How to Check If a Website Is Safe in 2026

Q: What are the signs of an unsafe website?

The clearest signs are a browser security warning, a plain http:// address on a page asking for a password or payment, an expired or self-signed certificate, a domain name that does not match the brand it claims (a lookalike spelling or an unrelated parent domain), a brand-new registration posing as an established company, and pressure to act immediately. Underneath the visible signs, an unsafe domain typically has no email authentication and no security headers — the configuration gaps that put 295,157,813 domains (78.3% of the web) in the F grade. Any single hard red flag on a site handling money or identity is reason enough to stop.

Published 2026-08-21

To check if a website is safe you read the signals a browser hides from you: is the connection encrypted, is the certificate real and current, can the domain’s email be forged, does the site set the headers that stop common attacks, and what does its overall security posture add up to. None of that shows in a padlock and none of it is visible to the naked eye — which is why “the site looks fine” is worthless as a safety test. In the defaults.exposed August 2026 census of 432,127,908 domains, 295,157,813 — 78.3% — earn an F grade. That is not a fringe of dodgy sites; it is nearly three domains in four. This guide gives you the seven machine-readable signals that actually decide whether a website is safe, how to read each one, and how to run all seven on any domain in a single click.

If you are about to enter a card number, log into a portal, download a file, or trust an invoice from a domain you do not already know, you need a faster and harder test than intuition. Scammers copy padlocks, logos, and layouts perfectly; what they cannot easily fake is a domain’s underlying configuration. The figures throughout come from the defaults.exposed August 2026 census, an independent scan of 432,127,908 domains graded as of 2026-08-16.

The short answer: what “safe” actually means for a website

“Safe” is not one property — it is a stack of them, and a site can pass the visible layer while failing every layer underneath. Break the question into two halves:

Is the connection to the site safe? Is traffic encrypted, is the certificate genuine and unexpired, and does the site refuse to fall back to plaintext? This protects you while you are on the page.
Is the domain itself trustworthy? Can criminals send email that looks exactly like it comes from this domain? Does the domain set the browser controls that stop cross-site attacks? This protects you after you leave the page — in the phishing email that arrives next week wearing the same name.

A padlock speaks only to a fraction of the first half. It confirms traffic is encrypted; it says nothing about whether the certificate is expired, whether the domain can be spoofed in email, or whether the site is a freshly registered clone of a brand. The census exists precisely because these hidden layers are where safety lives, and most of the web fails them: only 2.9% of domains — 10,902,284 — are fully protected across email, TLS, and DNS at once. Everything below is how you check each layer yourself.

Check your domain free at defaults.exposed — enter any domain, not just your own, and it reads all of these signals from public DNS and the live connection in about 30 seconds. It is the seven-signal check in this article, run at once.

Signals 1-2: HTTPS, valid certificates, and the 44 million-site HTTP gap

Signal 1 — HTTPS with no plaintext fallback. The base requirement is that the site loads over https:// and that the address does not quietly fall back to http://. Two failures hide here, and both are common:

No encryption at all. The census found 44 million websites still serving over plain HTTP with no TLS whatsoever. On these, anyone on the network path — a café Wi-Fi operator, an ISP, an attacker — can read and alter everything you send. We measured the full scale of this in The HTTP-Only Problem: 44 Million Domains Serving Unencrypted Web in 2026.
HTTPS that never becomes the default. A further 27 million sites answer on HTTP and never redirect to HTTPS, so a user who types the bare domain lands on the unencrypted version and stays there. The grading logic is in the HTTP-to-HTTPS redirect methodology.

How to check it yourself: look at the address bar after the page loads. If it shows http://, or if typing the plain domain does not snap to https://, treat the site as unsafe for anything sensitive. For a stronger guarantee, check whether the site sends an HSTS header, which forces the browser to use HTTPS even before it connects — see the HSTS methodology.

Signal 2 — a certificate that is real, current, and trusted. A padlock appears whenever any certificate is present. It does not tell you the certificate is valid. Three certificate failures let a padlock display while the site is untrustworthy:

Expired certificates. 5.2 million TLS certificates are expired but still being served. An expired certificate means the site’s identity is no longer being vouched for, and the encryption keys may be stale — full detail in Expired SSL Certificates: 5.2 Million Sites Still Serving.
Self-signed certificates. 3.3 million sites present self-signed certificates that no browser trusts, because the domain vouches for itself rather than being verified by a certificate authority. This is normal on internal test boxes and a major red flag on anything asking for your data — see Self-Signed Certificates: The 3.3 Million-Domain Census.
Name mismatch. The certificate is valid but issued for a different domain, so it does not actually cover the site you are on.

