How we rate websites

The four parts of the score

Part	What adds points
Security, up to 20	A valid HTTPS certificate (free ones count the same as paid), HSTS, and SPF and DMARC email records. An invalid certificate on a working site takes 10 points off, because your data is genuinely at risk.
Transparency, up to 20	Contact details, an about page, a privacy policy and terms linked from the home page, an email address on the site's own domain, and social media links.
Age and popularity, up to 15	One, three or ten years since registration, and a place in the Tranco list of the top million sites. These only add points. A new site simply starts without them.
Visitor reviews, up to ±10	The average rating from visitors, weighted by how many reviewed. One review moves the score by at most 2 points.

What makes a site red

The score is capped, whatever else the site does well, when we find one of these:

Dangerous (score 8 or lower): the domain is on the Phishing.Database list of active phishing domains, refreshed daily.
High risk (25 or lower): at least three different visitors report it as a scam, and they make up at least 60% of its reviews.
Suspicious (30 to 45 or lower): the address looks like it imitates a well-known brand, for example a brand name plus "login" or "refund", or a one-letter typo of a popular site. Sites that redirect to the brand or carry its certificate are excluded.
A shop that appears to accept only crypto loses 10 points, because those payments cannot be reversed.

What we show but never count against a site

A young domain. We label sites under six months old as "New website" so you know there is little history, but the score is not reduced.
Hidden owner details in the registry. Most registrars hide them by default.
The hosting company or registrar. Popular, cheap providers host millions of honest sites.
Low traffic, a free certificate, a site that blocks our check, or a registry that does not publish dates.

Where the data comes from

Registration dates and registrar: the official RDAP registry service, through rdap.org.
Certificate, DNS and home page: read directly by our server, which identifies itself as FraudPlatformsBot.
Popularity: the Tranco list, refreshed daily.
Phishing: Phishing.Database (MIT licence), refreshed daily.
Experiences: visitors to this site, one review per website per visitor.

rdap.org · Tranco · Phishing.Database

Limits

A clean result is not a guarantee. A brand-new scam site may have no reports yet, and an honest site may get an unfair review. That is why we show each finding separately. Read them, and pay with a method that offers buyer protection.