Is costco.com safe?

Very Likely Safe

No major red flags found. This looks like a legitimate, established website.

Popular site · #1,009 worldwideChecked Nov 13, 2026

Trust score

Why: Main reasons: domain registered 30+ years ago; not flagged by Google Safe Browsing; popular website — ranked #1,009 worldwide. Minor issues: no contact page found; large response served uncompressed.

Identity & Age100/100

Impersonation Risk100/100

Red Flags100/100

Transparency86/100

Security96/100

Email100/100

Positive highlights

Domain registered 30+ years agoLong-established domains are far less likely to be disposable scams.
Not flagged by Google Safe BrowsingNo malware, phishing, or unwanted-software match in Google's live threat database.
HTTPS is enforcedAll redirects stayed on HTTPS. Traffic is encrypted end-to-end.
Popular website — ranked #1,009 worldwideListed in the Tranco top 1 million websites. Scam sites are almost never this popular.
Site responded with 200Final URL: https://www.costco.com/. Response time 302ms.
HTTPS works with a valid certificateA secure connection was made on port 443. Certificate log details were unavailable at scan time.
No impersonation patterns detectedDomain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.
Not listed on URLhaus malware blocklist
Fast response (302ms)
Not present in PhishStats phishing feed

Negative highlights

No contact page foundReputable sites usually publish a contact page.
Large response served uncompressedEnable gzip or brotli at the edge to cut transfer size dramatically.
Heavy HTML payload (3480.5 KB)

Note: Registered via CSC Corporate Domains, Inc..

Note: 6 technologies detected. Next.js, React, Svelte, Tailwind CSS, Google Analytics, Cloudflare

Key facts about costco.com

Website: costco.com
Popularity: #1,009 worldwide (Tranco top 1M)
Domain created: Mar 17, 1997 (29.7 years old)
Domain expires: Mar 18, 2027
Registrar: CSC Corporate Domains, Inc.
Owner details: Public in WHOIS
IP address: 151.101.195.52
Hosting / CDN: Cloudflare
SSL certificate: HTTPS works (certificate details unavailable)
Email security: SPF ✓ · DMARC ✓ (reject)
Threat blocklists: Not listed (clean)
Technology: Next.js, React, Svelte, Tailwind CSS, Google Analytics, Cloudflare

Summary

96/100 — trusted. Long-established domain (29.7 years old), clean threat reputation, no impersonation patterns.

No malware/phishing on feedsGood reputationHTTPS enabled

Full technical report

Domain Information

Registration timeline, age calculation, registrar details, and ICANN status.

Verified

Registrar Name: CSC Corporate Domains, Inc.
Creation Date: March 17, 1997 (29.7 years ago)
Last Updated: November 12, 2026
Registry Expiry Date: March 18, 2027
WHOIS Privacy Protection: Publicly Visible
Domain Status Codes: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited

ICANN Status Badges

client transfer prohibitedserver delete prohibitedserver transfer prohibitedserver update prohibited

Open in standalone WHOIS / RDAP Lookup tool →

Domain registered 30+ years ago

Long-established domains are far less likely to be disposable scams.

+15

Registered via CSC Corporate Domains, Inc.

Owner information disclosed

The domain publishes registrant contact info — a small positive transparency signal.

HTTP Headers & Security

Full HTTP response headers, HSTS, Content Security Policy (CSP), and security baselines.

Warning

Security Header Baseline

Strict-Transport-SecurityMissing

Content-Security-PolicyMissing

X-Frame-OptionsMissing

X-Content-Type-OptionsMissing

Referrer-PolicyMissing

Permissions-PolicyMissing

Recommended Missing Headers

missing: X-Frame-Optionsmissing: X-Content-Type-Optionsmissing: Referrer Policymissing: Permissions Policy