How to check it yourself: click the padlock and open “Connection is secure” → “Certificate is valid.” Confirm the certificate is issued to the exact domain you typed, that it is within its validity dates, and that your browser does not show a warning. The grading detail sits in the certificate-valid methodology and the certificate-expiry methodology. Any certificate warning your browser raises — “not secure,” “your connection is not private,” a red address bar — is a stop sign, not a click-through.

Signals 3-4: domain age, reputation, and blocklist status

The census grades a domain’s configuration. Two further signals sit outside that — they describe the domain’s history and standing — and you check them with different free tools. They matter most when the site is one you have never heard of.

Signal 3 — domain age and identity. Fraudulent sites are usually young. A convincing clone of a bank or a courier is often registered days before the campaign that uses it. You can read a domain’s registration date from a public WHOIS lookup: a domain created last week that presents itself as an established brand is a strong warning. Pair this with a plain-language sniff test — a lookalike spelling (paypa1, -secure, an unexpected country suffix), a brand name buried in a long subdomain, or a checkout hosted on a domain unrelated to the shop are all classic impersonation tells.

Signal 4 — reputation and blocklist status. Independent reputation services record domains and URLs seen distributing malware or running phishing. A free URL-reputation or safe-browsing check tells you whether a domain is already flagged. Treat a listing as decisive: if a reputable blocklist names the site, do not proceed, regardless of how polished it looks. Treat a clean result as necessary but not sufficient — brand-new scam domains have not been reported yet, which is exactly why signals 1, 2, 5, and 6 matter. Reputation catches known-bad; configuration catches the not-yet-reported.

The census cannot see a domain’s reputation, but it can see the configuration that correlates with it. Domains that neglect encryption, certificates, and email authentication are the same domains that dominate the F grade — and a site that has not bothered to redirect to HTTPS in 2026 has usually not bothered with anything else either.

Signals 5-6: email spoofability (SPF/DMARC) and security headers

These two signals protect you after you leave the site. They are invisible in a browser and they are where most of the web fails hardest.

Signal 5 — can this domain’s email be forged? The most likely way a scammer harms you using a real company’s name is not by breaking into its website — it is by sending email as that company. A domain is protected against this only if it publishes an enforcing DMARC policy on top of SPF or DKIM. Most do not:

56.8% of the graded web — 214,276,774 domains — publish neither SPF nor DMARC, so there is no email-authentication posture at all. The profile is in The Silent Domain: 56.8% of the Internet Has No Email Authentication.
90.7% of domains have no enforcing DMARC policy, which is why the overwhelming majority of domains can be impersonated in email. The mechanics of exactly how that forgery works are in Email Spoofing Explained: Why 90.7% of Domains Can Be Forged, and the grading rule is in the DMARC policy methodology.

Why this belongs in a “is this website safe” check: if you receive an invoice, a password-reset, or a “your delivery failed” message that appears to come from a domain you are vetting, an unprotected domain means that message could be a forgery that passes every visible test. Checking the domain’s email posture tells you how much to trust mail wearing its name.

Signal 6 — security headers. These are instructions a site sends to your browser to shut down whole classes of attack: a Content-Security-Policy that blocks injected scripts, X-Frame-Options that stops the site being framed for clickjacking, X-Content-Type-Options that prevents content-type tricks. Adoption is thin — only 8.0% of sites set a Content-Security-Policy at all — so their presence is a positive signal of a site that takes security seriously, and their absence on a site handling money or credentials is a mark against it. The grading logic is in the CSP methodology. You will not see headers in normal browsing; a scanner reads them for you, which is the point of running the full check rather than eyeballing the page.

Signal 7: the overall grade — why 78.3% fail

The first six signals are individually readable, but no human runs all of them on every site. The seventh signal collapses them into one answer: a letter grade for the domain’s whole security posture. It is the fastest honest answer to “is this website safe.”

The distribution is bleak. Across the census, 295,157,813 domains — about 78.3% — earn an F grade. An F is not assigned for a single missing header; it is what a domain earns when the basics compound — no encryption or a broken certificate, no email authentication, missing security controls, or a domain that is registered but serves nothing usable at all. Dead and parked domains are graded on the same scale and land in F, which is part of why the number is so large: much of the namespace is configured for nobody.

