How can one go about verifying the security and legitimacy of a web application before accessing it?

6 Answers 6


dhulk's answer has some good info, but I think those are secondary.

Let's start with some basics:

Is it running on https? Look in your address bar. If the URL starts with https, then traffic to and from this app is encrypted.

Just because it's running on https doesn't guarantee that it's secure. The company (or person) who built the site has full access to any information that you send in.

Examine the certificate Double-click on the lock icon to see certification information (the position of the lock varies from browser to browser). Look at whom the certificate is issued to. If the name of the company doesn't seem familiar, do some google searches to figure out what the relationship is between the certificate holder and the service.

Look for a privacy policy. This should specify what they do with the information you give them. It doesn't guarantee that they'll obey their stated policy, of course.

Research its reputation. Do some google and twitter searches. Try things like "don't trust X" or "security of X" (where X is the service)

All in all, you're looking for a consistent picture that suggests that the operators of the site are up front and trustworthy. It's still no guarantee, but it's a great start before you divulge personal information.

  • Thanks for the input on this as a follow up, I made another specific question that you may be able to help on: webapps.stackexchange.com/questions/807/…
    – Woot4Moo
    Commented Jul 1, 2010 at 14:10
  • Decent answer, but dhulk's concerns are anything but secondary. Cross-site scripting attacks are good way to get your computer hijacked by unknown parties, so his NoScript recommendation is very important. Commented Jul 1, 2010 at 15:21
  • Yeah, regarding NoScript, the only place I don't use it is here at work since I'm a web developer and I'm usually just looking at Google, Stack Overflow, and sites that I've built, so I'm not concerned as much with scripting attacks at that point. Commented Jul 1, 2010 at 16:23
  • I didn't mean to imply that dhulk's concerns were of less importance. Instead I meant that there are other items I would examine first. NoScript is a very nice solution -- for those of us who understand what it's doing. I think that the vast majority of web users don't know, don't care and shouldn't need to know what is handled by scripting vs static HTML. With NoScript installed, these users will be befuddled by an apparently non-working site. Commented Jul 1, 2010 at 17:14
  • Very true, I often forget myself that I have it running and slight frustrations always occur when I visit a new site and it doesn't work. It's not something that novices are going to want to use really. Commented Jul 1, 2010 at 17:20

What you're after may be a little difficult. However, if you use Firefox there are a couple of things I do to protect myself from pages I haven't been before.

Firstly, I use the NoScript add-on for Firefox. It keeps Javascript from running on sites that you don't explicitly allow.

Second, I just came across this a few days ago, HTTPS Everywhere switches you to the HTTPS version of several sites which will offer you greater security. In addition to that, you can add as many rule sets as you want so that any site you come across and want to use the HTTPS version (has to be available of course) you can.

Hope this helps.

  • HTTPS Everywhere is an awesome suggestion. Are they making an extension for Chrome?
    – jinsungy
    Commented Jul 1, 2010 at 13:53
  • Not sure really, I just learned about it recently, but I sure hope so. Commented Jul 1, 2010 at 13:55
  • I will take a look into HTTPS Everywhere
    – Woot4Moo
    Commented Jul 1, 2010 at 14:14
  • i cant see how the existence of https ensures the web app is "secure". you transfer encrypted stuff to them and behind your back they sell the data. maybe i didn't get the meaning of the question in the first place...
    – akira
    Commented Jul 1, 2010 at 14:33
  • @akira it doesn't really, but the web application being secure isn't all you need to be concerned with. There's not really a way to ensure that your data is safe as even people that claim to take care of your information (remember Google buzz?) can accidentally do things with your data that you'd rather not do. Commented Jul 1, 2010 at 16:21

Suggesting some non-technical points you might want to consider in addition to the safety measures mentioned by others. They do require you to use the site to some degree so you'll have to be prepared to view portions of the site, so if you're really worried you might want to take precautions first (no script, disabling cookies etc.).

  • There's a Contact Us page that lists a physical address and phone number for the company.
  • All links point to where they claim to point to - check the URL in the status bar is what you expect it to be.
  • They let you look round the site before signing up. While you can't expect access to all content, you should be able to view some - low-resolution images, the first paragraphs of articles etc.
  • Any costs are clearly set out before you sign up.
  • There's a no-cost option that allows access to some content.
  • The site shouldn't ask you to install anything on your computer.

While I wouldn't expect all of these to be always present (apart from the contact us page) - after all each site is different - I would expect some content for free.


You can never be 100% certain.

Different browsers can help you in different ways:

IE has several security features

As does Firefox

And Chrome too

All three have a feature which will detect possible malware, phishing, out of date or bad certificates.


My primary concern is security, not so much legitimacy. Sometimes, a site is just so new, you're not going to find much about it.

For security, I would test whether the site prevents XSS, CSRF, directory traversal, buffer overflows, SQL injection, etc. There are various ways to test any of the above exploits, and any site that fails your test should be viewed with concern.


Install WOT or SiteAdvisor or look-up the site on their website. Go to the site's page and read the reviews.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.