All Response Headers (25)

alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
cache-control: no-cache, no-store, must-revalidate, proxy-revalidate, private, max-age=0, s-maxage=0
cf-cache-status: DYNAMIC
cf-ray: a59ea067286d1330-CMH
connection: close
content-security-policy: default-src 'self' https://*.queue-it.net/ https://*.costco.ca/ https://*.costco.com/ https://*.costcobusinessdelivery.com/ https://*.costcobusinesscentre.ca/ https://*.costcobusinesscenter.ca/ https://*.costco-static.com/ https://display.ugc.bazaarvoice.com/ https://api.bazaarvoice.com/; script-src 'self' https://*.dynatrace.com https://*.affirm.com https://h.costco.com/ https://js-cdn.dynatrace.com/ https://h.online-metrix.net/ https://*.cybersource.com/ https://www.google.com/recaptcha/ https://www.gstatic.com/ https://www.gstatic.com/recaptcha/ https://www.cdn-path.com/ https://h.costco.com/ https://dev.virtualearth.net/ https://sdk.virtualearth.net/ https://*.queue-it.net/ https://*.costcobusinessdelivery.com https://*.costcobusinesscenter.ca/ https://cdn.intake-lr.com/ https://cdn.cookielaw.org/ https://*.criteo.com/ http://*.criteo.com/ https://assets.adobedtm.com/ https://s.go-mpulse.net/ https://transcend-cdn.com/ https://apps.bazaarvoice.com/ https://agents.cloud.google.com/ https://display.ugc.bazaarvoice.com/ https://mobilecontent.costco.com/ https://mobilecontent-qa.costco.com/ https://*.pxlecdn.com https://*.pixlee.com https://*.pixlee.co https://fonts.googleapis.com https://yt3.googleusercontent.com/ 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://*.affirm.com https://dev.virtualearth.net/ https://sdk.virtualearth.net/ https://cdn.fonts.net/ 'unsafe-inline' https://transcend-cdn.com/ https://consent.costco.com/ https://consent.costco.ca/ https://consent.costco.com https://display.ugc.bazaarvoice.com/ https://www.gstatic.com/ https://fonts.googleapis.com; img-src 'self' https://dummyimage.com https://cdn.brandfolder.io/ https://*.affirm.com https://delivery-p178262-e1909084.adobeaemcloud.com https://retailmedia-static.criteo.com https://rmp-cdn.moloco.com/ https://*.costcobusinessdelivery.com https://*.tiles.virtualearth.net/ https://dev.virtualearth.net/ https://sdk.virtualearth.net/ https://*.costco.ca/ https://*.costco.com/ https://*.costcotravel.com/ https://*.costcotravel.ca/ https://cdn.bfldr.com/ https://*.contentstack.com/ https://*.costco-static.com/ https://cdn.cookielaw.org/ https://cm.everesttech.net/ https://dpm.demdex.net/ https://display.ugc.bazaarvoice.com https://retailmedia-static.azureedge.net https://retailmedia-static.azureedge.net/ https://network-a.bazaarvoice.com https://network-stg-a.bazaarvoice.com https://retailmedia-static.criteo.com/ https://yt3.googleusercontent.com/ https://gstatic.com/ https://www.gstatic.com/ https://services.google.com/ blob: data:; media-src 'self' https://*.costcobusinessdelivery.com https://*.costco.ca/ https://*.costco.com/ https://cdn.bfldr.com/ https://*.contentstack.com/ https://*.costco-static.com/ https://*.criteo.net/ https://retailmedia-static.criteo.com/ https://*.criteo.net; font-src 'self' https://*.affirm.com https://cdn.bfldr.com/ https://*.costco-static.com/ https://fonts.gstatic.com data:; object-src 'none'; base-uri 'self' about:; form-action 'self' https://*.cardinaltrusted.com https://*.cardinalcommerce.com https://www.cdn-path.com/ https://*.costcobusinessdelivery.com https://*.costco.ca/ https://*.costco.com/ https://r.intake-lr.com/ https://*.akstat.io https://*.opinionlab.com; frame-src https://*.affirm.com https://*.cardinaltrusted.com https://*.cardinalcommerce.com https://www.cdn-path.com/ https://h.costco.com/ https://h.online-metrix.net/ https://*.cybersource.com/ https://*.costcobusinessdelivery.com https://*.costcobusinesscentre.ca/ https://*.ct-costco.com https://costco.demdex.net/ https://costco.centah.com/ https://consent-sync.costco.com/ https://consent-sync.costco.ca/ https://*.criteo.com/ http://*.criteo.com https://*.pixlee.com https://*.pixlee.co https://*.costco.com/ https://*.costco.ca/ https://*.dynatrace.com https://login.centah.com/ https://www.google.com/recaptcha/ https://recaptcha.google.com/recaptcha/ https://cmppapi.cervey.com/; connect-src 'self' https://*.affirm.com https://rest.api.costco.com/ https://*.moloco.com https://*.rmp-api.moloco.com https://*.cc-costco.com https://gdx-prd.api.cc-costco.com https://h.costco.com/ https://cdn.bfldr.com/ https://js-cdn.dynatrace.com/ https://*.dynatrace.com https://www.google.com/recaptcha/ https://gdx-api.costco.com https://gdx-npd.np.api.cc-costco.com https://api-tst.np.gdx.cc-costco.com https://dev.virtualearth.net/ https://sdk.virtualearth.net/ https://spatial.virtualearth.net/ https://*.queue-it.net/ https://*.costcobusinessdelivery.com/ https://*.costcobusinesscenter.ca/ https://*.costcobusinesscentre.ca/ https://*.costco.ca/ https://*.costco.com/ https://*.costco-static.com/ https://*.ct-costco.com https://cdn.cookielaw.org/ https://geolocation.onetrust.com/ https://costco.demdex.net/ https://dpm.demdex.net/ https://costco.tt.omtrdc.net/ https://*.criteo.com/ http://*.criteo.com/ https://*.criteo.net/ https://cm.everesttech.net/ https://r.intake-lr.com/ https://*.contentstack.com/ https://assets.adobedtm.com/ https://dcs.adobedc.net/ https://*.akstat.io https://*.go-mpulse.net/ https://*.akamaihd.net https://adobedc.demdex.net/ https://sync-transcend-cdn.com https://transcend-cdn.com/ https://telemetry.transcend.io/ https://telemetry.us.transcend.io/ https://privacyportal.onetrust.com/ https://consent.us.transcend.io/ https://api.bazaarvoice.com/ https://stg.api.bazaarvoice.com/ https://agenticapplications.googleapis.com/ https://rx.costco.com/ https://ces.googleapis.com/; child-src 'self' blob: data:; upgrade-insecure-requests;
content-type: text/html; charset=utf-8
date: Fri, 13 Nov 2026 14:57:02 GMT
etag: W/"13a003tjdyy24d56"
server: cloudflare
set-cookie: client-zip-short=43230; Path=/; Expires=Fri, 13 Nov 2026 15:12:02 GMT
strict-transport-security: max-age=31536000;includeSubDomains
transfer-encoding: chunked
vary: Accept-Encoding
x-build-reference: 1.38.20-42722667323
x-build-tag: release-v1.38.20
x-costco-gdx-backend: external-web-backend
x-costco-gdx-deployment: blue
x-envoy-upstream-service-time: 98
x-middleware-rewrite: /en-us
x-next-i18n-router-locale: en-us
x-nextjs-cache: HIT
x-nextjs-prerender: 1
x-nextjs-stale-time: 300
x-timer: S1794581823.597513,VS0,VE6

