How it works
Six public signals, weighted by how hard each one is to fake.
A check takes a domain, reads three independent sources, and folds what it found through a pure function. Everything about that function is published — you can recompute any score this service hands you.
Step one · read
Three probes, in parallel, none of them able to break the others.
RDAP comes from the registry that actually holds the domain. The certificate is read off the socket. The page is fetched plainly first and re-fetched through a browser only when a plain fetch cannot read it — which is why this costs five cents and not fifty.
- RDAPthe registry of record
→ domain age
- TLSthe live certificate
→ certificate
- PAGEhomepage, browser render as fallback
→ contact · policies · address · reviews
Pure function
Σ(value × weight)Σ(weight)
resolved signals only
No model, no judgement call, no network. Same observations in, same score out.
Step two · weigh
What each signal is worth, and what it isn’t worth.
Domain age
RDAP · the registry itself
25When the registry says the domain was first registered, who the registrar is, and its EPP status codes.
Many ccTLDs publish no RDAP service. When that happens the signal is reported unresolved, not guessed.
TLS certificate
The live certificate, read off the socket
20Whether a CA validated a legal organization (OV/EV) or only DNS control, plus issuer, expiry and name coverage.
Certificate age is not scored past a 30-day floor. Let's Encrypt rotates every 90 days, so a young certificate means nothing.
Contact surface
The homepage
20An email on the site's own domain, a phone number, a contact page, linked social profiles.
A published address is not a monitored one. This measures reachability in principle, not whether anyone replies.
Policy pages
Links from the homepage
15Privacy, terms, and returns or shipping pages, weighted in that order.
Presence only. Nobody reads them — not us, and, statistically, not you.
Postal address
schema.org markup, then the page text
12A trading address, best when published as structured PostalAddress markup rather than pattern-matched from a footer.
A PO box scores low and is labelled as a mail drop. We do not verify that anyone is there.
Review footprint
Outbound links to review platforms
8Whether the business publicly points at a third-party review profile — Trustpilot, G2, Yelp, the app stores.
A footprint, NOT a rating. We do not read the reviews or use their scores. A link is cheap to add, which is exactly why this weighs least.
Weights sum to 100. A signal that does not resolve leaves the denominator — it is never scored as zero, because “we could not look” is not the same finding as “there is nothing there”.
Step three · divide
The rule that keeps the number meaning one thing.
Worked example
One signal would not resolve. Watch the divisor, not the number.
If we scored it zero
64 ÷ 100 × 100
64mixed
A worse reading for a business we simply could not finish looking at.
What Trust Check returns
64 ÷ 92 × 100
70strong
Scored on the five signals that resolved, and the response says so: resolved_signals: 5.
Fall below three resolved signals — or under 45 of the 100 weight — and no number is published at all. The band comes back insufficient and score: null. A trust score you can only get sometimes is more useful than one that quietly changes meaning.
Step four · read it correctly
Four bands, and what each one does not mean.
strong
70–100Most signals resolved and looked established.
An established footprint. It is not a guarantee of good conduct — plenty of long-lived domains behave badly.
mixed
40–69Signals were uneven — read the evidence before acting.
The band where the number is least useful and the signal list is most useful. Look at which ones are thin.
weak
0–39Few signals looked established.
Most often new, or a business that has simply never invested in a web presence. Not an accusation. Slow down; do not conclude.
insufficient
no scoreToo few signals resolved to publish a number.
Under 3 resolved signals or 45 of the weight, we return null rather than something that looks like a measurement.
The honest part
What this cannot do.
It cannot tell you whether a business is honest.
It reads a footprint. A long-established company with an EV certificate can still fail to ship your order, and a two-week-old shop can be run by decent people. The score is a prior, not a finding.
It is not KYB and not compliance evidence.
No registry filings, no beneficial ownership, no sanctions screening, no documents. If you have a regulatory obligation, this does not discharge it.
It reads one page.
The homepage, plus whatever it links to by URL. A trading address published only on a deep contact page will show up as unresolved rather than absent — the evidence string says which.
It has blind spots and names them.
Many ccTLDs publish no RDAP service. Some sites refuse every automated fetch. When that happens the signal is reported unresolved with the reason, and its weight leaves the divisor.
Trust Check reports publicly observable signals about a domain. It is not a certification, a credit check, or a fraud determination. A low score most often means a business is new or has a thin public footprint — not that it is dishonest. Read the signals and their evidence before acting on the number.