How do I verify a website's security badge is real?
Why most trust seals are decorative images, and the one property that separates a verifiable badge from a picture.
Click it. A real badge links to a live result on the issuer's own domain, showing the specific site and a recent date. A decorative one links nowhere, links to a marketing page, or links to a result for a different domain entirely.
The problem with trust seals
A badge is an image. Anyone can save one and put it on any page — there is no technical barrier and no verification step. A great many sites display seals from services they have never used, and it is essentially never noticed.
This has made the whole category close to worthless as a signal, which is a shame, because a badge that is verifiable is genuinely informative.
What separates a real one
| Property | Verifiable badge | Decorative badge |
|---|---|---|
| Links to | A live result on the issuer's domain | Nowhere, or a marketing page |
| The result names | The specific domain displaying it | Nothing, or a different domain |
| Date | Recent, and shown | Absent |
| Re-runnable | You can measure it again yourself | Nothing to re-run |
| Content | Generated per site | A static file identical everywhere |
Checking one in thirty seconds
- Click it. No link at all is the answer.
- Check the destination domain. It must be the issuer's, not the site's own — a self-hosted "verification" page verifies nothing.
- Confirm the result names the domain you came from. Badges get copied between sites, and the copy usually still names the original.
- Look for a date. An undated claim describes an unknown moment.
- Re-run it if the issuer allows. A result you can regenerate is a measurement; one you cannot is a picture of one.
The image itself can be checked
A badge served as a live SVG or image from the issuer's domain, generated per site, is harder to fake than a saved PNG. Look at the image URL: if it contains the domain being reported and is served from the issuer, the graphic is being produced on demand rather than copied.
A badge saved to the site's own server proves nothing, whatever it depicts.
If you are displaying one
- Link it to the live result. An unlinked badge is decoration and will be read as such by anyone paying attention.
- Let it update. A badge showing a score from last year is worse than none — it advertises that you stopped checking.
- Do not display a bad number. A faithful badge showing a poor score is honest and unhelpful. Fix the findings first.
- Prefer no JavaScript. A badge requiring a script on your page is a third party with execution rights, added for a graphic.
- Make sure it names your domain. If a visitor clicks through and sees someone else's result, you have copied it wrong.
What a badge can honestly claim
Be realistic about the ceiling. A badge can honestly say that a specific domain was measured against a published ruleset on a specific date, and that anyone may re-run that measurement. That is a real, checkable claim.
It cannot say a site is safe, that it will not be compromised, or that its application code is sound. A badge asserting any of those is claiming more than any external measurement supports.
What our audit reports about this
Every item below is measured directly, not inferred. Run it against your own site and the result names the exact rule or header responsible.
- Badges generated live per domain and served from the issuer, rather than static files that can be copied.
- A link from every badge through to a re-runnable measurement naming the same domain.
- No JavaScript on the displaying page — a plain image and a link, so nothing third-party executes.
- Detection of unverifiable trust seals and dark patterns when auditing someone else's credibility signals.
For agents and scripts, the same measurement is at
/api/v1/credibility?url=yoursite.com —
see the API documentation.
Related questions
Are trust seals worth displaying?
Only linked, live ones. An unlinked seal is decoration, and increasingly read as a negative signal by anyone technical. A badge that links to a re-runnable measurement is a genuine, checkable claim.
Can someone copy my badge?
They can copy the markup, and the badge will keep reporting your domain — so a click-through shows your result on their site, which is more embarrassing for them than for you. That is a direct consequence of generating badges per domain rather than serving one static image.
Should a badge show a score or just verification?
Show the number when it is good, since a specific figure is a stronger claim than a vague assurance. When it is not good, a verification-only badge is honest without advertising the problem — and fixing the findings is the better answer either way.
Does a badge need JavaScript?
It should not. A plain image with a link achieves everything and adds no third-party execution to your page. A badge that requires a script is asking for far more access than a graphic warrants.
Read next
How can I tell if a website is real or a scam?
The signals that genuinely distinguish a legitimate site from a fraudulent one — and the ones everybody cites that mean nothing at all.
ReadHow do I prove my website is secure?
What you can honestly demonstrate about your site's security, what nobody can prove, and how to make the claim checkable.
ReadHow do I make my website look trustworthy?
The signals people and machines actually use — most of which cost nothing and are missing from most small sites.
ReadWhat does a website score actually mean?
How a score out of 100 is built, what it can honestly tell you, and the four things it cannot.
Read