How to Tell If a Website Is Safe Before You Type Anything

The padlock means the connection is encrypted. It has never meant the site is honest, and phishing operators have had free certificates for years — which is why "look for the padlock" is now advice that actively misleads. The checks that still work take about twenty seconds and none of them involve the padlock.

[[answer]]Read the domain from right to left and take the last TWO segments before the first slash — that pair is the only piece an attacker cannot fake. Everything to the left of it, including a company name and the word "secure", can be set to anything. If that final segment is not the company you meant to visit, nothing else on the page matters.[[/answer]]

How to read an address correctly

Domains are hierarchical from the right. In paypal.com.account-verify.io the actual site is account-verify.io — everything before it is a subdomain the owner invented, and they can invent anything. This single reading habit defeats the majority of phishing links, because the majority rely on you scanning left to right and stopping at the first familiar word.

Two variations to know. Hyphenated lookalikes (secure-paypal.com) are separate domains with no relationship to the real one. And homograph attacks substitute characters from other alphabets that render identically — a Cyrillic "а" inside a Latin word. Modern browsers show such domains in punycode (xn--), which looks broken, and looking broken is the point.

[[steps]] Take the last two segments before the first slash :: In paypal.com.account-verify.io that is account-verify.io — the real site. Read that pair first, ignore everything to the left of it. Check for hyphens where you do not expect them :: Big brands rarely hyphenate their primary domain. Look for xn-- in the address bar :: The browser telling you the name contains foreign characters. Treat as hostile. Hover before clicking, always :: On desktop the target appears in the status bar; on mobile a long press shows it without opening. Type the address yourself when money is involved :: Slower, and it makes the entire class of attack impossible. Distrust the link, not the message :: A convincing message from a real acquaintance can still carry a link they were fooled by. [[/steps]]

What the padlock actually certifies

[[compare]] Signal | What it proves | What it does not prove Padlock / HTTPS | traffic is encrypted | anything about who runs the site Valid certificate | the domain controls the cert | that the domain is who you think Site looks correct | someone copied the CSS | nothing at all Domain matches exactly | you are where you intended | that the site is competent [[/compare]]

Free certificate authorities were an unambiguous improvement for the web, and one of their side effects is that encryption stopped being a trust signal. The FTC's phishing guidance now leads with sender and domain rather than with the padlock, which is the correct order.

The three-second checks that still work

Age of the domain. A public WHOIS lookup shows the registration date. A "bank" registered eleven days ago is not a bank. This is the single highest-yield check and almost nobody runs it.

How you arrived. Links from search results and from your own bookmarks are qualitatively safer than links from messages. Attacks overwhelmingly arrive through channels that create urgency: SMS, DM, email about an expiring account.

What is being asked. A page requesting a card number, a one-time code and a password together is describing an attack, because no legitimate flow needs all three at once. In particular, a one-time code is what a real service sends to you — it is never something a real service asks you to read out.

When you have already typed something

Speed matters more than diagnosis. Change the password on the real site first, from a different device if one is nearby, because the attacker's automation is often faster than a person. If you entered a card number, call the bank and freeze the card — the number is already circulating within minutes. If you read out a one-time code, the account is likely already accessed and the priority is revoking active sessions, which every major service exposes under security settings.

What not to do: do not return to the site to "check" it, and do not reply to the message that carried it. Both confirm you are a live target and both get you added to lists that get resold.

The version of this that is harder

Everything above assumes a fake site. The harder case is a real site that has been compromised — correct domain, correct certificate, legitimate history, and a payment form quietly swapped. Domain reading does not catch that. Two habits do: paying through a method with a chargeback path rather than a bank transfer, and taking seriously the moment a site you know suddenly asks for something it never asked for before.

That instinct, the small "this is not how this usually goes" reaction, is worth more than any checklist. It is also the thing urgency is engineered to override, which is why the messages always come with a deadline.

[[faq]] Do browser warnings catch phishing sites? :: Some. Blocklists lag by hours to days, and phishing domains are built to live for less time than that. A missing warning proves nothing. Is a green padlock ever meaningful? :: It means encrypted. Extended-validation indicators, which did suggest a vetted organisation, have been retired from most browsers. What about link shorteners? :: They hide the destination by design. Expand before opening, or treat as untrusted. Are QR codes riskier? :: Materially, yes — you cannot read a QR code before it resolves, and printed codes on public surfaces are frequently overlaid with stickers. How do I check a domain's age quickly? :: Any public WHOIS lookup, and it takes seconds. Registration date within the last few months for an established brand is a strong warning. [[/faq]]