How to check if a website is safe to buy from

WindowsMaciPhoneAndroidUpdated

A padlock in the address bar doesn't prove a shop is real. Citizens Advice says it "doesn't guarantee you're buying from a real company", and the US Federal Trade Commission says the "s" in https means a site is encrypted, not that it's legitimate. The useful checks are about the business behind the site, and how you pay.

Quick answer

Put the address into Get Safe Online's free Check a website tool, look the company up on GOV.UK, read reviews on other websites and find the shop's terms and a street address. Don't treat the padlock as proof. Pay by credit card if you have one: the NCSC says many protect online purchases under the Consumer Credit Act.

How do I check if a shopping website is legit?

Look up the business, not just the website. The UK's National Cyber Security Centre (NCSC) says to research online shops, particularly ones you haven't used before, using consumer websites or reviews from people or organisations you trust. Citizens Advice lists the checks it suggests:

  1. Search for the company on GOV.UK. Citizens Advice says this tells you whether it's a registered company.
  2. Find the address. Citizens Advice says it should have a street name, not just a post office box.
  3. Read the terms and conditions. On a site you haven't used before, Citizens Advice suggests spending a few minutes checking it, starting with the terms.
  4. Read reviews elsewhere. Citizens Advice says to look on different websites and not rely on reviews the company has put on its own site. The NCSC points to advice from the consumer group Which? on spotting fake reviews, which can help identify fake shops.

The FTC adds one more: search online for the company or product name with the words "complaint" or "scam".

How does Get Safe Online's Check a website tool work?

You type or paste the shop's address and get a result. Get Safe Online says the tool helps you work out whether a website is likely to be legitimate or a scam before you visit it. It's provided in the UK with Cifas, ScamAdviser and other partners, and gives a trust score based on more than 40 data sources and reports of malicious websites from law enforcement agencies, regulators and consumer brands.

Get Safe Online says no information that can identify you is transferred, collected or stored when you run a check.

A trust score is an estimate, so use it alongside the checks above rather than instead of them.

Is a website safe if it has a padlock?

Not on its own. The padlock and https tell you the connection is encrypted. Both Citizens Advice and the FTC say that doesn't show the seller is genuine.

Treat links in messages with the same care. The NCSC says criminals put malicious links into texts, emails and, increasingly, social media posts, often leading to fake shops with promotions that seem too good to be true. If you're unsure about a link, the NCSC says don't click on it.

What's the safest way to pay online?

A credit card, if you have one. The NCSC says many credit cards protect online purchases as part of the Consumer Credit Act, that debit card payments offer less protection, and that you should never pay by direct bank transfer. For PayPal and similar services, it says to check their terms and conditions to see what cover they provide.

In the UK, MoneyHelper, the government-backed money guidance service, explains the two routes to get money back:

  • Section 75 of the Consumer Credit Act 1974, for credit card purchases of something costing more than £100 and up to £30,000. The Act sets those limits on the cash price of a single item. MoneyHelper says paying only the deposit by credit card is enough, and that if you log in to PayPal and pay with your credit card through it, you won't have Section 75 protection.
  • Chargeback, a voluntary scheme that MoneyHelper says Visa, Mastercard and American Express have signed up to. It works for debit, credit and prepaid cards, isn't legal protection like Section 75, and you must claim within 120 days of the purchase.

In the US, the FTC says paying by credit card best protects you and your money if something goes wrong. If you're billed for things you didn't accept or that weren't delivered as agreed, you can dispute the charge. The FTC says your letter must reach the card issuer within 60 days after the first bill with the error was sent to you. It also says never to buy from online sellers who insist you can only pay with gift cards.

What does a reported vulnerability at a shop mean for me?

A vulnerability is a weakness in software, not proof that anything was taken. On 21 October 2026 the PHP project fixed two critical flaws in PHP, the language many websites run on. The NCSC says they may allow attackers to execute commands on web servers running PHP, and asks organisations to update. As of 23 October 2026, the US agency CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication".

The fix is the shop's job. You can't tell from the outside: the PHP manual says a server can be set up so that there's no way for users to tell PHP is being used. If a shop you use is affected and data was taken, our guide on whether your personal data is at risk explains how you'd be told and what to do.

What if I've already paid a fake shop?

Contact your bank. The NCSC says that if you've been tricked into making a payment, tell your bank and report it as a crime to Report Fraud in England, Wales and Northern Ireland, or to Police Scotland in Scotland. If you think someone else has used your card, it says to let your bank know straight away so they can block anyone using it, contacting the bank through its official website or phone number.

In the US, the FTC says to try to sort it out with the seller first, then report it at ReportFraud.ftc.gov.

More questions

Should I create an account with a new shop?

The NCSC suggests not, unless you think you'll become a regular customer, and says there's often an option to check out as a guest. It also advises not letting your browser or the shop store your payment details for future purchases.

Can good reviews make a fake shop look real?

Yes. The FTC says some reviews and ratings are fake or misleading, so don't rely on star ratings alone. Citizens Advice suggests reading reviews on several websites rather than the shop's own.

Does a website asking for lots of personal details mean it's a scam?

Not necessarily, but Citizens Advice says that if a site asks for information without an obvious reason, check it's legitimate before you give it.

Can visiting a dodgy shop website hack my device?

The PHP flaws are on servers, not your device. A hacked site can still show fake pages or push downloads, which our guide to whether visiting a hacked website can hack you covers. Our PHP2Shell explainer covers the flaws themselves.

Sources