Website Legit Checker: Is This Website Legit? Online Store Risk Signals and Trust Score

Website Legit Checker helps you check whether an online store or website looks legit by collecting public risk signals for each domain, up to 200 domains per run. For every domain you get a trust score from 0 to 100, a risk signal level and the reasons behind it: domain age and registrar, TLS certificate, email records, third-party phishing and scam blocklists, legal pages (imprint, privacy, terms, returns), the physical address, the company behind the site matched against an official register, payment methods, social profiles and unusually low pricing.

The result is an automated set of signals to help you decide where to look closer. It is not a statement of fact about any merchant, and every row says so in its disclaimer field.

What it does

For each domain or URL you enter, the Actor:

1. Reads the domain registration from the official registry over RDAP: registration date, age in days, expiry, registrar and status codes (such as "client hold" when a registry has suspended a domain). Only RDAP is used, never bulk WHOIS. At most 100 registry lookups are made per run, paced per registry, and .de domains are not looked up at all because DENIC allows its data only for technical or administrative purposes.
2. Checks DNS: MX records (can the domain receive email?), SPF and DMARC.
3. Checks the TLS certificate: valid or not, issuer, valid from and to, days left. After robots.txt allows it, it also checks whether plain http redirects to https.
4. Looks the domain up in third-party public blocklists of phishing, scam and malware domains. No connection at all is made to a listed website (no TLS check, no page request); only DNS and the list data are used.
5. Reads the homepage and up to 6 legal pages by default (you can raise this to 10) linked from it (imprint, contact, returns or refund policy, terms, privacy, about, shipping). robots.txt is read first, and the website gets one request at a time.
6. Detects the shop platform (Shopify, WooCommerce, Magento, BigCommerce, Wix, Squarespace, Shopware, PrestaShop, Shopline, Shoplazza and more), visible payment methods and social media links.
7. Finds the contact details: emails (own domain or free mail), phone numbers and a physical address, with the exact line from the site.
8. Finds the company name behind the site and looks it up in the GLEIF LEI register (and UK Companies House if you add a free key).
9. Samples up to 30 products from the public catalog of Shopify and WooCommerce stores to measure discounts, and notes unusually low pricing such as branded goods at 80 to 90 percent off.
10. Spots parked, for-sale and placeholder pages, and handles dead domains and redirects.
11. Adds an AI assessment with probabilities: are the legal pages genuine and specific to this business, how complete are they, is a physical address stated, are prices unusually low for the goods.
12. Combines everything into a trust score from 0 to 100 with a list of reasons, each with its points, so you can see exactly why a site scored as it did.

Who uses it

• Payment providers and marketplaces onboarding merchants (KYB and merchant risk checks).
• AI shopping and payment agents that need a legitimacy check before buying from an unknown store.
• Affiliate networks, ad networks and lead platforms screening the sites they send traffic to.
• Fraud and trust and safety teams triaging reported domains for manual review.
• Chargeback and dispute teams gathering signals before a person reviews a merchant.

The results are meant for your own internal review. Please do not publish the score or risk level as a statement about a named merchant.

Output

One row per domain. Main fields:

Field	What it means
trustScore	0 to 100. Higher means more signals of a real, accountable business
verdict	Risk signal level: few_risk_signals (75+), some_risk_signals (55 to 74), several_risk_signals (35 to 54), many_risk_signals (below 35), or not_enough_data when the website could not be read and nothing stands out at domain level
disclaimer	In every row: automated risk signals only, not a statement of fact about the merchant; verify before acting
status	checked, parked, unreachable, not_registered, invalid_input or error
summary	One sentence with the main risk signals and positive signals
reasons	Every signal with its points, strongest first
checkCoverage	full when legal pages were read, homepage_only when only the homepage could be read (for example a site built entirely with JavaScript), domain_only when only domain, TLS, email and blocklist checks were possible
domainAgeDays, domainRegistration	Age, registration date, expiry, registrar, status codes (RDAP); a note when the registry was not queried
tls, httpsRedirect	Certificate validity, issuer, dates, days left; http to https redirect
emailSecurity	MX, SPF, DMARC and its policy, nameservers
blocklists	listed and the hits with the list name
legalPages	For imprint, privacy, terms, returns, shipping, contact, about: found, URL, word count, template placeholders
legalPagesAssessment	AI probability that the pages are genuine, completeness 0 to 4, clear returns terms, consistent details
contact	Emails, phones, physical address probability and the exact address line from the site
companyName, registryMatch	Company named on the site; register match with ID, legal name, status and link
platform, paymentMethods, socialLinks	Shop platform, payment methods visible, social profile links
pricing	Products sampled, share on sale, median and max discount, AI probability that prices are unusually low (unusualPricingProbability)
parkedSignals, parkedProbability	Why the page looks parked or for sale
finalUrl, redirectChain, redirectedToOtherDomain	Where the domain ends up
siteBlockedReason	Why the website content was not read (robots.txt, bot protection, blocklist)

