How to Tell if an Online Store Is Legit, and What 26 Real Shops Look Like

This post contains affiliate links. If you buy something through one of them, Veravix may earn a commission at no extra cost to you.

Before you buy from a store you have never heard of, six checks in about two minutes will tell you more than most online “legitimate site checker” tools explain: how old the domain is, whether return and privacy pages exist and say something, whether you can reach a person, whether a business address or company name is stated, how the store takes payment, and what people say about it somewhere the store does not control. The padlock in the address bar is not on that list, and the data below shows why.

Searching for this topic returns a lot of checker tools that hand you a verdict without showing the evidence behind it. I wanted to know what the evidence looks like on shops that are plainly real, so on 2 November 2026 I measured 26 well-known direct-to-consumer online stores. This is the baseline: what normal looks like, so that something missing stands out.

The six checks, in the order I would run them

1. Look up the domain registration date. A registry lookup (RDAP, or the “whois” tool of any registrar) shows when the domain was first registered. A shop claiming years of history on a domain registered last month deserves a pause.
2. Open the returns and shipping pages. They should exist, be reachable from the footer and contain actual terms: time limits, who pays, how to start a return. An empty page or a pasted template that never names the store is a poor sign.
3. Find a way to reach a person. A contact form alone is the weakest option. An email address, a phone number or a postal address is better, and a business name is better still.
4. Look for who owns the shop. A company name, a registered address or a named founder on the About page. Anonymous stores are not always fake, but real ones usually have a reason to be findable.
5. Check how you will pay. A card processor or a payment service with buyer protection leaves you a way to dispute the charge. A request to pay by bank transfer, a gift card or a cryptocurrency wallet removes it.
6. Search for the store name plus the word “reviews” away from the store. Independent reviews, forum threads and complaint sites are outside the owner’s control. Reviews shown only on the store itself are not.

Why the padlock tells you almost nothing

The padlock means the connection to the site is encrypted and the certificate matched the domain. It does not mean the owner is honest. Certificates are issued to whoever can prove control of a domain, and free ones are available to everyone.

That showed up in the data. All 26 shops had a valid certificate, with no browser warnings and at least 34 days left on every one. Twenty used Let’s Encrypt, five used Google Trust Services and one used an Amazon certificate. Because every honest shop looks the same on this point, it cannot separate an honest shop from a dishonest one, and a checker that rewards the padlock rewards nothing. I covered the connection-level checks in detail in how to check website security online; they matter for your own site, not as a trust test for someone else’s.

What I measured, and what the sample is

I picked 26 established online stores, mostly clothing, coffee, accessories and home goods: Allbirds, Gymshark, Brooklinen, Bombas, Ruggable, Tentree, Kith, ColourPop, Huel, Ridge, Taylor Stitch, Chubbies, Outdoor Voices, Blue Bottle Coffee, Death Wish Coffee, Rothy’s, Glossier, Jeni’s, Magic Spoon, Bellroy, Peak Design, Nomad, Ugmonk, Hydro Flask, Yeti and Stanley. They are well known, and that is the limit of this survey. They are not small shops and they are not a random sample. I did not measure any scam shops, so this data cannot tell you which signals separate the two groups. It tells you what a legitimate store usually publishes.

• Domain age: the registration date from the Verisign RDAP service, which covers all .com domains.
• Certificate: a direct TLS connection on port 443, reading the issuer, validity and days remaining.
• Policy and contact pages: a script read each home page and looked for footer links labelled returns or refund, shipping or delivery, contact or help, privacy, terms and about. It then opened each policy link and counted it as real if the page loaded and held more than a few paragraphs of text. For the contact page it looked for a form, an email link, a phone number and a street address.

Five shops (Bombas, Ridge, Blue Bottle Coffee, Hydro Flask and Yeti) refused my script with a 403 or 429 response. Gymshark loaded, but its footer links are not in the page source a script reads, so I could not count them. I report the page-level results for the 20 remaining shops, and domain age and certificates for all 26.

