A first-time visitor lands on your site knowing nothing about you. In the next few seconds they make a quiet, mostly unconscious decision: is this a real business, or am I about to get burned? They can't see your warehouse, your team, or your reviews queue. All they have is what's on the page — and a lifetime of instinct about which sites feel safe and which feel sketchy.
That instinct fires hardest at checkout, with their card number sitting in the form. The Baymard Institute, which has studied checkout abandonment for years, consistently finds "I didn't trust the site with my credit card information" among the top reasons people bail with a full cart. The frustrating part: most trust problems aren't about your product or your prices. They're about missing or broken signals — a phone number that isn't there, a return policy nobody can find, a browser warning that turns your homepage into a wall of red.
The good news is that trust signals are concrete, checkable, and mostly free to fix. This guide is the checklist I'd hand someone who said "traffic's fine but nobody's buying — what's wrong with my site?"
By the end you'll know:
- The technical signals (SSL, mixed content, stale dates) that make browsers and people distrust you
- The exact policies and contact details visitors hunt for before they buy
- Which social proof actually moves the needle — and which is just decoration
- A realistic sense of what you can audit yourself in an afternoon
Part 1 — The Technical Trust Signals
These are the signals your browser checks automatically, and the ones a wary shopper notices first. Get them wrong and nothing else on the page gets a fair hearing.
1. Your SSL certificate is valid and not about to expire
The padlock in the address bar means traffic to your site is encrypted. No padlock — or worse, a full-page "Your connection is not private" warning — and most visitors leave before they've read a single word. Certificates also expire, usually every 90 days for free Let's Encrypt certs, and auto-renewal silently fails more often than people expect.
What "bad" looks like: An expired certificate (instant full-page browser warning), a certificate that doesn't match your domain, or one with fewer than 30 days left and no working auto-renewal. When a cert expires, the browser doesn't show your homepage at all — it shows a scary interstitial, and most visitors never click past it.
What to do: Type your URL with https:// and look for the padlock. Click it to see the certificate's expiry date. If you're inside 30 days and not sure renewal is automated, fix that now — set a calendar reminder or move to a host that auto-renews. Confirm http://yoursite.com redirects to https:// rather than loading an insecure version.
2. No mixed-content warnings
A "mixed content" page is one served over secure HTTPS that still pulls in images, scripts, or stylesheets over insecure HTTP. Browsers flag this — sometimes by stripping the padlock, sometimes with a console warning, sometimes by blocking the resource entirely so part of your page breaks.
What "bad" looks like: A padlock that's missing or marked "Not secure" even though your cert is valid, or images that mysteriously don't load. It's usually caused by a hardcoded http:// link to an image or an old third-party widget.
What to do: Open your browser's developer console (F12) on your homepage and look for mixed-content warnings. Each one names the offending file. Change those http:// references to https://, or pull the resource from a host that supports HTTPS.
3. Your copyright year isn't stale
It's a tiny detail in the footer, but a "© 2019" on a site you're visiting in 2026 reads as abandoned. People wonder whether anyone's home to ship their order or answer an email.
What "bad" looks like: A copyright year that's a year or more behind the current one. (If you show a range like "© 2018–2026," only the latest year matters — that's fine.)
What to do: Make the year dynamic so it updates itself, or just put it on your maintenance checklist for every January. Two minutes, real signal.
Part 2 — The Pages Visitors Hunt For
Before a careful shopper buys, they go looking for specific reassurances. If those pages don't exist — or exist but say nothing — the shopper fills the silence with doubt.
4. A real privacy policy and terms
These two are baseline credibility. A privacy policy tells visitors what you do with their data; terms set the rules of engagement. Beyond the trust signal, many payment processors and ad platforms require a privacy policy, and privacy laws may require one too.
What "bad" looks like: No privacy or terms page at all, or a thin stub of a few sentences that clearly exists just to fill a footer link. A 200-word minimum is a reasonable bar for "this is real."
What to do: Publish both, link them in the footer site-wide, and make them genuinely cover your situation. A reputable policy generator beats nothing, but have someone read it for plausibility.
5. A clear return / refund policy (if you sell anything)
For ecommerce this is the big one. Shoppers routinely check the returns page before they buy — it's how they decide whether the purchase is reversible if it goes wrong. No return policy reads as "all sales final, no recourse," and a lot of carts die right there.
What "bad" looks like: No returns or refund page, or a vague one that won't say the three things people actually want: the return window, the condition items must be in, and when they'll see their money back.