Inspect all headers in HTTP Header Checker tool →

HSTS is set

Tells browsers to only use HTTPS for this domain.

Content Security Policy is set

Restricts which scripts and resources the page can load.

Missing X-Frame-Options

Prevents clickjacking by disallowing framing.

-3

Missing X-Content-Type-Options

Blocks MIME-sniffing browser attacks.

-2

Missing Referrer Policy

Controls what referrer information is sent with requests.

-2

Missing Permissions Policy

Restricts access to powerful browser features (camera, mic, etc.).

-2

DNS Records

Encrypted DoH resolution: A, AAAA, MX mail servers, authoritative NS, and TXT verification.

Resolved

IPv4 Addresses (A): 151.101.195.52, 151.101.67.52, 151.101.131.52, 151.101.3.52
IPv6 Addresses (AAAA): None
Mail Servers (MX): mxb-001f9d01.gslb.pphosted.com (Priority: 5), mxa-001f9d01.gslb.pphosted.com (Priority: 5), mx0a-001f9d01.pphosted.com (Priority: 10), mx0b-001f9d01.pphosted.com (Priority: 10)
Authoritative Nameservers (NS): a1-116.akam.net, a28-66.akam.net, a9-66.akam.net, a5-64.akam.net, a14-67.akam.net, a6-64.akam.net
TXT Records Found: 30 TXT verification records