A run summary with counts per status and verdict and the blocklists used (with entry counts and download time) is saved as SUMMARY in the key-value store.

How to run

1. Paste your domains or URLs into Domains or website URLs, one per line.
2. Keep the defaults, or turn off the AI assessment, the register lookup or the price check.
3. Optional: add a free UK Companies House API key to match UK companies.
4. Start the run and download the results as JSON, CSV or Excel, or open the Trust check table view.

Example output

A real row for zalando.de (shortened):

{
  "input": "zalando.de",
  "domain": "zalando.de",
  "status": "checked",
  "trustScore": 93,
  "verdict": "few_risk_signals",
  "checkCoverage": "full",
  "summary": "Few risk signals (trust score 93/100). Main positive signals: Company found in GLEIF LEI register: Zalando SE (ACTIVE); AI check: legal pages are specific to this business (probability 0.95).",
  "tls": {"valid": true, "issuer": "Let's Encrypt", "validTo": "2026-11-30", "daysLeft": 30},
  "emailSecurity": {"mx": true, "spf": true, "dmarc": true, "dmarcPolicy": "reject"},
  "blocklists": {"listed": false, "hits": []},
  "contact": {"physicalAddressProbability": 0.99, "addressLine": "Zalando SE, Valeska-Gert-Straße 5, 10243 Berlin, DE"},
  "companyName": "Zalando SE",
  "registryMatch": {"verdict": "match", "source": "GLEIF LEI register", "registryId": "529900YRFFGH5AXU4S86",
                    "legalName": "Zalando SE", "country": "DE", "registrationStatus": "ACTIVE"},
  "paymentMethods": ["Visa", "Mastercard", "American Express", "Discover", "PayPal", "Apple Pay", "Klarna", "SOFORT", "SEPA direct debit", "Bank transfer"]
}

A made-up shop registered four days before the check, with template legal pages and the website builder's sample email address as contact (shortened):

{
  "status": "checked",
  "trustScore": 23,
  "verdict": "many_risk_signals",
  "disclaimer": "Automated risk signals only, not a statement of fact about the merchant or its business; verify before acting.",
  "domainAgeDays": 4,
  "platform": "Wix",
  "contact": {"emails": ["info@mysite.com"]},
  "reasons": [
    {"code": "domain_age", "points": -25, "text": "Domain registered less than 30 days ago (4 days)"},
    {"code": "template_placeholders", "points": -8, "text": "Legal pages contain template placeholders such as \"info@mysite.com\""},
    {"code": "legal_genuine", "points": -8, "text": "AI check: legal pages look generic, copied or incomplete (probability genuine 0.02)"},
    {"code": "address", "points": 6, "text": "A physical business address is stated"}
  ]
}

API use

Run it from your own code or an AI agent with the Apify API or the Apify MCP server:

curl -X POST "https://api.apify.com/v2/acts/reliable_tools~website-legit-checker/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"domains": ["shop.example.com", "another-store.com"]}'

Python:

from apify_client import ApifyClient
client = ApifyClient("YOUR_TOKEN")
run = client.actor("reliable_tools/website-legit-checker").call(run_input={"domains": ["allbirds.com"]})
for row in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(row["domain"], row["trustScore"], row["verdict"])

Pricing

Pay per event, no subscription:

Event	Price
Website checked (all checks and the trust score)	$0.02
Actor start	$0.00005 per run

Invalid inputs, domains that are not registered and domains without a working website are free. Platform usage is included in the price.

