# Website safe check

> To check if a website is safe, look at two things: whether it is set up securely and whether it behaves like a scam. Vigilbase's free check covers the first: valid HTTPS, security headers, exposed files and server configuration. For the second, look for the warning signs listed below before you enter a password or card number.

This site is run by Vigilbase (https://vigilbase.com), a managed security provider. It covers: website safe check.

## Run the check

- In the browser: https://websitesafecheck.com/ (results shown on the page)
- API: POST https://api.vigilbase.com/tools/v1/agent/tools/security-headers/execute with {"target":"example.com"}

## Signs a website is safe

- The address uses https:// and the browser shows no certificate warning.
- The domain is spelled exactly as you expect, with no extra words, hyphens or swapped letters.
- The site lists a real company name, address and contact details.
- You reached it by typing the address or from a search result, not from an unexpected message.

## Warning signs of an unsafe website

- Prices or prizes that look too good to be true, and countdown pressure to pay now.
- Payment only by bank transfer, gift card or crypto.
- A login page reached from an email or text that asks you to confirm your account.
- Pop-ups that say your device is infected and ask you to call a number or install software.

## Safe signal or warning sign?

| What you see | Usually means |
| --- | --- |
| Padlock and https:// | The connection is encrypted. Not proof the site is honest |
| Brand name plus extra words in the domain | Warning: a common lookalike trick |
| Company name, address and phone number | A good sign, if they check out |
| Only bank transfer, gift cards or crypto accepted | Warning: payments you cannot dispute |
| Browser certificate warning | Leave the site. Do not enter anything |

## What our check covers, and what it does not

The Vigilbase check tests how securely a site is configured. It is built for site owners and the teams who look after them. It does not keep a blocklist of scam sites, so a well-configured site can still be a scam. If a site fails basic checks such as HTTPS, treat it with caution.

## FAQ

### Does HTTPS mean a website is safe?

No. HTTPS means the connection is encrypted. Scam sites use HTTPS too. It is a minimum, not proof that the site is honest.

### How can I tell if a shopping site is legitimate?

Check the exact domain, look for a real company name and address, search for independent reviews, and pay by card rather than bank transfer so you can dispute the charge.

### I run a website. How do I make it safe for visitors?

Fix every failed check in the scan, keep software updated, and put the site behind a web application firewall such as Vigilbase Shield.

## Related

- [Run the full website security check](https://vigilbase.com/tools/website-security)
- [Protect your own site](https://vigilbase.com/shield)
- [Security headers checker](https://vigilbase.com/tools/security-headers)
- [HSTS checker](https://vigilbase.com/tools/hsts-checker)
- [DNSSEC checker](https://vigilbase.com/tools/dnssec-checker)
- [CSP evaluator](https://vigilbase.com/tools/csp-evaluator)
- [Cloudflare checker](https://vigilbase.com/tools/cloudflare-checker)