A Records (IPv4)

151.101.195.52151.101.67.52151.101.131.52151.101.3.52

TXT Verification Records

d3958bd3-ebec-43fc-8b73-53355efdf2f6.costco.com

onetrust-domain-verification=0cc4aa566b3f4d3d9f5f03bc7cfd73c4

onetrust-domain-verification=e62749d1cc3549bea14bacad4cd8215f

google-site-verification=dffTnhrKhs3V5-UUHvEYJg-RNLJjBz27jCBqmF6sX_E

atlassian-domain-verification=mOyfCnOmDOAo2wCWxZ1feSqlR3yeXX6nP2KotAWqkWWtO1NAJydXpiYNCYEhJUn8

google-site-verification=3Kx9tc2_v5CgX3NuVqNwWFZRYanPPJCP3__8KbRxn5Q

facebook-domain-verification=46if6nzbzbffbhikh3uq8sye7ez5bg

ciscocidomainverification=778c9d75e8b6fdb7dc3f095b677d08d21ececebe8462cb691c377eb0c061c825

vmware-cloud-verification-7161df13-1d90-4cbe-a1a9-0f29fc3e9ffc

docusign=4db9a87a-9dea-417f-bfaa-d45bf7c94291

postman-domain-verification=a5e9b1c7145c22a192ff089eb9c140d4a589b99d7763b87483c24c2deba6d7032578d3a1329849d9e52dd2ae59b3721b451d3fdb461b4514f4e8f5f6b8d696cd

ms-domain-verification=2d5e7430-b403-4b17-a1df-4cb3eee9967b

MS=ms45356090

onx=58b94d97-109f-4db2-98cf-5a1c93395b4d

flexera-domain-verification-bazgmhadwejbbgdq

VmwCafXLaizwh4cfQPdy

Dynatrace-site-verification=85537782-cedf-4d0d-9b24-3126f2ae1dcb__87kk52lv2c0qrp2k60td8iugme

have-i-been-pwned-verification=7411effeb11c12300a4c027396b4cf0f

flexera-domain-verification-mddzccpcqcdbeuih

dtm-domain-verification=RvQ3bIbvQAeeMHbrXwHbtfcU-Z8WGxW6tBQQFfdpIvA

a3a34ae6-fccb-4452-9105-cb31f5348086

docusign=3e51deb4-b2f9-46ef-b120-18f6955ebce1

intersight=c7f5c84fa7c1559a23ae37f0a45aa2806cc1b09291dfe94ffa5c775b65feb280

onx=2d96b540-bcd6-4410-813c-d5e96ab635c5

v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all

google-site-verification=_UMsl36liAGjRl5ldvmM5bK7YCzP_z19C522LsS_6Z4

onx=efbf8ab1-7e83-4416-85a4-711586edb47c

d4c2e4a3297fe25a71d030b67eb83bfc

google-site-verification=XGHXzaAnl-HmYsIW4QB-l4aaHMgJyBHqcT3Jc8SB2BY

adobe-idp-site-verification=ae9e3f0f-2848-4000-aed4-e1c7e8031815

Run live DNS resolution in DNS Lookup tool →

4 address record(s) resolved

6 authoritative nameservers

WHOIS & Identity Lookup

Domain ownership status, registry lifecycle, nameservers, and privacy redaction.

Found

Registrable Domain: costco.com
Registrar Organization: CSC Corporate Domains, Inc.
WHOIS Privacy Status: Public Registration Data
Registry Status Codes: client transfer prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Delegated Authoritative Nameservers: a1-116.akam.net, a14-67.akam.net, a28-66.akam.net, a5-64.akam.net, a6-64.akam.net, a9-66.akam.net
Registration Lifecycle: Registered: 1997 → Expires: 2027

Nameservers (NS)

a1-116.akam.neta14-67.akam.neta28-66.akam.neta5-64.akam.neta6-64.akam.neta9-66.akam.net

Run dedicated WHOIS query for costco.com →

Domain registered 30+ years ago

Long-established domains are far less likely to be disposable scams.

+15

Registered via CSC Corporate Domains, Inc.

Owner information disclosed

The domain publishes registrant contact info — a small positive transparency signal.