Data sources and licences

Source	What we use	Licence or terms
Domain registries over RDAP (IANA bootstrap)	Registration date, registrar, status	Public registry data service, query based: at most 100 lookups per run, paced per registry, no WHOIS, .de not queried (DENIC terms)
DNS	MX, SPF, DMARC, nameservers	Public DNS
The website itself	Homepage and up to 6 linked legal pages (10 if you raise the limit), public product catalog	Public pages, robots.txt read first and respected, honest bot name ReliableToolsBot, no proxies
GLEIF LEI register	Legal name, country, status	CC0
UK Companies House (optional, your key)	Company name, number, status	Open Government Licence v3
Phishing.Database (active phishing domains)	Domain list	MIT
ShadowWhisperer BlockLists (Scam, Malware)	Domain lists	Unlicense
durablenapkin scamblocklist	Fake shop and scam domains	MIT

Lists that do not allow commercial use (such as the free tiers of OpenPhish, URLhaus and PhishTank) are not used. Blocklist entries are third-party data; a listing can be outdated or wrong.

This Actor is not affiliated with or endorsed by GLEIF, DENIC, Verisign, UK Companies House, any domain registry, the blocklist maintainers or any website it checks.

Limits and fair use

• Up to 200 domains per run and at most 100 domain registry lookups per run. Split larger lists into several runs.
• .de domains get no registration date, because DENIC allows its registry data only for technical or administrative purposes.
• Websites that block bots or ask them not to crawl in robots.txt are not read; we never work around that.

Data protection

The Actor reads public pages of the websites you enter, including imprint and contact pages. For small businesses and sole traders these pages can contain personal data such as a name, business address, email or phone number, which then appears in the contact and companyName fields. When the AI assessment is on, short excerpts of these public pages are sent to our AI provider, which acts as a processor and returns probabilities only. Turn off AI assessment to keep all processing on the Apify platform. Results are stored in your own Apify account, where you control retention. Use the results only for a legitimate purpose such as merchant review, and do not republish them as statements about named businesses or people.

FAQ

How do I check if a website is legit? Enter the domain and read the trustScore, verdict and reasons. A new domain, no physical address, generic legal pages, only crypto or wire transfer payments and huge discounts on brand goods are common risk signals that deserve a closer look.

Does a low score mean a site is a scam? No. The score combines automated public signals to show you where to look closer. It is not a statement of fact about any merchant. A brand new but honest shop can score low at first, and a site behind strong bot protection can only be scored on its domain, certificate and email records.

Why was the website content not checked for some big stores? Some large sites block automated requests or ask bots in robots.txt not to crawl. We respect that and never work around it, so these sites are scored on the domain level checks only and siteBlockedReason says why.

Why is the domain age missing for .de, .es or .it domains? Some registries do not offer public RDAP, do not publish the registration date, or (like DENIC for .de) allow their data only for technical purposes, so we do not query them. The field then stays empty and has no effect on the score.

Does it visit phishing sites? No. If a domain is on one of the blocklists, no connection is made to the website at all: no page request and no TLS check. Only DNS records and the list data are used.

Why does a company show "not_found" in the register? The global LEI register mostly covers larger companies and regulated businesses. Most small shops have no LEI, so a missing record is not counted against the site.

Does it work for any platform? Yes. Shopify and WooCommerce stores also get a price check from their public catalog; other sites are checked from their homepage and legal pages.

Can I use it in an AI agent? Yes. The input is a simple list of domains and every row has a score, a risk signal level and plain-language reasons, which works well as a tool for shopping and payment agents.

Something broke or a field is missing? Open an issue on the Issues tab and we'll look at it.

About Reliable Tools

This Actor is made by Reliable Tools. We build scrapers that return clean data plus an AI label with a confidence score, so you can filter and act on the results straight away. Our focus is e-commerce, product sourcing and lead research.

If a field is missing or a store doesn't parse the way you expect, open an issue on the Issues tab. We read every one and usually reply within a day. You can find our other Actors on our profile page.