Check Before
You Click.
Analyze a website for scam and security warning signs before you buy, sign in, or share your information.
ScamGuard provides a risk assessment based on available signals. No automated system can guarantee that a website is safe.
What ScamGuard checks
Six categories of signals are combined into a single, explainable risk assessment.
Domain
Domain age, registration information, and suspicious naming characteristics.
Security
HTTPS, certificate information, redirects, and technical security signals.
Reputation
Available reputation and threat intelligence signals.
Business
Business identity, contact information, policies, and transparency.
Website Behavior
Suspicious redirects, unusual behavior, and technical indicators.
Scam Signals
Patterns commonly associated with fraudulent websites.
How ScamGuard works
Four steps take you from a pasted link to a plain-English understanding of the risk.
Paste
Paste the website URL into the scanner.
Analyze
ScamGuard checks available security, domain, and website-structure signals.
Evaluate
The scoring engine combines the evidence collected from each check.
Understand
You receive a risk score and a clear, plain-English explanation.
ScamGuard runs a real, transparent URL-structure heuristic engine entirely in your browser — it looks at the actual link you paste (protocol, hostname, TLD, subdomains, known shortener domains, brand-lookalike patterns, and similar structural signals). It does not fabricate domain-age, certificate, or reputation data.
A server-side check also runs on every scan: domain age/registrar via a live RDAP (WHOIS) lookup, safe redirect-chain following (SSRF-guarded — private/internal targets are refused before anything is fetched), and, when configured, a Google Safe Browsing lookup against known malware and phishing URLs. TLS certificate chain inspection is not yet connected. If a live check fails, times out, or isn't configured, that specific field is honestly marked Not available with the real reason — never faked.
Know the patterns scammers use
Tap a card to learn what it is, the warning signs, how scammers use it, and how to protect yourself.
Simple, transparent plans
Start free. Upgrade when you need deeper reports and monitoring.
- ✓ 5 website scans per day
- ✓ Risk score & risk band
- ✓ Warning signs & positive signals
- ✓ Scan history (stored on this device)
- ✓ 100 scans / month
- ✓ Full technical details
- ✓ Extended scan history
- ✓ Watchlist with alerts
- ✓ Advanced reputation checks (SSL)
- ✓ 1,000 scans / month
- ✓ Bulk URL & CSV scanning
- ✓ API access
- ✓ Team membersComing soon
Why ScamGuard exists
Fake online stores, phishing pages, and impersonation sites are built to look convincing in the seconds before someone enters a password or a card number. ScamGuard exists to slow that moment down — giving people a clear, evidence-based second opinion before they click, sign in, or pay.
ScamGuard doesn't claim to catch every scam or guarantee that any website is safe. It's built to be honest about what it actually knows: every signal shown in a report is one ScamGuard's checks genuinely found, and every check it couldn't run is labeled as unavailable rather than guessed at.
The goal is simple: help ordinary people make a more informed decision, in plain language, before something goes wrong.
Evidence-based
Every score is built from real, checkable signals — domain age, redirect behavior, known threat databases — never a guess dressed up as an answer.
Radically transparent
Every technical detail behind a score is visible if you want to see it — nothing about how a site is judged happens in a black box.
Honest about limits
When a check can't run or a signal isn't available, ScamGuard says so plainly — instead of quietly filling the gap with something fabricated.
Your ScamGuard Dashboard
Scan history, watchlist alerts, bulk scanning, and API access — all in one place. Log in from the navbar to use these features and sync across devices.
Log in or create a free account to save sites to your watchlist — ScamGuard will re-check them automatically and email you if something changes.
ScamGuard checks watched sites once a day and emails you if a site becomes flagged as unsafe or its final destination changes. Up to 10 sites.
Log in or create a free account to scan multiple URLs at once.
Paste one URL per line, or upload a CSV — ScamGuard uses the first column that looks like a URL.
Log in or create a free account to generate an API key.
Up to 5 active keys. The full key is only ever shown once, right when you create it.
Send a POST request with your key as a Bearer token:
curl -X POST https://scamguard.store/.netlify/functions/api-check \
-H "Authorization: Bearer sg_live_your_key_here" \
-H "Content-Type: application/json" \
-d '{"url":"https://example.com"}'
Rate limit: 60 requests per hour per key. Response includes the same Safe Browsing, domain age, redirect chain, and SSL certificate data shown on the website.
Privacy Policy
Last updated August 23, 2026. Plain-language summary of what ScamGuard does and doesn't do with your data.
URL structure analysis: The first layer of every scan (protocol, hostname, TLD, brand-lookalike patterns, and similar structural signals) runs entirely in your browser. That step never leaves your device.
Live checks: For public websites, ScamGuard also runs live checks — domain age via a WHOIS/RDAP lookup, safe redirect-chain following, and, when configured, a Google Safe Browsing lookup. This requires sending the site's address to ScamGuard's server so it can perform those lookups. Internal or private network addresses are refused automatically before anything is fetched. These live checks are not logged or stored — they happen in memory for that one scan and are then discarded.
Scan history: If you're not logged in, each scan you run is stored locally in your own browser, never transmitted anywhere, and can be deleted at any time from the Scan History page. If you're logged in, a scan's domain, risk score, and date are also saved to your account (not the full URL) so your history can sync across devices — you can delete any entry, or your whole history, at any time.
Accounts: Creating an account stores your email address and a securely hashed password (never your plain-text password). This is used to log you in and, if you use "Forgot password," to email you a reset link. Login attempts are rate-limited to protect your account from being guessed at.
Reporting a website: If you use "Report a Website," the address you report, any reason you write, and an email address if you choose to provide one, are stored so the report can be reviewed.
Suggestions: If you use "Suggest an Idea," your message and an email address if you choose to provide one, are stored so we can review it and follow up if needed.
Payments: ScamGuard does not yet process any payments or store any financial or card information. Paid plans are not active yet — this policy will be updated with full details before they go live.
Contact: Questions about this policy can be sent to the site owner listed in the footer.
Analyzing website
example.comNo major warning signs were detected by the checks currently available.
Disclaimer: ScamGuard provides automated risk assessments based on available information. A low-risk result does not guarantee that a website is legitimate, and a high-risk result does not by itself prove fraud. Always use your own judgment before making payments or sharing sensitive information.