Email Security & Deliverability

SPF record validation, DMARC policy enforcement, DKIM selectors, and MX reputation.

Protected

SPF Record: v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com -all
DMARC Policy Mode: Policy: REJECT
DMARC Raw Record: v=DMARC1; p=reject; sp=reject; fo=1; rua=mailto:dmarc_rua@emaildefense.proofpoint.com; ruf=mailto:dmarc_ruf@emaildefense.proofpoint.com;
DKIM Selectors Detected: google, s1, s2

Email Protection Summary: This domain has strong email authentication configured to prevent spammers from sending emails impersonating this brand.

Test email deliverability in Email Reputation tool →

SPF record published

DMARC published (reject)

DKIM configured (google, s1, s2)

Threat Intelligence & Blocklists

Multi-source malware feeds (URLhaus), phishing checks (PhishStats, Safe Browsing), and typosquats.

Clean

URLhaus Malware

Clean / Not Listed

PhishStats Feed

Clean / Not Listed

Google Safe Browsing

Clean / Verified

Root Domain Label: costco
Top-Level Domain (TLD): .com (Standard TLD)
Punycode Obfuscation: No (Standard ASCII)
Homoglyph / Lookalike Script: No mixed scripts
Brand Match Analysis: No recognized brand impersonation
Typosquatting Risk: Clean

No impersonation patterns detected

Domain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.

Technology Stack & Metadata

Detected CMS, JavaScript frameworks, analytics tags, CDN providers, and page metadata.

Detected

Detected Technologies by Category

framework

Next.js

ReactSvelte

css

Tailwind CSS

analytics

Google Analytics

cdn

Cloudflare

Page Metadata & Fingerprint

HTML Title: Welcome to Costco Wholesale
Meta Description: Shop Costco.com for electronics, computers, furniture, outdoor living, appliances, jewelry and more. Enjoy low warehouse prices on name-brands products delivered to your door
Document Language: en-us
Character Encoding: utf-8
Viewport Setting: width=device-width, initial-scale=1
Generator Software: —

Fingerprint tech stack in Technology Detector tool →

6 technologies detected

Next.js, React, Svelte, Tailwind CSS, Google Analytics, Cloudflare

Built on a modern framework

Mobile viewport configured

Page Performance & Compression

Server response time, content payload size, Brotli/Gzip compression, and caching rules.

302ms

Items to Fix & Optimize

Text compression (Brotli/Gzip)

MUCH NEEDEDEnable on server or CDN

Heavy HTML Payload

RECOMMENDEDMinify HTML and bundle assets

Modern image formats (WebP/AVIF/SVG)

OPTIONALConvert heavy images to WebP/AVIF

Protocol

HTTP/3

QUIC-based, multiplexed

Compression

NONE

No compression detected

Optimization Signals (From Detectable Headers & Assets)

Image Formats

Legacy / Unchecked

Transfer

Uncompressed

Transport

QUIC/H3

These are server-side signals. Actual Core Web Vitals (LCP, INP, CLS) require real-user measurement via PageSpeed Insights.

Detected Asset & Image Formats

WebPAVIFSVGJPEGPNG

HTTP Response Time: 302 ms
Payload Body Size: 3480.5 KB
Compression Status: Uncompressed
Cache Directives: no-cache, no-store, must-revalidate, proxy-revalidate, private, max-age=0, s-maxage=0

Large response served uncompressed

Enable gzip or brotli at the edge to cut transfer size dramatically.

-3

Heavy HTML payload (3480.5 KB)

-3

AI Content Safety & Red Flags

High-pressure language, payment gateway safety, disposable domain analysis, and deceptive tactics.

Safe

AI Content Evaluation

96/100 — trusted. Long-established domain (29.7 years old), clean threat reputation, no impersonation patterns. Main reasons: domain registered 30+ years ago; not flagged by Google Safe Browsing; popular website — ranked #1,009 worldwide. Minor issues: no contact page found; large response served uncompressed.

Payment Red Flags: None (No suspicious payment requests)
High-Pressure Language: None (No artificial urgency detected)
Disposable Domain Risk: No (Established infrastructure)
Text Scanned Depth: 5,817 characters verified

No scam-correlated language found on the home page

No crypto-only / gift-card / wire-only payment demands, and no obvious urgency tactics.

