Check domain, HTTPS, contact, reviews.
Introduction
Website Checkmate was built to answer four questions: Is this website real? Is it safe? Is it healthy? Is it built to convert? This guide focuses on how to tell if a website is legitimate. Most teams treat website problems as design problems. In reality, half of the issues are foundation problems and half are conversion execution problems. When foundation is weak, even great copy and offers underperform because browsers show warnings, search suppresses visibility, and mobile users bounce.
The real backend analyzer at /api/analyze fetches your public homepage server-side with SSRF protection, checks DNS resolution, follows redirects safely, enforces timeout and max bytes, inspects HTTPS, HSTS, Content-Security-Policy, X-Content-Type-Options, mixed content, title, meta description, H1, viewport, language, canonical, form presence, CTA wording, image alt coverage, and insecure assets. It returns REAL, SAFE, HEALTHY statuses with a technical score 0-100 and prioritized issues. The 8-question check captures what a crawler cannot know.
Why this topic matters
Visitors decide in under five seconds whether to stay. If the headline does not explain the offer, if the primary call to action is not obvious, if there is no easy way to leave contact information, and if there is no proof, they leave. Technical health impacts trust before any reading happens. A missing viewport tag breaks mobile layout. A missing H1 confuses search. No HTTPS triggers browser warnings. Low alt coverage hurts accessibility. Missing canonical creates duplicate content risk. These are small signals that compound.
For how to tell if a website is legitimate, the key is to separate what is observable from what requires business context. Observable signals can be automated. Business context — whether you follow up, whether you know drop-off, whether you can name the single most important improvement — requires your answers. That is why Website Checkmate combines both.
Deep diagnostic breakdown
1. REAL check — reachability
REAL means the public domain resolves via DNS and returns an HTTP response. It does not mean legal business verification. The analyzer blocks localhost, .localhost, .local, private IPv4 ranges (10/8, 172.16/12, 192.168/16, 127/8, 169.254/16), link-local, multicast, and private IPv6 (fc00::/7, fe80::/10, ::1). It resolves hostname before fetch and re-validates after every redirect, with max 4 redirects and 9 second timeout. If DNS fails or status is 4xx/5xx, REAL is problem. This protects you from misconfigured domains and typos.
2. SAFE check — basic transport safety
SAFE checks HTTPS on final URL, mixed HTTP assets, HSTS, CSP, and X-Content-Type-Options, and flags password fields over HTTP. Important: this is a basic signal, not a malware-free or fraud-free guarantee. Language matters: we say "HTTPS works and basic security signals were detected" for pass, and "HTTPS works, but additional security configuration should be reviewed" for check. Never claim guaranteed secure.
3. HEALTHY check — fundamentals
HEALTHY scores title length, meta description length, H1 presence, viewport, language attribute, canonical, contact/lead form detection, CTA wording presence, image alt coverage, and insecure assets. Scoring starts at 100 and deducts. 75-100 is healthy foundation, 50-74 needs attention, 0-49 significant problems found. Issues are returned, but only top 3 are prominent in UI to avoid overwhelm.
Practical checklist for How to Tell if a Website Is Legitimate
- Verify domain resolves and www vs apex handling is consistent with single canonical
- Enforce HTTPS with 301 redirect from HTTP and enable HSTS after testing
- Ensure final URL uses HTTPS and no mixed http:// src attributes remain
- Check title is 30-60 characters and unique per page, meta description 120-155 characters
- Ensure one H1 per page describing the primary offer, logical H2/H3 hierarchy
- Add viewport meta tag: width=device-width, initial-scale=1
- Add lang attribute to html tag and canonical link
- Make primary CTA visible above the fold with clear verb: Get Started, Book Call, Request Quote
- Add lead capture that takes under 10 seconds: email field + clear privacy note
- Show proof: reviews, examples, case studies, real contact info, not stock testimonials
- Audit image alt attributes: aim for >80% coverage, descriptive not keyword stuffed
- Test on mobile: tap targets 44x44, readable font sizes, no horizontal scroll
- Set up basic tracking of drop-off to know which step loses visitors
- Document single most important improvement to make next
Examples
Example 1: A consulting site with title "Home" and no meta description scored 52/100 healthy. After updating title to "B2B Operations Consulting for Series A Startups" and adding meta description, H1, viewport, and one CTA "Book Diagnostic Call", score moved to 81 and conversion answers improved from 6 to 12. Example 2: An ecommerce homepage loaded 12 http:// images on https://. Mixed content caused browser warnings. Fixing src to https:// raised SAFE from check to pass and reduced bounce.
What to do next
Run your own site through Website Checkmate. Note REAL, SAFE, HEALTHY and technical score. Then answer the 8 conversion questions honestly: 0 for no/not sure, 1 for partly, 2 for yes. Your conversion score max is 16. Classification: 13-16 strong foundation, 9-12 needs attention, 5-8 conversion problems, 0-4 significant leaks. Focus on top 3 priorities. Fix foundation first if technical is below 50 or SAFE is problem. Then fix clarity and CTA.