or reset a password

1. Check the request independently. Open the service through its official app or known address and look for the same notification there. If it is unclear, contact support through that trusted route.
2. Pause at unexpected login steps. Do not give someone a one-time security code or approve a sign-in you did not initiate. A convincing page or a caller claiming to be support does not make that request legitimate.
3. Use a unique password when creating an account. Reusing your email or banking password puts those accounts at risk if the new site steals it. Enable multi-factor authentication where available.

ASD's multi-factor authentication guidance explains why codes and approval prompts need the same care as passwords.

Before you pay or place an order

Check the seller's identity, contact details, returns policy and independent reviews. Confirm that the person or business receiving the payment matches the seller you intended to pay. Scamwatch's buying guidance covers these checks; our full pre-purchase guide goes into store research.

A card or PayPal option does not establish that a seller is trustworthy. Check your provider's dispute rules, deadlines and exclusions before paying. For example, PayPal Australia's Buyer Protection terms make eligibility conditional and exclude personal payments such as Friends and Family. Reimbursement is not guaranteed.

Unexpected delivery or customs fee? Genuine customs charges exist. Royal Mail, for example, may notify customers by text or email when a customs fee is due. Check through the carrier's official site or app yourself, using your order and tracking information. The wording "customs fee" alone cannot tell you whether a request is genuine.

Before you download or install anything

1. Find the publisher independently. Use its official site or your device's official app store. Check the publisher name rather than choosing the first advertisement or download button.
2. Check what you are being asked to open. If you expected a document but receive an installer such as an .exe or .msi file, stop and verify with the sender through another channel.
3. Question extra permissions. Do not install an unexpected extension, grant remote access or disable security protections just because a page says it is required. Review whether the software needs the access it requests.
4. Keep the device updated. Install browser, operating-system and security updates through their normal settings. A web pop-up demanding an urgent "security update" is not a trusted update channel.

These precautions follow ASD's ransomware prevention guidance. A website-address check does not examine everything an installer will do on your device.

If you have already used the site

Choose the steps that match what happened. If malware is possible, use another device you trust to contact your bank or recover accounts.

• Only viewed the page: close it without approving prompts or opening downloads. Keep your browser and device updated. Unexpected programs, redirects or security alerts deserve attention.
• Entered a password or security code: open the real service independently and recover the account immediately. Change the exposed password and any reused versions, sign out other sessions where available, check recovery details, and enable multi-factor authentication. For a banking login, also contact your bank now.
• Paid or entered card details: contact your bank or card provider immediately using its app or the number on your card. Explain what happened and ask about securing the card or account, stopping payments and dispute options. Keep receipts and messages; do not wait for a checker result or an unauthorised charge to appear.
• Downloaded a file but have not opened it: leave it unopened and remove it. If it opened automatically or you are unsure whether it ran, follow the malware guidance below.
• Opened a suspicious file, installed software or granted remote access: stop entering sensitive information on that device. Disconnect it from networks if you suspect malware and follow the device-specific recovery instructions below. Seek trusted IT help if you are unsure.

Use ASD's account recovery guide and malware recovery guide for the detailed steps. If identity documents were shared, Scamwatch's recovery page also points to free identity support. Our damage-control checklist can help you organise your next actions.

After urgent protective steps, report the incident through the service for your country: Scamwatch and, for Australian cybercrime, ReportCyber; Report Fraud for England, Wales and Northern Ireland; or Police Scotland on 101. Report Fraud replaced Action Fraud on 4 December 2025. In the US, use the FTC's ReportFraud service. Reporting does not replace contacting your bank or account provider.

Frequently asked questions

Sources and review date

Reviewed 4 September 2026. The primary sources linked above were checked for this revision. ASD's MFA guide states it was updated on 21 August 2026; its ransomware prevention guide on 12 February 2025; its account and malware recovery pages on 10 November 2023. PayPal Australia's Buyer Protection terms were updated on 1 July 2024. The Report Fraud launch notice is dated 4 December 2025. Reporting routes and payment terms can change; follow the current official guidance for your country and provider.