Server & Hosting Infrastructure

Primary IP address, web server software, CDN edge network, and redirect hop chain.

cloudflare

Primary Web Server: cloudflare
CDN / Cloud Provider: Cloudflare
Primary IP Address: 151.101.195.52
HTTP Status Code: 200 OK
Final Landing Destination: https://www.costco.com/
Redirect Hop Count: 1 hop

Redirect Hop Chain

1.https://costco.com/ → https://www.costco.com/

Lookup IP & ASN in IP Lookup tool →Trace redirects in URL Expander tool →

Site responded with 200

Final URL: https://www.costco.com/. Response time 302ms.

HTTPS is enforced

All redirects stayed on HTTPS. Traffic is encrypted end-to-end.

+10

Fast response (302ms)

Served through Cloudflare

Sites behind a major CDN benefit from DDoS protection and edge caching.

SSL / TLS Certificate

Active Certificate Authority, Common Name, validity period, expiration countdown, and SANs.

Secure

Certificate Authority (Issuer): Not available (certificate logs did not respond)
Subject Common Name (CN): —
Validity Period: Not available
Subject Alternative Names (SANs): 1 domain protected
Certificates Logged (CT): Verified in live TLS

Subject Alternative Names (Sample)

costco.com

Check certificate history in SSL Checker tool →

HTTPS works with a valid certificate

A secure connection was made on port 443. Certificate log details were unavailable at scan time.

Content & Transparency Policies

Linked privacy policy, terms of service, about page, social channels, and published contacts.

Verified

Key Legal & Transparency Pages

privacy PageFound

terms PageFound

contact PageNot linked

about PageFound

refund PageNot linked

shipping PageFound

cookies PageNot linked

Verified Social Channels

facebook instagram tiktok

Published Phone Numbers: 1400 1400, 05751062-7528-4, 28-8410-579, 638446544, 696-543997, 8409-87248485471

No contact page found

Reputable sites usually publish a contact page.

-4

About page linked from home page

No refund/return policy found

Reputable sites usually publish a refund/return policy.

-3

No cookie policy found

Reputable sites usually publish a cookie policy.

-2

3 social profile(s) linked

facebook, instagram, tiktok

Phone number published

Robots.txt & Sitemap Discoverability

Search engine crawler directives, indexability, and declared XML sitemaps.

Present

Robots.txt Directives: Present & Configured
Sitemaps Declared: https://www.costco.com/sitemap_lw_index.xml
Disallow Rules Count: 54 rules

View Raw robots.txt

# robots.txt for https://www.costco.com

User-agent: *
# Disallow: /*AboutUsView*
# Disallow: /*CTOProductChooserView*
# Disallow: /*CTOProductConfigurationView*
# Disallow: /*CTOProductSummaryView*
# Disallow: /*CashCardBalanceDisplayView*
# Disallow: /*CashCardBalanceInquiry*
# Disallow: /*CatalogAttachmentView*
# Disallow: /*CatalogSearch*
# Disallow: /*CatalogSearchInkJsonView*
# Disallow: /*CatalogSearchResultView*
# Disallow: /*CategoryDisplay*
# Disallow: /*CategoryDisplayView*
# Disallow: /*CategoryOnlyResultsDisplayView*
# Disallow: /*ClickInfo*
# Disallow: /*CompareProductsDisplay*
# Disallow: /*ContactUsSendMessageView*
# Disallow: /*ContactUsView*
# Disallow: /*CostcoCashCardProcess*
# Disallow: /*CostcoWarehouseListDisplayView*
# Disallow: /*CreateStoreView*
# Disallow: /*DefaultSitemapView*
# Disallow: /*FaqView*
# Disallow: /*GetCatalogEntryDetailsByID*
# Disallow: /*GetCatalogEntryInventoryData*
# Disallow: /*HelpContactUsView*
# Disallow: /*NavigationView*
# Disallow: /*OrderByItemsDisplayView*
# Disallow: /*PrivacyView*
# Disallow: /*ProductDisplay*
# Disallow: /*ProductDisplayErrorView*
# Disallow: /*ProductDisplayView*
# Disallow: /*SharedWishListView*
# Disallow: /*SiteMapView*
# Disallow: /*StoreCatalogDisplay*
# Disallow: /*StoreCatalogDisplayView*
# Disallow: /*StoreView*
# Disallow: /*SubCatListDisplayView*
# Disallow: /*TopCategoriesDisplay*
# Disallow: /*TopCategoriesDisplayView*
Disallow: /*WarehouseLocatorBrowseView*
# Disallow: /*WarehouseLocatorDetailsView*
# Disallow: /*WarehouseLocatorDirectionsView*
# Disallow: /*WarehouseLocatorJSView*
# Disallow: /*WarehouseLocatorView*
# Disallow: /*WarehouseTiresLocatorView*
# Disallow: /*WelcomeView*
# Disallow: /*WishListDetailView*
# Disallow: /*WishListResultDisplayView*
# Disallow: /*dynamicJs*
# Disallow: /*dynamic_css*

