How Our Trust Score Works

Every website we check is given a trust score out of 100. This page explains exactly how that number is produced, what it is based on, and what it cannot tell you. If you disagree with a score, our corrections policy explains how to ask us to review it.

Where the data comes from

Three sources feed every check. Complaint records published by the U.S. Federal Trade Commission and the FBI Internet Crime Complaint Center. Public domain registration and SSL certificate data for the website being checked. Reports submitted by readers of this site, which are read by a person before they are published.

How the score is calculated

Every website starts at 100 points. Points are then deducted for each risk signal we can verify.

Domain age

Registered less than 30 days ago deducts 35 points. Less than 6 months deducts 20 points. Less than a year deducts 8 points. Over a year is treated as a positive signal and deducts nothing. If the registration date cannot be verified at all, 12 points are deducted, because an unverifiable record is itself a weak signal.

SSL certificate

A valid certificate deducts nothing. No valid certificate deducts 20 points.

Complaint reports on file

Each report on file deducts 6 points, capped at 45 points in total. The cap exists so that a single coordinated complaint campaign cannot drive a score to zero on its own.

What the bands mean

A high score is shown as Looks Safe, a middle score as Use Caution, and a low score as High Risk. These are summaries of the signals above, not verdicts about the people or company behind a website.

How often it updates

A score is recalculated when a website is checked and the stored result has expired, and again whenever a new report about that website is approved. The date of the most recent check is shown on each report page.

What this score cannot tell you

A low score does not prove that anyone has broken the law. A high score does not guarantee a website is safe, because a brand new scam site can have clean registration and a valid certificate on its first day. The absence of reports means only that nobody has reported it to us yet. Domain and certificate data can be incomplete or out of date at the source, and we reproduce what those sources publish.

Treat the score as one input into your own judgement, not as a substitute for it. If you have already lost money, our emergency guide lists the steps that matter most in the first hour.