What to do: Publish a returns page that states the window, the condition, and the refund timing in plain language. Link it in the footer and near the add-to-cart button and on the checkout page — exactly where the hesitation happens. On Shopify the conventional path is /policies/refund-policy; make sure it's actually linked, not just sitting there unlinked.
6. A real About page
The About page is where a stranger decides there are actual humans behind the storefront. A substantive one — real names or faces, a founding year, a story — does quiet, heavy lifting for trust.
What "bad" looks like: No About page, or a stub of a few generic sentences ("We are passionate about quality...") with no names, no photos, no specifics. Under ~100 words of boilerplate is a stub, not a story.
What to do: Write 300+ honest words. Who started it and why, where you're based, what you actually do. Add a photo or two of real people. This is one of the cheapest trust upgrades available and almost nobody does it well.
Part 3 — Contact Info and Social Proof
The last layer is about being reachable and being vouched for. Anonymous sites with no proof are exactly what scams look like — so the absence of these signals doesn't read as neutral, it reads as suspicious.
7. Complete, findable contact information
A visitor who can find a phone number, an email, and a physical address relaxes. A site that offers only a generic contact form and nothing else makes people wonder what you're hiding.
What "bad" looks like: No phone number anywhere, no real email (just a form), and no street address. For a business asking for credit cards, that's three missing reassurances at once.
What to do: Put at least an email and, ideally, a phone number and address in the footer and on a real Contact page. If you're home-based and don't want to publish your address, a business mailbox or "serving the [region] area" line still beats total silence.
8. Social proof that's actually believable
Reviews, testimonials, star ratings, "as seen in" logos, and trust badges all tell a visitor other people already took this risk and were fine. But not all proof is equal. A wall of unattributed testimonials ("Great product! — J.S.") barely registers; verifiable third-party reviews carry far more weight.
What "bad" looks like: Zero social proof on the homepage — no reviews, no ratings, no testimonials, no logos. Or only self-hosted quotes with no way to verify them.
What to do: Add real reviews through a recognized platform (Google, Trustpilot, Yotpo, Judge.me) so they're verifiable, and surface star ratings on product pages. If you've been featured anywhere legitimate, show the logos. Managing where those reviews live is its own discipline — see How to Manage Your Online Reviews for the off-site half of the trust equation.
9. Security badges near the point of payment
A small "Secure Checkout" or recognized payment-security badge right beside the buy button is reassurance delivered at the exact moment of hesitation. It won't save a bad site, but on a good one it nudges the nervous shopper over the line.
What "bad" looks like: A bare checkout button with no security cues at all, on a site that's otherwise asking for a card number.
What to do: Place a genuine, recognized badge (your payment processor usually provides one) near the checkout button. Don't fake it — a made-up badge is worse than none if a savvy shopper spots it.
This checklist will catch the trust leaks you can see by carefully clicking through your own site. What it won't do is check everything consistently, at once, the way a stranger's browser does — and that's where the misses hide.
A few things a manual pass tends to miss:
- The exact days remaining on your SSL cert and whether auto-renewal is genuinely wired up
- Mixed-content resources buried in third-party widgets you'd never think to inspect
- Policies that exist but are too thin to count, measured against a real word-count bar
- Whether your "reviews" are verifiable third-party proof or just unverifiable homepage quotes
- Every one of these scored together into a single trust number you can re-check after fixes
You can find most of these by hand. Whether you can find all of them, on every page, before you stop paying attention — that's the gap.
If you'd rather not click through every policy page and squint at your own footer, the Trust Signal Audit does the whole pass for you. Give it your homepage URL and it inventories every trust marker a first-time shopper uses — SSL health and expiry, mixed content, privacy/terms/returns policies, contact completeness, social proof and review platforms, security badges, About-page depth, and that stale copyright year — then scores your overall trust health and hands you a prioritized fix plan. It even detects whether you're running an ecommerce site and weights the return-policy check accordingly.
It's $19.99, one-time — a fraction of an agency retainer, no subscription, delivered in under 24 hours. You point it at your site, it does the squinting, and you get a clear list of what to fix first. If you've got real traffic but soft conversion, run the Trust Signal Audit before you spend another dollar driving people to a page they don't trust.
It pairs naturally with Why Your Page Isn't Converting — trust gets people comfortable, copy gets them to act.
Rather have it done for you? The Trust Signal Audit pulls the data, runs every check above, and hands you a prioritized, plain-English report in under 24 hours — a fraction of an agency retainer, no subscription, no upsell.