How We Review & Score Websites

Our Review Principles

Three commitments shape everything on this page:

• Explainable. Every score comes with the signals behind it. You should never have to take a number on faith.
• Consistent. The same site, checked under the same conditions, gets the same result. We apply the same method to a global brand and a one-week-old shop.
• Honest about uncertainty. We flag when data is thin, when a site is too new to judge, and when a result may be wrong.

The Five Pillars

A trust score blends five independent checks. The weight next to each is its default contribution; weights can shift when a signal is especially strong (for example, a confirmed blocklist hit can cap the whole score regardless of the other pillars).

How a Check Runs

1. Normalise the input. We clean the address you enter – stripping protocols and tracking, resolving the real host.
2. Gather signals. We pull together the data points for each of the five pillars, drawing on live checks and reputable data sources.
3. Score each pillar. Every pillar is scored on its own 0–100 scale from its signals.
4. Weight and combine. Pillar scores are weighted into a single trust score, with safety signals able to override the rest.
5. Explain the result. We surface the positives and warnings that moved the score, so you can judge for yourself.

Turning Signals Into a Score

Each pillar's sub-score is a weighted blend of its own signals. The overall trust score is then the weighted average of the five pillars – except where a hard signal applies. Hard signals are findings serious enough to cap the score on their own, such as a confirmed malware or phishing blocklist hit, a credential-harvesting or payment-fraud pattern, or a brand-impersonation look-alike domain.

When a hard signal is present, the overall score is capped in the "Dangerous" or "Risky" band regardless of a site's authority or age – because a well-ranked site can still be compromised.

What Each Score Band Means

Dangerous (1–39): strong scam or malware signals – don't interact. Risky (40–54): several red flags; treat with real caution. Use caution (55–69): mixed signals; verify the company first. Trusted (70–84): established, encrypted and clean. Safe (85–100): a long track record, healthy authority and no warning signs.

Where Our Data Comes From

A score is only as good as its inputs. We combine:

• Live technical checks we run ourselves – encryption, certificate, redirects, and page structure;
• Reputable security feeds – malware, phishing and spam blocklists;
• Authority and traffic data – domain rating, backlink and traffic estimates from established providers;
• Registration data – public WHOIS and DNS records; and
• Community reports – scams flagged by our readers, reviewed by our team before they affect scoring.

These come from a mix of our own infrastructure and licensed third-party APIs; estimates (such as traffic) are approximate by nature.

Editorial Independence

Our reviews and scores are editorially independent. Where we earn revenue – through advertising, clearly labelled sponsored content, or affiliate links in reviews – it is kept strictly separate from how sites are scored. If a conflict of interest could exist, we disclose it.

The Limits of an Automated Score

We want you to use our scores well, which means knowing what they can't do:

• A score is a snapshot. A safe site can be hacked tomorrow; a new site can be perfectly legitimate.
• A high score is not a guarantee, and a low score is not proof of wrongdoing – it's a signal to look closer.
• Brand-new or very small sites have little data, so their scores carry more uncertainty.
• Our tools measure safety and authority signals – they do not judge the quality of a product, service, or seller.

Always combine a score with your own judgement: look for a real company, genuine reviews, and secure payment, and never pay by gift card, crypto, or bank transfer to an unknown seller.

Updates, Re-Scans & Disputes

Sites change, so scores are re-evaluated when a site is checked again and periodically for popular domains. If you own a site and believe its report is wrong or out of date, you can request a re-scan and a human review through our Complaints & Corrections page. We review evidence-based requests and update reports where the data supports it.

Who Writes and Maintains This

This methodology is owned by the TechJox Research Desk – the same team that writes our security reporting and builds our tools. We review the methodology regularly and update this page whenever the approach changes, with the date shown at the top. Questions or suggestions are welcome: