Five Checks That Take Two Minutes Before You Trust a New Website
Anyone who has clicked an ad for a suspiciously cheap graphics card knows the feeling. The site looks fine. The padlock sits in the address bar. And something in the back of your head still nags. Listen to it. Building a convincing website now takes an afternoon and a template, so looks prove very little. The five habits below take about two minutes in total, and they work whether you’re buying a keyboard, signing up for a game launcher or opening an account with a service you’ve never heard of.
The Padlock Only Tells Half the Story
That little lock means the connection between you and the site is encrypted. Nothing more. It doesn’t say the owner is honest, only that nobody can eavesdrop on the conversation. Free certificates are available to anyone who owns a domain, which is wonderful for the open web and equally wonderful for scammers. Click the padlock and look at the issue date. A certificate created three days ago on a site that claims to be a decade-old brand is a small red flag. Not a verdict, just a reason to keep digging.
Look Up When the Domain Was Born
Every domain carries a registration date, and it’s one of the cheapest signals you can get. The old WHOIS service lost its formal footing in early 2025, when ICANN’s port 43 requirement ended on 28 January and RDAP took over, but the habit hasn’t changed. Run the address through any RDAP lookup, including the one ICANN itself runs, and read the creation date. A shop that says “trusted since 2012” on a domain registered last month has some explaining to do. Age isn’t proof of anything, since old domains get sold and repurposed, yet a brand-new domain with big claims deserves a slower pace. Owner names are usually redacted now. The dates normally aren’t.
Find the Company Behind the Curtain
Scroll to the footer. A real operator names itself: a registered company, a registration number, a physical address, and an email that isn’t a free webmail account. Then search that company name away from the site. Does an official business register list it? Do people mention it anywhere that the site’s owner doesn’t control, such as forum threads or independent reviews? If the footer says only “© 2026” and offers a contact form, you’ve learned something.
One more habit belongs here. Pay with a credit card or a virtual card whenever you can, never a bank transfer to a personal account. Card networks give you a dispute route if the order vanishes. A transfer to a stranger rarely does.
Check the Licence, Then Check the Law
Some services sit in regulated areas such as banking, insurance or online gaming, and those add a layer worth knowing about. A licence quoted on a page is a claim. A licence listed on the regulator’s own public register is a fact, and the UK’s financial register is a good example of how searchable these can be. There’s a second catch: a company can hold a licence from one jurisdiction while serving customers in another, and the two don’t always line up.
It’s a handy exercise with a platform such as W88: find the operator the site names, see which body issued the licence it cites, read what that body actually covers, and confirm the service is permitted where you live, including the minimum age, before you go any further. Ten minutes of reading beats months of regret.
Lock the Account Down Anyway
Even an honest site can be breached, so assume your login will leak one day and arrange things so it matters less. A unique password for every service, kept in a password manager, is the biggest single upgrade. Check your email address on Have I Been Pwned to see which old accounts already turned up in a breach, because you’ll probably find one. Then switch on two-factor authentication. SMS codes beat nothing, and authenticator apps beat SMS.
Better still, take passkeys wherever a site offers them. A passkey is tied to the genuine domain, so it simply refuses to work on a lookalike page, which makes phishing far harder. It’s a neat piece of engineering, and in my view the most underrated security feature on your phone today.
Try the whole routine once on a site you already trust, just to see what a clean result looks like. After that, the dodgy ones tend to stand out on their own.
Five Checks That Take Two Minutes Before You Trust a New Website
Anyone who has clicked an ad for a suspiciously cheap graphics card knows the feeling. The site looks fine. The padlock sits in the address bar. And something in the back of your head still nags. Listen to it. Building a convincing website now takes an afternoon and a template, so looks prove very little. The five habits below take about two minutes in total, and they work whether you’re buying a keyboard, signing up for a game launcher or opening an account with a service you’ve never heard of.
The Padlock Only Tells Half the Story
That little lock means the connection between you and the site is encrypted. Nothing more. It doesn’t say the owner is honest, only that nobody can eavesdrop on the conversation. Free certificates are available to anyone who owns a domain, which is wonderful for the open web and equally wonderful for scammers. Click the padlock and look at the issue date. A certificate created three days ago on a site that claims to be a decade-old brand is a small red flag. Not a verdict, just a reason to keep digging.
Look Up When the Domain Was Born
Every domain carries a registration date, and it’s one of the cheapest signals you can get. The old WHOIS service lost its formal footing in early 2025, when ICANN’s port 43 requirement ended on 28 January and RDAP took over, but the habit hasn’t changed. Run the address through any RDAP lookup, including the one ICANN itself runs, and read the creation date. A shop that says “trusted since 2012” on a domain registered last month has some explaining to do. Age isn’t proof of anything, since old domains get sold and repurposed, yet a brand-new domain with big claims deserves a slower pace. Owner names are usually redacted now. The dates normally aren’t.
Find the Company Behind the Curtain
Scroll to the footer. A real operator names itself: a registered company, a registration number, a physical address, and an email that isn’t a free webmail account. Then search that company name away from the site. Does an official business register list it? Do people mention it anywhere that the site’s owner doesn’t control, such as forum threads or independent reviews? If the footer says only “© 2026” and offers a contact form, you’ve learned something.
One more habit belongs here. Pay with a credit card or a virtual card whenever you can, never a bank transfer to a personal account. Card networks give you a dispute route if the order vanishes. A transfer to a stranger rarely does.
Check the Licence, Then Check the Law
Some services sit in regulated areas such as banking, insurance or online gaming, and those add a layer worth knowing about. A licence quoted on a page is a claim. A licence listed on the regulator’s own public register is a fact, and the UK’s financial register is a good example of how searchable these can be. There’s a second catch: a company can hold a licence from one jurisdiction while serving customers in another, and the two don’t always line up.
It’s a handy exercise with a platform such as W88: find the operator the site names, see which body issued the licence it cites, read what that body actually covers, and confirm the service is permitted where you live, including the minimum age, before you go any further. Ten minutes of reading beats months of regret.
Lock the Account Down Anyway
Even an honest site can be breached, so assume your login will leak one day and arrange things so it matters less. A unique password for every service, kept in a password manager, is the biggest single upgrade. Check your email address on Have I Been Pwned to see which old accounts already turned up in a breach, because you’ll probably find one. Then switch on two-factor authentication. SMS codes beat nothing, and authenticator apps beat SMS.
Better still, take passkeys wherever a site offers them. A passkey is tied to the genuine domain, so it simply refuses to work on a lookalike page, which makes phishing far harder. It’s a neat piece of engineering, and in my view the most underrated security feature on your phone today.
Try the whole routine once on a site you already trust, just to see what a clean result looks like. After that, the dodgy ones tend to stand out on their own.
All articles