Set the F rate against the top of the scale and the shape of the web becomes clear. Only 2.9% of domains — 10,902,284 — are fully protected across email, TLS, and DNS simultaneously. The gap between those two numbers is the reason a visual impression is worthless: the median domain on the internet is not “mostly fine with a few gaps,” it is comprehensively unprotected, and it looks identical in a browser to the 2.9% that are not.

For you, vetting a specific site, the grade converts all seven signals into a single decision. A high grade means the operator has closed the encryption, certificate, email, and header gaps that most of the web leaves open — a strong proxy for competence and care. A failing grade on a site asking for money or credentials means the operator has skipped the basics, and you are being asked to trust the same standard of diligence with your data.

Check your domain free at defaults.exposed to get this grade for any site in about 30 seconds — no account needed. If it is your own domain and the grade comes back low, see how the fix works to close the gaps and keep them closed.

Red flags that should stop you immediately

Some findings are not “score a point down” — they are “do not proceed.” If you see any of these while checking a site you do not already trust, stop:

A browser security warning — “Not secure,” “Your connection is not private,” a crossed-out padlock, or a full-page certificate error. Never click through to reach a site that asks for data.
http:// on any page that takes a password or a payment. Unencrypted plus sensitive is the single clearest red flag.
An expired or self-signed certificate on a site presenting itself as a real business — between them the census counts 5.2 million expired and 3.3 million self-signed certificates still in the wild.
A domain that does not match the brand — a lookalike spelling, a brand name that is only a subdomain of an unrelated domain, or a checkout on a different domain than the shop.
A brand-new registration masquerading as an established company, revealed by a WHOIS date days or weeks old.
Pressure to act now — countdown timers, “verify immediately or lose access,” a link in an unexpected message. Urgency is the social-engineering wrapper around every technical red flag above.

Any one of these is enough. You do not need to confirm all seven signals are bad; a single hard red flag on a site handling money or identity is a reason to walk away.

What this means

For online shoppers, the practical rule is that the padlock is table stakes, not proof. Before you enter a card number on an unfamiliar shop, confirm the address is HTTPS, click the padlock to check the certificate is issued to that exact domain and unexpired, and be suspicious of a domain registered days ago or spelled almost-but-not-quite like a brand you know. If the checkout sits on a different domain than the shop, stop and verify. A 30-second grade check turns four separate lookups into one answer, which is the difference between actually checking and telling yourself you did.

For small businesses vetting a vendor or partner, the domain you are about to integrate, pay, or exchange data with is part of your own attack surface. A supplier whose domain has no email authentication is a supplier whose invoices can be forged in their name and sent to you — which is how most invoice-redirection fraud begins. Run the seven-signal check on a prospective vendor’s primary domain the way you would check their company registration: a failing grade is a question to raise before money moves, not after. The email posture in particular tells you how much to trust any message that later arrives wearing that vendor’s name.

For site owners, every signal in this checklist is one an attacker, a customer, or a security-conscious buyer can read about your domain without your permission — because it all lives in public DNS and the live connection. If 78.3% of the web earns an F, a passing grade is a genuine differentiator that a careful buyer will notice, and a failing one is a liability they will notice too. The gaps that cause it — no HTTPS redirect, a lapsed certificate, no enforcing DMARC, missing headers — are each a small, well-understood fix rather than a rebuild.

Run the full check in one click

Reading seven signals by hand — address bar, certificate panel, WHOIS, a reputation lookup, a DMARC record, response headers, then a mental grade — is more than anyone does before trusting a site in the moment. The value of a scanner is that it runs all seven at once and returns the one thing you actually want: a straight answer on whether this domain is safe.

That is what the free check does, and because it reads only public DNS and the live connection, it works on any domain — a shop you are about to buy from, a portal a partner sent you, a link in an email you are not sure about, or your own site.

Check your domain free at defaults.exposed — it reads HTTPS, certificate validity, email spoofability, and security headers straight from public sources and returns a letter grade in about 30 seconds. No account needed. If the domain you check is your own and it grades poorly, see how the fix works to close the encryption, certificate, and email-authentication gaps that push 78.3% of the web into an F.

