How the checks and the trust score work

Status

Every status page combines three sources. Our own checks request the site's homepage from Cloudflare's edge network, GitHub's US region and our London server, testing DNS, the TLS certificate, the HTTP response, response time and whether the page content matches what we saw before. Where a service publishes a status page in the common Statuspage or Instatus format, we read its feed. And visitors can report problems, which we count against the usual rate for that hour and break down by country and network.

Down: every location fails, or the only location has failed twice in a row.
Partial outage: at least one location fails while another succeeds, the official feed reports a major incident, or visitor reports exceed four times the baseline.
Slow: all locations succeed but the median response is over 5 seconds.
Up: everything else. An incident closes after the next clean check.
No website found: the name has never answered from any location. Infrastructure, email-only and parked domains sit here and are never listed as outages.

What counts as a failure: no DNS answer, no connection, a timeout, or an HTTP 5xx response. A server that answers with 401, 403, 404 or 429 is reachable; many large sites answer automated requests that way and it is not an outage. We try both the bare domain and www, and a single failed check is never enough: it has to repeat on the next check before the state changes.

The "your connection" test runs in your browser: it times a request to the site and compares it with our servers, so the page can say whether the fault is on your side. Nothing from that test is stored with your identity.

Trust score

Every site starts at 100. Each signal below can subtract up to its maximum weight; a strongly established site (high traffic rank, many years old) earns a small bonus so genuine brands sit in the 90s. Sites on a security blocklist are capped at 15; lookalike domains at 25. Under 50 is flagged. Where we have neither registry data nor a crawl, the page says "not enough history" and is not indexed.

Signal	Source	Max weight
Domain age	RDAP registry data, Wayback Machine as fallback	−25
Company registry	Company name on the site matched against Companies House	−20
Visitor reports	Categorised visitor reports, de-duplicated by device and network	−25
Related sites	Shared analytics IDs, pixels and servers with flagged sites in our index	−10
Imitates a brand	Edit distance against a list of well-known brands	−30
Owner privacy	Registry data	−5
Blocklists	Google Safe Browsing, URLhaus	−40
Refund policy	The site's own refund and returns pages	−4
Contact details	Phone, email and contact page found on the site	−5
Postal address	Postal address found on the site	−3
Mail server	DNS MX records	−3
Recent changes	Homepage content compared between visits	−3
Payment methods	Payment methods named on the site	−6
Shipping origin	Shipping origin named on the site	−3
Discount claims	Sitewide discount claims on new domains	−2
TLS certificate	Certificate read during the check	−5
Availability	Our checks over 30 days	−4
Traffic rank	Tranco top 1M list	context only
First seen on the web	Wayback Machine first capture	−5
Official status page	Official status page detected	context only

Visitor reports

Reports are counts in categories, not reviews and not ratings. One report per device and network per day; reports containing links are discarded; long free-text reports are held for moderation. Status reports feed the outage detection; trust reports feed the score. A site owner can dispute any signal or report by email, and corrections are reviewed within 48 hours. Score history stays public so a corrected score is visible as a correction.

Limits

These are automated estimates from public data. A high score means we found no warning signs, not that a site is guaranteed safe; a low score means the warning signs are there, not that a crime has been proven. Adult and gambling sites are checked for safety but are not listed, linked or indexed.