Website safety checkers are useful, but only if you know what they actually look at. Google Safe Browsing flags known phishing and malware URLs. VirusTotal aggregates 70+ scanner engines. URLVoid checks blocklists. Sucuri SiteCheck scans for injected code. None of them, on their own, will tell you whether a shop will actually ship your order. Layering two or three tools takes about ninety seconds and catches most of what a single check misses.
What “safe” actually means to a checker
The word safe gets used loosely. In the world of website checkers it maps to three very different questions: is this domain a known bad actor, is the page currently serving malicious code, and is the certificate/host configured properly. Most tools answer one of those questions well and the other two poorly. That is why relying on a single scanner produces false confidence.
Before we look at individual tools, a quick reference on how they get their data:
- Blocklist databases — curated lists of URLs known to distribute malware, host phishing kits, or run scams. Google Safe Browsing, PhishTank, and Spamhaus feed most of these.
- Multi-engine scanners — services that fan a URL out to dozens of antivirus and reputation engines. VirusTotal is the reference example, with more than 70 partner engines as of 2026.
- Live crawlers — tools that fetch the page and analyse the response for injected scripts, malicious redirects, or defacement. Sucuri SiteCheck and Quttera work this way.
- Passive reputation signals — WHOIS age, SSL issuer, hosting country, historical DNS. ScamAdviser and URLVoid lean heavily on this layer.
The seven tools worth knowing (and what each one really detects)
1. Google Safe Browsing
Google Safe Browsing powers the “Deceptive site ahead” warning in Chrome, Firefox, Safari, and Android. It protects more than 5 billion devices according to Google’s transparency report. Strength: unmatched reach on phishing and malware URLs. Weakness: it only tells you what is already known bad; a freshly registered scam site can stay green for days. Check any URL at transparencyreport.google.com/safe-browsing/search.
2. VirusTotal
VirusTotal is the Swiss army knife. Paste a URL and it queries 70+ engines including Kaspersky, Sophos, BitDefender, ESET, Fortinet, and Google Safe Browsing itself. Strength: consensus across engines is a strong signal. Weakness: a single engine flagging is often a false positive, and the interface is intimidating for non-technical users. Rule of thumb: three or more engines flagging the same URL is worth taking seriously.
3. URLVoid and IPVoid
URLVoid checks a domain against roughly 30 reputation blocklists (Spamhaus, PhishTank, OpenPhish, and more). IPVoid does the same for the underlying IP address. Strength: cheap way to see if a domain lives on a bad-neighbourhood host. Weakness: no live page scanning; a compromised legitimate site will look clean until a blocklist notices.
4. Sucuri SiteCheck
Sucuri actually fetches the page and inspects the DOM for injected JavaScript, malicious iframes, spam SEO content, and known malware signatures. Strength: catches compromised legitimate sites that reputation tools miss. Weakness: false negatives on very fresh infections and no verdict on the seller’s honesty. Available at sitecheck.sucuri.net.
5. ScamAdviser
ScamAdviser combines WHOIS age, hosting reputation, SSL, blocklist data, and user reviews into a 1–100 trust score. Strength: fast, non-technical read on brand-new domains. Weakness: the score is a heuristic. Legitimate niche shops sometimes score in the 30s because they are young and low-traffic; established scams that have gamed the signals sometimes score in the 70s. Use it as one input, not a verdict.
6. WHOIS lookup
Not a “checker” in the classic sense, but essential. A WHOIS record shows when a domain was registered, by whom (if not redacted), and where it is hosted. Scam shops overwhelmingly use domains under 90 days old with redacted ownership. If a “20-year-old established brand” turns out to have registered its domain last month, that alone is a decisive red flag.
7. Web directories with editorial curation
Directories like Webwiki, Trustpilot, and the Better Business Bureau add a signal none of the technical scanners can: months or years of actual user experience with the site. A directory listing with hundreds of consistent reviews across time is much harder to fake than a clean scanner result on a two-week-old domain.
The 90-second layered check
You do not need to run every tool for every URL. This routine takes under two minutes and catches the overwhelming majority of dangerous sites:
- Google Safe Browsing — 10 seconds. Instant kill on known-bad URLs.
- WHOIS age — 20 seconds. Anything under 90 days on a “big brand” claim is a strong warning.
- VirusTotal or URLVoid — 30 seconds. Confirms whether reputation engines have flagged the domain.
- A web directory search — 30 seconds. Look for a consistent review history over time, not a wall of five-stars posted in one week.
If all four come back clean and you still get a bad feeling, trust the feeling. Scanners are pattern-matchers; your intuition on tone, product photography, pricing, and copy is often the earliest warning system.
Three concrete data points to keep in mind
Anti-Phishing Working Group data for the second half of 2025 recorded over 1 million unique phishing sites per quarter, most of them living less than 48 hours. Google’s Safe Browsing team blocks roughly 100 million phishing attempts every day. And a 2024 study by NortonLifeLock found that around 22% of scam shopping domains had their SSL certificate issued within seven days of the fraud campaign. That last number is the reason “it has HTTPS” is not enough — a valid certificate takes minutes to issue and tells you nothing about the intent behind the site.
FAQ
Is a green padlock the same as a safe website?
No. The padlock only confirms that traffic between your browser and the server is encrypted. Scam sites can and do get free SSL certificates in minutes.
If VirusTotal shows zero detections, is the site definitely safe?
Not necessarily. Fresh scam sites can go days before any engine catches them. Combine VirusTotal with WHOIS age and a directory search for a fuller picture.
Which single tool should I use if I only have time for one?
Google Safe Browsing plus a quick WHOIS check. Together they catch most known-bad URLs and expose the majority of freshly minted scam domains.
Can a legitimate site be flagged by mistake?
Yes. False positives happen, especially when a site shares hosting with bad actors or briefly hosted a compromised plugin. Cross-check with at least one other tool before treating a single alert as final.
Do these tools work on shortened URLs (bit.ly, t.co)?
Most will follow the redirect and analyse the destination. If a tool refuses, use a URL-expander like unshorten.it first, then rescan.
Related reading
- How to Tell If a Website Is Trustworthy: The Complete Checklist
- How to Check If a Website Is Safe Before You Click
- How to Check If a Website Is a Scam: 12 Warning Signs
- How to Verify a Website’s Legitimacy in Under 2 Minutes
Sources and further reading
- Google Safe Browsing Transparency Report — transparencyreport.google.com/safe-browsing/overview
- Anti-Phishing Working Group, Phishing Activity Trends Reports — apwg.org/trendsreports
- VirusTotal Documentation — docs.virustotal.com
- Sucuri Blog on website compromises — blog.sucuri.net