Trust Audit Fixes: Signals Visitors and Checkers Look For
Before someone buys from a website, enters card details or links to it, they judge whether it is trustworthy, and so do browsers, payment providers, fraud checkers and search engines. The Website Trust Audit tests 22 of the signals those checks commonly rely on, across 8 categories: domain, reputation, authority, identity, site behaviour, on-page trust, technology and top-level domain.
It grades the site from A to F. This page explains each failing check, separates the quick fixes from the slow ones, and links to the matching section of the Trust Audit Guide.
How the score is made up
The audit scores out of 100, split across eight categories. Some categories are worth more because they are harder to fake: a domain registered years ago, or a clean reputation with Google Safe Browsing, says more about a site than a contact link that anyone can add in a minute.
| Category | Points | What it looks at | Speed of fix |
|---|---|---|---|
| Domain | 18 | Domain age, registration data, registrar. | Slow (age) to quick (registrar details). |
| Reputation | 18 | Safe Browsing status, backlink spam score. | Days to months. |
| Authority | 15 | Referring domains, domain rank. | Months. |
| Identity | 12 | Contact email, phone, Organization schema, social links. | Hours. |
| Site behaviour | 10 | robots.txt, crawler blocking, AI crawler access. | Minutes. |
| On-page trust | 10 | About, Contact, Privacy and Terms links. | Hours to days. |
| Technology | 7 | Detectable technology stack and CMS. | Often self-resolving. |
| TLD risk | 10 | Whether the domain ending is one heavily used for abuse. | Needs a domain move. |
A trust score is not a Google ranking score. Google has said, for example, that domain age on its own is not a ranking factor. The audit measures signals that people and automated risk checks use to judge legitimacy, several of which also overlap with what search quality guidelines ask raters to look for, such as clear information about who runs a site.
Every finding and where it is fixed
Each link goes to the matching section of the Trust Audit Guide.
Domain
A young domain cannot be aged artificially; the guide covers strengthening other signals meanwhile, and what happens to the registration date when an established domain changes hands. Hidden or unavailable WHOIS explains that privacy redaction is normal, but a record with nothing at all, not even a creation date or country, counts against you. An unidentifiable registrar covers moving to a mainstream registrar.
Reputation
Google Safe Browsing flags covers cleaning a compromised site and requesting a review through Search Console. A high backlink spam score covers auditing links from link farms, private networks and comment spam, and when disavowing is worth it.
Authority
Low referring domains covers earning links from real, relevant sites. Low domain rank covers building topical depth on a few subjects so links follow.
Identity
A missing contact email and a missing phone number cover showing real contact details, ideally an address on your own domain and a number in international format. Missing Organization schema covers the JSON-LD that names your organisation, logo, contact point and profiles. Missing social profile links covers linking to active profiles, not empty placeholders.
Site behaviour
A missing robots.txt gives a minimal file. A block on all crawlers covers removing a site-wide disallow left over from development. Blocked AI crawlers covers deciding deliberately which AI user agents to allow.
On-page trust
The About, Contact, Privacy Policy and Terms and Conditions sections cover what each page should contain and linking them from the footer of every page.
Technology and TLD
Empty technology detection and an unrecognised CMS explain when to wait and when to check whether your site blocks fingerprinting crawlers. A high-risk TLD covers moving a brand to a mainstream domain ending with permanent redirects.
Which findings to fix first
Some failures are emergencies, some are quick points, and some are long projects. Handle them in that order.
- Safe Browsing flag. Browsers show a full-page warning to visitors, so almost nobody reaches the site. Treat it as an incident: find and remove the malicious or deceptive content, close the hole that let it in, then request a review in Search Console's Security Issues report.
- Blocking all crawlers. A single line in robots.txt can hide the whole site from search. It takes a minute to fix.
- Missing identity and on-page items. Contact email, phone, About, Contact, Privacy and Terms links, Organization schema and social links. All within your control, most doable in a day.
- Registration data and registrar. Make sure the public record shows at least a creation date and country, and that the registrar is a recognised one.
- Spam score. Review the worst links; disavow only where there is a clear pattern of manipulative links, particularly if you have received a manual action.
- Authority and domain age. Ongoing work measured in months and years.
- TLD. A move to a new domain is a significant project with redirect, email and branding work, so plan it rather than rushing it.
Showing who runs the site
The identity and on-page categories matter most to the people deciding whether to trust you, and they are the easiest to fix. For UK businesses there is also a legal side worth knowing about.
- Limited companies and LLPs must show certain details on their websites under the Companies Act trading disclosure rules, including the registered name, company number, place of registration and registered office address. A footer line is the usual place.
- Online sellers must give consumers specific information before a contract, including who they are, how to contact them and how cancellation works, under consumer contract rules. Terms, returns and delivery pages are where most of this lives.
- Anyone collecting personal data must tell people how it is used, which is what a privacy notice does under the UK GDPR. The Data (Use and Access) Act 2025 amends parts of UK GDPR and PECR as it comes into force, so check current ICO guidance. See our GDPR Guide for more.
These points are general information, not legal advice. If you are unsure what applies to your business, check Companies House and ICO guidance or ask a solicitor.
