Website Safety Checker

Paste the URL above and run the check. The report shows each source separately: threat databases when they are available on the server, a page-behavior fetch that inspects transport and redirects, and instant checks your own browser computes, like lookalike characters in the domain. The headline always states how many threat sources actually ran and when, so you can judge how much the result covers. Combine it with the red-flag checklist on this page before trusting a site with money or passwords.

No, and any tool that claims it can is overselling. This checker never uses the word safe in a verdict. The best possible result reads "no known threats, with full configured coverage", which means every configured threat source ran and none had anything on the URL at that moment. Brand-new scam sites have not been reported anywhere yet, so they pass every database on day one. Treat results as observations with a timestamp, not a guarantee.

It means one or more threat databases could not be consulted for your check, because a source was unavailable, timed out, or is not configured on the server right now. The tool refuses to show a clear result built on missing coverage: a source that did not run can never count as a pass. The per-source rows show exactly which databases answered and which were unavailable.

By default the query string and fragment are removed before the URL leaves your browser, and any embedded credentials are always stripped. The preview under the input shows the exact address that will be sent. This matters because full URLs can carry password-reset tokens, signed download links or session identifiers; never submit a private or authenticated URL to any online scanner, this one included. Checked URLs are not logged into analytics and results have no public permalink.

URLhaus is a free database run by abuse.ch, a respected non-profit security project, tracking URLs observed actively distributing malware. It is deliberately scoped: it is a malware-distribution feed, not a general phishing list, which is why this tool labels it that way and never converts a URLhaus miss into an overall clearance. If a URL you check is listed there, do not open it.

It tells you whether security vendors have flagged your own site. Sites usually land on blocklists after being hacked: a vulnerable plugin gets exploited and the site starts hosting phishing pages or malware without the owner noticing. Once listed, browsers show warning pages, search traffic collapses and email deliverability drops. The site-owner section below lists the delisting routes; run your own domain through this checker regularly, or automate the monitoring.

Punycode lets domains contain non-Latin characters, encoded with an xn-- prefix. Attackers abuse it to register domains that render almost identically to a brand, like apple.com written with a Cyrillic letter a. This checker analyzes each label of the hostname in your browser, flags labels that mix Latin with lookalike scripts, and shows the technical hostname, so a URL that looks familiar but is a different domain gets caught before you click. It also shows the registrable domain, the only part that identifies who you are talking to.

Threat databases require server-side credentials and quotas, and any source can time out or fail. When that happens the row says unavailable and the verdict accounts for it: an unavailable source is never treated as a pass, and if no threat database ran at all the headline says coverage incomplete instead of showing a reassuring result. That is deliberate; a green light built on sources that did not answer would be a lie.