# Account Management
Disallow: /*AddressBookDisplayView*
Disallow: /*ChangePassword*
Disallow: /*CommunicationPreferenceView*
Disallow: /*NonAjaxAddressBook*
Disallow: /*OrderStatusCmd*
Disallow: /*PaymentMethodDisplayView*
Disallow: /*UserAccountView*
Disallow: /*UserRegistrationErrorView*
Disallow: /*CashCardBalanceInquiry*
Disallow: /*CashCardFormView*

# Checkout Flow
Disallow: /*BillingPaymentDisplayView*
Disallow: /*CheckoutReviewDisplayView*
Disallow: /*CostcoOrderReview*
Disallow: /*MultipleShipmentOrderSummaryView*
Disallow: /*OrderBillingView*
Disallow: /*OrderConfirmationView*

# Error Pages
Disallow: /*AccessControlErrorView*
Disallow: /*AuthenticationPolicyErrorView*
Disallow: /*CrossSiteRequestForgeryErrorView*
Disallow: /*GenericApplicationError*
Disallow: /*GenericError*
Disallow: /*GenericSystemError*
Disallow: /*InvalidInputErrorView*
Disallow: /*InvalidProductView*
Disallow: /*PasswordReEnterErrorView*
Disallow: /*PreviewExclusionView*
Disallow: /*ProductNotFoundView*
Disallow: /*ProhibitedCharacterErrorView*

# Sort and Filtering Query Parameters
#Disallow: /*?*refine=*
Disallow: /*?*pageSize=*
Allow: /*?currentPage=*pageSize=*
Disallow: /*?*sortBy=*

# Logon/Logoff Flow
# Disallow: /*LogonForm*
Disallow: /RegisterAccount*
Disallow: /UserRegistrationForm*
Disallow: /*ResetPassword*
Disallow: /Logoff*

# Order History
Disallow: /*ListOrdersDisplayTableView*
Disallow: /*ListOrdersDisplayView*
Disallow: /*OrderStatusDetailsView*
Disallow: /*OrderStatusSummaryFSAView*
Disallow: /*OrderStatusSummaryView*
Disallow: /*OrderStatusTableDetailsDisplay*

# Legacy References
Disallow: /Browse/
Disallow: /Common/
Disallow: /Warehouse/
Disallow: /CatalogSearch*

# Email Pages 
# Added for story stry0143138
#Disallow: /EmailFriendView*

# Mobile optimization
# Added for story stry0143140
Disallow: /*AjaxManageShoppingCartCmd*
Disallow: /*CTOConfigureCmd*
Disallow: /*WarehouseLocatorDirectionsView*
Disallow: /Pharmacy/AccountRegister
Disallow: /SiteMap$
Disallow: /SiteMap?*
Disallow: /*OrderByItemsDisplayView*
Disallow: /*OrderDefinitionView*
Disallow: /*SharedWishListView*

Sitemap: https://www.costco.com/sitemap_lw_index.xml

robots.txt published

Export & Share Intelligence

Download the complete official PDF verification report (all sections and technical signals expanded), or export raw JSON telemetry.

Scan Engine Performance

Automated multi-signal inspection pipeline

v5.1.0 Engine

Signals Analyzed

This scan

Sources Checked

Live security feeds

Scan Duration

3.90s

Full live scan

Last Scan

11/13/2026

Live timestamp

Overall Risk

Low Risk

User reviews of costco.com

No reviews yet. Be the first to share your experience.