Website legit checker tools: what each one actually checks
No single checker can tell you a site is safe. Each one answers a narrower question, and the useful skill is knowing which question you are asking.
A website legit checker is any tool that tells you something about a site before you trust it with money or a password. The free ones worth knowing are Google Safe Browsing's site status, ScamAdviser, VirusTotal, ICANN Lookup and the Wayback Machine, plus browser-side checks like Kitsuvo's. None of them can prove a site is legitimate. Each answers one question: is it on a blocklist, how old is it, what has it been, what does the page itself show. Use two or three together.
For the manual version of these checks, with no tools at all, see how to check if a website is legit.
Which website checker answers which question?
| Tool | Question it answers | Cost | Main blind spot |
|---|---|---|---|
| Google Safe Browsing site status | Has Google flagged this site as unsafe? | Free | New sites not yet reported |
| ScamAdviser | How do dozens of signals add up to a trust score? | Free to look up | Scores can lag behind a site's real behaviour |
| VirusTotal | Do security vendors' blocklists flag this address? | Free for public use | Shares what you submit with partners |
| ICANN Lookup | When was the domain registered, and through whom? | Free | Owner details are usually redacted |
| Wayback Machine | What did this site look like before? | Free | Not every site is archived |
| Kitsuvo | What does this page show as it loads: look-alikes, fake CAPTCHAs, AI-builder fingerprints? | Free | Only judges pages you open, on Mac and Windows |
Is the site on Google's unsafe list?
Google's Safe Browsing site status lets you paste an address and see "the most recent results of the Safe Browsing analysis for that webpage", as Google's security blog describes it, without visiting the page yourself. It is the same list Chrome, Firefox and Safari use for their red warning screens.
What it misses: a site nobody has reported. Phishing pages often live for hours or days, and "no unsafe content found" only means Google hasn't flagged it yet.
What is ScamAdviser's trust score based on?
ScamAdviser gives each site a trust score. According to its data partner listing, the score uses more than 40 data sources, such as the domain's age, the server's location, whether contact details appear and reviews elsewhere. It is good at the common case: a shop registered last month, hosted somewhere unusual, with no reviews anywhere.
What it misses: the weighting isn't published, so you can't check the reasoning, and a young but honest small business can score low. Read the reasons it shows, not just the number.
Do security vendors flag the address?
VirusTotal checks a URL against what its documentation calls "over 70 antivirus scanners and URL/domain blocklisting services". If several of them flag an address, believe them.
What it misses, and a warning: a clean result is common for brand-new scams. And VirusTotal's own documentation says the contents of submitted pages may be shared with premium customers. Never paste a link that contains a personal token, such as a password reset or a private document link.
How old is the domain?
ICANN Lookup shows the "current registration data" for a domain: the registrar and, most usefully, the creation date. A store selling discounted brand goods on a domain registered three weeks ago is a classic pattern of fake shops. Owner names are usually hidden for privacy, which is normal and tells you nothing either way.
The Wayback Machine fills in the history: paste the address and see snapshots over time. A domain that was a dentist's site until last month and is now a sneaker outlet has changed hands. More on this pattern in how to spot a fake online store.
What can a check on the page itself catch?
The tools above look up an address. They don't look at what the page in front of you is doing. Some of the most useful signs are only on the page:
- A sign-in form with a well-known brand's logo on a domain that isn't that brand's.
- An address that swaps a letter, such as
rnform, or uses a look-alike character. - A "verify you are human" box that asks you to press keys and paste a command, the fake CAPTCHA scam.
- A form that sends what you type to a Telegram bot or a Discord webhook.
- A store built in an afternoon with an AI app builder and still carrying the template's placeholder text.
Kitsuvo, our browser, checks for these on your own computer as each page loads. For the narrow, high-confidence cases, a password or card field on a look-alike address, or a fake CAPTCHA, it holds the page behind a warning with Go back and Show this page anyway, a second or two after the page loads. Everything else appears as a finding with its evidence. It also names the AI builder behind a site when there is a fingerprint, which is context, not an accusation: plenty of honest sites are made that way. More in how to spot phishing sites built with AI.
What it misses: Kitsuvo's impersonation check covers a hand-written list of about 70 brands and a set of known patterns, and it only sees pages you open. It is not a replacement for Safe Browsing or for a password manager that only fills passwords on the real domain.
What is a good routine before you pay or sign in?
- Read the full address. If you arrived from an email or ad, type the brand's address yourself instead.
- Paste the address into Safe Browsing site status.
- For a shop you haven't heard of, check the domain's age in ICANN Lookup and its history in the Wayback Machine.
- Look at ScamAdviser's reasons, not only its score.
- Pay with a card or a payment service that offers buyer protection, never by bank transfer, gift card or crypto to a stranger.
If you find a scam, report it so the lists catch up: how to report a phishing website.
Questions people ask
What is the best website legit checker?
There isn't one that covers everything. Google Safe Browsing is the most widely used blocklist, ScamAdviser is a quick summary for online shops, and ICANN Lookup shows domain age. Use two or three together, and check the page itself.
Can a website legit checker be wrong?
Yes, in both directions. New scams are often missing from blocklists, and young but honest businesses can get low trust scores. Treat each result as one piece of evidence.
Is it safe to paste a link into a checker?
For public addresses, yes. Don't paste links that contain private tokens, such as password resets or shared documents: some services, VirusTotal among them, share submissions with partners.
Does Kitsuvo replace Google Safe Browsing?
No. Kitsuvo's impersonation checks run on your computer and look for specific patterns on the page; they complement blocklists rather than replacing them.