Making identity machine-readable
Organization schema ties the visible details together for search engines and other tools. A good block
includes name, url, logo, a contactPoint and a sameAs
list of your real profiles. Local businesses can use a LocalBusiness subtype instead. Every
value should match what is visible on the page.
Living with the slow signals
Three findings cannot be fixed on the day: domain age, authority and, sometimes, technology detection. It helps to know what is realistic.
Domain age
Age accrues one day at a time. A new business on a new domain will score lower here for its first years, whatever it does. That is why the audit weights other categories heavily. Transferring an existing domain to a new owner or registrar generally keeps its original creation date, which is why established domains are sometimes bought, but check the domain's history and any past penalties before buying one.
Authority
Referring domains and domain rank grow when other sites choose to mention and link to you. That comes from being useful: original data, expert commentary, genuine partnerships, supplier and trade body listings, and content that answers questions well. A handful of links from relevant, respected sites carries more weight than many from low-quality directories. The security audit fixes hub is worth reading alongside this one, because a secure site is easier to recommend.
Technology detection
This check relies on third-party crawl data, which can take weeks to include a new or rebuilt site. If it stays empty for a long time, check that your firewall or CDN does not block legitimate crawlers and that pages return meaningful HTML without needing JavaScript to show content. A custom-built platform may never match a known CMS, and that is fine if the rest of the audit is strong.
A sensible order of work
- Run the audit. Start with the Website Trust Audit to see which of the 22 checks pass and your overall grade. Keep the report for comparison.
- Deal with emergencies. A Safe Browsing flag or a site-wide crawler block comes before anything else.
- Complete the footer. Contact email, phone number, links to About, Contact, Privacy and Terms, social profile links and, for companies, the trading disclosure details.
- Add Organization schema to the homepage. Validate it with the Schema Markup Validator.
- Tidy robots.txt. Allow normal crawling, block only private paths, add your sitemap and decide on AI crawlers.
- Check registration data and registrar. Log in to your registrar and review what is published.
- Review the backlink profile. Identify obvious spam and decide whether any action is needed.
- Start the long programme. Plan content and outreach that earns links over the coming months.
- Re-run the audit. Quick fixes show on the next run; slower signals are worth checking quarterly.
1. Does domain age affect Google rankings?
Google has said that domain age by itself is not a ranking factor. An old domain does not rank because it is old, and a new one can rank well if its content and links are strong. Age still matters to other systems, though. Fraud checks, payment providers, email filters and people doing their own research often treat a very new domain with more caution, which is why a trust audit includes it as one signal among many.
2. Is it bad to use WHOIS privacy on my domain?
No. Since data protection rules tightened, most registrars redact personal details from public registration records by default, and that is normal and sensible. What counts against a site is a record that shows almost nothing, such as no creation date, no registrar details and no country. For individuals, keeping personal details private is expected. For businesses, it is worth checking that at least the organisation name and country appear where your registrar allows it.
3. How do I get my site off Google's Safe Browsing list?
First find out why it was flagged, using the Security Issues report in Google Search Console, which lists the problem and sometimes example URLs. Remove the malware, phishing pages or unwanted software, then fix the cause, such as an outdated plugin, a weak password or a compromised server. Once the site is clean, request a review from the same report. Reviews often complete within days, but you should keep monitoring in case the problem returns.
4. Should I disavow links with a high spam score?
Usually not straight away. Google says it ignores most low-quality links automatically, and a spam score from a third-party tool is an estimate, not Google's view. Disavowing makes sense when you have received a manual action for unnatural links, or when you know links were bought or built manipulatively in the past. Disavowing good links by mistake can do harm, so review the domains carefully and use domain-level entries only for clear spam sources.
5. Do I need a privacy policy on a small business website?
If your site collects any personal data, such as through a contact form, newsletter sign-up, orders or analytics cookies, UK data protection law requires you to tell people how that data is used, and a privacy notice is the normal way to do it. It should say who you are, what you collect, why, your lawful basis, who you share it with, how long you keep it and people's rights. This is general information, not legal advice.
6. Should I block AI crawlers like GPTBot in robots.txt?
It depends on your business. Blocking AI crawlers can stop your content being used to train some models or being fetched by some AI assistants, which matters to publishers and paid-content businesses. It can also reduce the chance of being cited in AI answers. Most small businesses benefit from being visible, so allowing them is a reasonable default. Whatever you choose, make it a deliberate decision and list each user agent explicitly in robots.txt.
7. Why does a .xyz or .top domain lower my trust score?
Some cheaper domain endings have been used disproportionately for spam, phishing and short-lived scam sites, so security tools and some email filters treat them with extra suspicion. That is unfair on legitimate businesses using them, but it affects how visitors and systems react. If your brand relies on trust, consider registering the same name on a .co.uk, .uk, .com or similar ending and moving the site with permanent 301 redirects from the old address.
The Website Trust Audit tests 22 signals across 8 categories, from domain and reputation to identity, site behaviour, on-page trust, technology and TLD, grades the site from A to F and links each failed check to the fix above.
Run the Trust Audit →