Is etsy.com safe?

Very Likely Safe

No major red flags found. This looks like a legitimate, established website.

Checked Nov 13, 2026

Trust score

Why: Main reasons: domain registered 23+ years ago; no impersonation patterns detected; not listed on URLhaus malware blocklist. Minor issues: site returned HTTP 403; missing HSTS.

Identity & Age100/100

Impersonation Risk100/100

Red Flags100/100

Transparency70/100

Security77/100

Email100/100

Positive highlights

Domain registered 23+ years agoLong-established domains are far less likely to be disposable scams.
HTTPS is enforcedAll redirects stayed on HTTPS. Traffic is encrypted end-to-end.
Valid SSL / TLS certificate activeIssued by C=US, O=Let's Encrypt, CN=YR1, valid for 33 remaining days.
No impersonation patterns detectedDomain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.
Not listed on URLhaus malware blocklist
Fast response (211ms)
Not present in PhishStats phishing feed
DMARC published (reject)
No scam-correlated language found on the home pageNo crypto-only / gift-card / wire-only payment demands, and no obvious urgency tactics.
SPF record published

Negative highlights

Site returned HTTP 403The server is reachable but did not return a success status.
Missing HSTSTells browsers to only use HTTPS for this domain.
Missing Content Security PolicyRestricts which scripts and resources the page can load.

Note: Registered via MarkMonitor Inc..

Note: 1 technologies detected. Cloudflare

Note: Policy pages could not be checked. The site showed our scanner a bot-check or short page, so privacy, terms and contact pages were not verified. This is common for large sites and is not counted against them.

Key facts about etsy.com

Website: etsy.com
Popularity: Not checked
Domain created: Feb 5, 2004 (22.8 years old)
Domain expires: Feb 5, 2027
Registrar: MarkMonitor Inc.
Owner details: Public in WHOIS
IP address: 151.101.129.224
Hosting / CDN: Cloudflare
SSL certificate: Let's Encrypt · valid until Dec 16, 2026
Email security: SPF ✓ · DMARC ✓ (reject)
Threat blocklists: Not listed (clean)
Technology: Cloudflare

Summary

92/100 — trusted. Long-established domain (22.8 years old), clean threat reputation, no impersonation patterns.

No malware/phishing on feedsGood reputationHTTPS enabled

Full technical report

Domain Information

Registration timeline, age calculation, registrar details, and ICANN status.

Verified

Registrar Name: MarkMonitor Inc.
Creation Date: February 5, 2004 (22.8 years ago)
Last Updated: January 4, 2025
Registry Expiry Date: February 5, 2027
WHOIS Privacy Protection: Publicly Visible
Domain Status Codes: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited

ICANN Status Badges

client delete prohibitedclient transfer prohibitedclient update prohibitedserver delete prohibitedserver transfer prohibitedserver update prohibited

Open in standalone WHOIS / RDAP Lookup tool →

Domain registered 23+ years ago

Long-established domains are far less likely to be disposable scams.

+15

Registered via MarkMonitor Inc.

Owner information disclosed

The domain publishes registrant contact info — a small positive transparency signal.

HTTP Headers & Security

Full HTTP response headers, HSTS, Content Security Policy (CSP), and security baselines.

Warning

Security Header Baseline

Strict-Transport-SecurityMissing

Content-Security-PolicyMissing

X-Frame-OptionsMissing

X-Content-Type-OptionsMissing

Referrer-PolicyMissing

Permissions-PolicyMissing

Recommended Missing Headers

missing: HSTSmissing: Content Security Policymissing: X-Frame-Optionsmissing: X-Content-Type-Optionsmissing: Referrer Policymissing: Permissions Policy

All Response Headers (27)

accept-ch: Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory,Sec-CH-UA-Platform-Version
accept-ranges: bytes
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: x-dd-b, x-set-cookie
alt-svc: h3=":443"; ma=7200
cache-control: max-age=0, private, no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: a59db042bff1a1f9-YYZ
charset: utf-8
connection: close
content-length: 776
content-type: text/html;charset=utf-8
date: Fri, 13 Nov 2026 12:13:06 GMT
pragma: no-cache
server: cloudflare
set-cookie: exp_ebid=m=yz086hcdETha%2FZhiFzBEBRt0JsXW18ZZs%2FPgBYAbYd0%3D,v=ofk8bAg_slOw_n_eY0cplVaxyPUVUIIl; domain=.etsy.com; path=/; Secure; max-age=5184000
via: 1.1 varnish
x-cache: MISS
x-cache-hits: 0
x-datadome: protected
x-datadome-cid: AHrlqAAAAAMAYeH_U3u-PgIA-Ost8Q==
x-datadome-riskscore: 0.9681066703714664
x-dd-b: 2
x-fastly-backend-reqs: 4
x-served-by: cache-yyz-cyyz770032-YYZ
x-timer: S1794571986.368263,VS0,VE15

Inspect all headers in HTTP Header Checker tool →

Missing HSTS

Tells browsers to only use HTTPS for this domain.