Read the flagship census report: The State of Domain Security 2026 →

FAQ

How can I tell if a website is safe? Read the signals a browser hides rather than trusting how the page looks. Confirm the connection is HTTPS and does not fall back to plaintext; open the padlock and check the certificate is issued to the exact domain, is unexpired, and raises no warning; check the domain’s age and reputation for a young or flagged clone; and, for anything wearing a company’s name, check whether the domain’s email can be forged. In the August 2026 census, 295,157,813 domains — 78.3% — earn an F, so a polished appearance proves nothing. The fastest route is to run all these at once: check your domain free at defaults.exposed.

Does HTTPS mean a website is safe? No. HTTPS means the connection is encrypted so nobody can read it in transit — it says nothing about who runs the site or whether they are honest. Scammers get certificates as easily as anyone, so a padlock appears on phishing sites too. Worse, a padlock shows for any certificate: the census found 5.2 million expired and 3.3 million self-signed certificates still being served, all of which can still show a lock in some contexts. HTTPS is necessary but nowhere near sufficient. It is one of seven signals, not the whole test — and 44 million sites do not even clear that first bar.

How do I check if a domain is safe? Check the domain’s configuration, not just the page. A safe domain serves HTTPS with a valid, current certificate; refuses to fall back to plain HTTP; publishes email authentication (an enforcing DMARC policy on top of SPF or DKIM) so it cannot be impersonated; and sets browser security headers. You can read each of these from public sources without visiting the site’s sensitive pages. Because only 2.9% of domains (10,902,284) are fully protected across all these layers, most domains you check will show gaps — the question is whether the gaps are on a site you are about to trust with money or credentials.

What are the signs of an unsafe website? The clearest signs are a browser security warning, a plain http:// address on a page asking for a password or payment, an expired or self-signed certificate, a domain name that does not match the brand it claims (a lookalike spelling or an unrelated parent domain), a brand-new registration posing as an established company, and pressure to act immediately. Underneath the visible signs, an unsafe domain typically has no email authentication and no security headers — the configuration gaps that put 295,157,813 domains (78.3% of the web) in the F grade. Any single hard red flag on a site handling money or identity is reason enough to stop.

Data to cite

“295,157,813 domains — about 78.3% — earn an F grade in the August 2026 census, so a site’s visual appearance is not a reliable safety signal.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“44 million websites still serve over plain HTTP with no encryption at all.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“27 million sites answer on HTTP and never redirect to HTTPS, leaving users on the unencrypted version.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“5.2 million TLS certificates are expired but still being served.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“3.3 million sites present self-signed certificates that no browser trusts.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“Only 2.9% of domains — 10,902,284 — are fully protected across email, TLS, and DNS simultaneously.” — defaults.exposed August 2026 Domain Security Census (432M domains)

See where your own domain stands

Checking if a website is safe is not a feeling — it is seven concrete signals, and six of them are invisible in a browser. You can read them one by one, or you can run them together and get a single letter grade. Given that 78.3% of the graded web earns an F, the odds are that any unfamiliar site you check will have gaps; the check tells you where they are and whether they matter for what you are about to do.

Check your domain free at defaults.exposed — enter any domain and it reads HTTPS, certificate validity, email spoofability, and security headers from public DNS and the live connection, then returns a plain grade. Takes 30 seconds. No account needed. If the domain is your own and it grades badly, see how the fix works to close the gaps for good.

Read the flagship census report: The State of Domain Security 2026 →

Aggregate data only. Data stored and processed in the EU.

Data source: defaults.exposed August 2026 census, methodology v9, as of 2026-08-16. 376,928,750 domains graded for email from 432,127,908 scanned; 284,598,752 graded on overall posture. All figures are counts of graded domains. References: RFC 8446 (TLS 1.3), RFC 6797 (HSTS), RFC 7489 (DMARC).

How to cite this report

Press / blog: defaults.exposed (2026). How to Check If a Website Is Safe in 2026. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/v9/articles/how-to-check-if-a-website-is-safe-in-2026

Academic: defaults.exposed. (2026, August 21). How to Check If a Website Is Safe in 2026. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/v9/articles/how-to-check-if-a-website-is-safe-in-2026

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=432,127,908 domains scanned)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,750 of them for email authentication using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/v9/methodology Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Data sourced from the August 2026 grading methodology (v9) — 34 checks, 376 million domains. Browse the census statistics or the Census Explorer, or see all August 2026 research →