Domain age: every shop was at least seven years old

The youngest domain, stanley1913.com, was registered in September 2019, making it 7.1 years old. The median across the 26 was 18.1 years, the oldest was 31.6 years, and 25 of the 26 were over 10 years old. None was under five.

That fits the first check, with two warnings. A young domain does not make a shop fake, since every real store was new once, and a domain can be bought already aged, so an old registration date is not proof either. It is one clue, worth about as much as the others.

What the 20 readable shops publish

Signal on the home page or contact page	Shops (of 20)
Contact link in the footer	20
Privacy policy link	19
Returns or refund link	18
Terms link	18
About link	17
Shipping or delivery link	13
Contact page with a form	18
Contact page with an email link	11
Phone number on the home or contact page	7
Street address on the home or contact page	6

Two things stand out. First, nearly every shop had a privacy page, a contact page and a returns page, and every policy link I followed opened a page with real text on it. A shop with none of them is further from normal than any other single signal I measured.

Second, the details people often treat as proof of honesty were less common than I expected. Only seven shops showed a phone number and only six a street address on the pages I checked, and ten showed neither. Only three showed both. If you would walk away from any store without a visible phone number, you would walk away from half of this list. A missing phone number is a reason to look at the other checks, not a verdict. Shipping information was also less common as a footer link than I expected, but several shops put it inside the returns page or the help section, so my check undercounts it.

Twenty of the 21 readable home pages carried Shopify’s page markers, which is a reminder that the platform tells you nothing either. Three quarters of the shops, 15 of 20, also loaded a third-party reviews widget, which is useful as a lead but sits on the store’s own page and is not independent proof.

What a legitimate site checker can and cannot see

I did not run any of the free checkers for this post, so I make no claim about how well they work. What the data does suggest is where a checker has to look. The padlock is identical everywhere, so it carries no information. Domain age and policy pages do vary and are worth weighing. And five of these 26 real stores refused an unfamiliar automated request, so a tool that reads a shop with a script can be blocked by a store that is perfectly honest. I do not know how any given checker scores a blocked fetch. It is worth knowing the tool may have seen less than you assume.

If you run a store: point the same checks at yourself

A new shop starts with none of the history these brands have, so the signals you control matter more. This is the list I would work through on a store I was about to launch.

• Link returns, shipping, privacy, terms and contact from the footer, using those plain words as the link labels. Both people and tools look for them.
• Put real terms on the returns page: the time window, who pays for shipping, how to start. Do not paste a template that never mentions your store.
• Offer more than a form. A monitored email address is the minimum, and a phone number, a postal address or a company name each add something most real shops skip.
• Name the owner on the About page, with a company name and registration number if you have one.
• Register the domain for several years, not one, and keep the registration details consistent.
• Encourage reviews on a platform you do not control and link to them.
• Keep the certificate renewing automatically and keep the site clean. A store that serves malware reads as untrustworthy to every checker, and Sucuri SiteCheck gives a quick remote look for the common signs. What it can and cannot see is covered in my malware scan guide.

Security headers and known plugin flaws are the next layer for a WordPress store. I tested headers on 63 real sites in my security headers guide and plugin flaws in the vulnerability scan guide.

What this survey did not check

• Whether any shop ships what it sells. No order was placed and no policy text was judged for fairness.
• How scam shops compare. I measured none, so I cannot say which signal best separates a fake from a real one.
• Whether the address and phone counts are complete. They come from text patterns on two pages. A number inside an image, a page I did not open, or an address in an unusual format would be missed.
• Payment methods, traffic and blacklist status. None was measured.
• The five blocked shops and Gymshark for page-level signals, as explained above.

Checked for accuracy on 2 November 2026. Domain ages come from the Verisign RDAP registration date for each .com domain. Certificate and page results were collected on 2 November 2026 from one request per page, so a store behind bot protection can show a result that differs from what a browser sees.