-4

Missing Content Security Policy

Restricts which scripts and resources the page can load.

-4

Missing X-Frame-Options

Prevents clickjacking by disallowing framing.

-3

Missing X-Content-Type-Options

Blocks MIME-sniffing browser attacks.

-2

Missing Referrer Policy

Controls what referrer information is sent with requests.

-2

Missing Permissions Policy

Restricts access to powerful browser features (camera, mic, etc.).

-2

DNS Records

Encrypted DoH resolution: A, AAAA, MX mail servers, authoritative NS, and TXT verification.

Resolved

IPv4 Addresses (A): 151.101.129.224, 151.101.65.224, 151.101.1.224, 151.101.193.224
IPv6 Addresses (AAAA): None
Mail Servers (MX): aspmx.l.google.com (Priority: 10), alt1.aspmx.l.google.com (Priority: 20), alt2.aspmx.l.google.com (Priority: 30), aspmx2.googlemail.com (Priority: 40), aspmx3.googlemail.com (Priority: 50)
Authoritative Nameservers (NS): dns1.p03.nsone.net, ns-1264.awsdns-30.org, dns3.p03.nsone.net, ns-162.awsdns-20.com
TXT Records Found: 29 TXT verification records

A Records (IPv4)

151.101.129.224151.101.65.224151.101.1.224151.101.193.224

TXT Verification Records

MS=61C0D53B132406B96613AF941D1FFB83A6CFCD73

MS=ms91667443

_globalsign-domain-verification=xfkrv3yRwA5GGm0E4l5RlcNKTqVD8KAYsYdCYTBMF0

adobe-idp-site-verification=1858581c5ab657f77e067d14de03dd297c85f0b6b2916dbe0adeca4fac539e6b

airtable-verification=23b884301fafa42d33a80aa3c8b48d9b

anthropic-domain-verification-nehbw6=4taelnzAjM6NVkhm1rylyYZ8r

apple-domain-verification=qgAwoHpdlhEv-3QiQ3G11S5xHj60JbTSzecxszntlvo

atlassian-domain-verification=cMcfcaBm3JNaxKiO2fok5oOn20qbqxLmjQdFrsLV25SQj8l5hTkX/pb21NqLPLP0

bugcrowd-verification=460ceee75155fa4965c62123bc9cd182

cursor-domain-verification-vyqnwm=JyRGj2Bcnbk8QqNAclaAE8mHY

datadome-domain-verify=BNtk7vonAvB8fhBLjp0E2orOzns71WB1

docker-verification=40052c18-7a84-4d01-a294-9fed0866066e

docusign=9866d46c-c0b0-47c6-a98e-c6381eb4ccc6

facebook-domain-verification=j81l6m6391dika9nlbuh2c8ji9nhye

fastly-domain-delegation-svi5ebiqbg4tbn-20251029

google-site-verification=mpVLpWjH_tjbc5eK6pmVTZjq4xmHhzoE3crE0rKFULs

jamf-site-verification=lUaUDNLb-GDzmbIbaCg_lg

lucidlink-verification=HYZGQ2NMESYDAVG1GR5EJX21Z0

miro-verification=31250d3fe2c000cf1f892588d27dcf9eeb6afdd8

monday-com-verification=bG-_DMl97UjUXdEr36_aoOlymHnNMGiZ9z_UM8h7t20

onetrust-domain-verification=9f4716cb45f046429764b34174392ce2

openai-domain-verification=dv-kBkaf6OFwgohxPZc4YIjOD6t

pinterest-site-verification=b92965d84ebb1103548fbd23e39baf66

segment-site-verification=qK8Hs2slX9yMAAiKpgMoNP6bJCKq0cqQ

stripe-verification=5e8773ee85575b784fc2a6868da2b17b165e2e59f62d067f77bfd40c0ad5cdc5

stripe-verification=660c4cdde58756c254bc46c26b92b6232ebc140156e6d2ba74cbb988b283b5ae

stripe-verification=fe491048e654bcc35d8f194964540604a3a4108e3191ffd27a9ea4c232d5bcf1

v=spf1 ip4:66.3.159.0/24 ip4:192.147.0.0/24 ip4:173.46.67.72/29 ip4:192.147.1.0/24 ip4:38.106.64.0/24 ip4:38.76.1.0/24 ip4:38.76.2.0/24 ip4:162.220.28.32/27 ip4:162.220.28.64/28 ip4:208.74.204.0/22 ip4:46.19.168.0/23 include:servers.mcsv.net include:mail." "zendesk.com include:amazonses.com include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com a:web.q4press.com include:cvent-planner.com include:mail.clinchtalent.com include:spf.redpoints.com -all

wrike-verification=NDMwNDc4NDo3YzVlMGVmM2RhZGU0NjRkZTIxZTBjYmU5Mjc2NGZmODRmNzVhMDc2NjRmMTI0NThhYzlhZTdhMzhkNzkyY2Uw

Run live DNS resolution in DNS Lookup tool →

4 address record(s) resolved

4 authoritative nameservers

WHOIS & Identity Lookup

Domain ownership status, registry lifecycle, nameservers, and privacy redaction.

Found

Registrable Domain: etsy.com
Registrar Organization: MarkMonitor Inc.
WHOIS Privacy Status: Public Registration Data
Registry Status Codes: client delete prohibited, client transfer prohibited, client update prohibited, server delete prohibited, server transfer prohibited, server update prohibited
Delegated Authoritative Nameservers: dns1.p03.nsone.net, dns3.p03.nsone.net, ns-1264.awsdns-30.org, ns-162.awsdns-20.com
Registration Lifecycle: Registered: 2004 → Expires: 2027

Nameservers (NS)

dns1.p03.nsone.netdns3.p03.nsone.netns-1264.awsdns-30.orgns-162.awsdns-20.com

Run dedicated WHOIS query for etsy.com →

Domain registered 23+ years ago

Long-established domains are far less likely to be disposable scams.

+15

Registered via MarkMonitor Inc.

Owner information disclosed

The domain publishes registrant contact info — a small positive transparency signal.

Email Security & Deliverability

SPF record validation, DMARC policy enforcement, DKIM selectors, and MX reputation.

Protected

SPF Record: v=spf1 ip4:66.3.159.0/24 ip4:192.147.0.0/24 ip4:173.46.67.72/29 ip4:192.147.1.0/24 ip4:38.106.64.0/24 ip4:38.76.1.0/24 ip4:38.76.2.0/24 ip4:162.220.28.32/27 ip4:162.220.28.64/28 ip4:208.74.204.0/22 ip4:46.19.168.0/23 include:servers.mcsv.net include:mail." "zendesk.com include:amazonses.com include:_netblocks.google.com include:_netblocks2.google.com include:_netblocks3.google.com a:web.q4press.com include:cvent-planner.com include:mail.clinchtalent.com include:spf.redpoints.com -all
DMARC Policy Mode: Policy: REJECT
DMARC Raw Record: v=DMARC1; p=reject; fo=1; rua=mailto:dmarc@etsy.com; ruf=mailto:dmarc@etsy.com
DKIM Selectors Detected: google, s1, s2

Email Protection Summary: This domain has strong email authentication configured to prevent spammers from sending emails impersonating this brand.

Test email deliverability in Email Reputation tool →

SPF record published

DMARC published (reject)

DKIM configured (google, s1, s2)

Threat Intelligence & Blocklists

Multi-source malware feeds (URLhaus), phishing checks (PhishStats, Safe Browsing), and typosquats.

Clean

URLhaus Malware

Clean / Not Listed

PhishStats Feed

Clean / Not Listed

Google Safe Browsing

Not checked

Root Domain Label: etsy
Top-Level Domain (TLD): .com (Standard TLD)
Punycode Obfuscation: No (Standard ASCII)
Homoglyph / Lookalike Script: No mixed scripts
Brand Match Analysis: No recognized brand impersonation
Typosquatting Risk: Clean

No impersonation patterns detected

Domain doesn't look like a typosquat, doesn't embed a well-known brand, and uses ASCII characters.

Technology Stack & Metadata

Detected CMS, JavaScript frameworks, analytics tags, CDN providers, and page metadata.

Detected

Detected Technologies by Category

cdn

Cloudflare

Page Metadata & Fingerprint

HTML Title: etsy.com
Meta Description: —
Document Language: en
Character Encoding: utf-8
Viewport Setting: width=device-width
Generator Software: —

Fingerprint tech stack in Technology Detector tool →

1 technologies detected

Cloudflare

Page Performance & Compression

Server response time, content payload size, Brotli/Gzip compression, and caching rules.

211ms

Items to Fix & Optimize

Text compression (Brotli/Gzip)

MUCH NEEDEDEnable on server or CDN

Modern image formats (WebP/AVIF/SVG)

OPTIONALConvert heavy images to WebP/AVIF

Protocol

HTTP/3

QUIC-based, multiplexed

Compression

NONE

No compression detected

Optimization Signals (From Detectable Headers & Assets)

Image Formats

Legacy / Unchecked

Transfer

Uncompressed

Transport

QUIC/H3

These are server-side signals. Actual Core Web Vitals (LCP, INP, CLS) require real-user measurement via PageSpeed Insights.

Detected Asset & Image Formats

WebPAVIFSVGJPEGPNG

HTTP Response Time: 211 ms
Payload Body Size: 0.8 KB
Compression Status: Uncompressed
Cache Directives: max-age=0, private, no-cache, no-store, must-revalidate

No findings.

AI Content Safety & Red Flags

High-pressure language, payment gateway safety, disposable domain analysis, and deceptive tactics.

Safe

AI Content Evaluation

92/100 — trusted. Long-established domain (22.8 years old), clean threat reputation, no impersonation patterns. Main reasons: domain registered 23+ years ago; no impersonation patterns detected; not listed on URLhaus malware blocklist. Minor issues: site returned HTTP 403; missing HSTS.

Payment Red Flags: None (No suspicious payment requests)
High-Pressure Language: None (No artificial urgency detected)
Disposable Domain Risk: No (Established infrastructure)
Text Scanned Depth: 54 characters verified

No scam-correlated language found on the home page

No crypto-only / gift-card / wire-only payment demands, and no obvious urgency tactics.

Server & Hosting Infrastructure

Primary IP address, web server software, CDN edge network, and redirect hop chain.

cloudflare

Primary Web Server: cloudflare
CDN / Cloud Provider: Cloudflare
Primary IP Address: 151.101.129.224
HTTP Status Code: 403 OK
Final Landing Destination: https://www.etsy.com/
Redirect Hop Count: 1 hop

Redirect Hop Chain

1.https://etsy.com/ → https://www.etsy.com/

Lookup IP & ASN in IP Lookup tool →Trace redirects in URL Expander tool →

Site returned HTTP 403

The server is reachable but did not return a success status.

-6

HTTPS is enforced

All redirects stayed on HTTPS. Traffic is encrypted end-to-end.

+10

Fast response (211ms)

Served through Cloudflare

Sites behind a major CDN benefit from DDoS protection and edge caching.

SSL / TLS Certificate

Active Certificate Authority, Common Name, validity period, expiration countdown, and SANs.

Secure

Certificate Authority (Issuer): C=US, O=Let's Encrypt, CN=YR1
Subject Common Name (CN): theetsymarket.etsy.com
Validity Period: 33 days remaining (Expires: 2026-12-16T23:23:02Z)
Subject Alternative Names (SANs): 40 domains protected
Certificates Logged (CT): 100 certs recorded

Subject Alternative Names (Sample)

theetsymarket.etsy.comeducation.etsy.comcommunity.etsy.comdsml.etsy.comoktapreview.etsy.comhelp.etsy.cominvestors.etsy.comwww-ak-staging.etsy.comwww-ak.etsy.comopenapi-ak.etsy.comwww.action.etsy.comaction.etsy.combcn.etsy.comdeveloper.etsy.comdevelopers.etsy.comopenapi-h3.etsy.cometsy.comvt.etsy.comprincess-bcn.etsy.comextfiles.etsy.combrandguidelines.etsy.comopenapi-f.etsy.comwww-f.etsy.comdam.etsy.cometsy.bynder.combrand.etsy.comclick.e.etsy.comauth-api.etsy.combrk-esxi03.netwk.etsy.comjpm-gmp-signing-prod.etsy.comjpm-gmp-transport-prod.etsy.comwww.jpm-gmp-transport-prod.etsy.comwww.jpm-gmp-signing-prod.etsy.combrk-powerstore.netwk.etsy.comwww.brk-powerstore.netwk.etsy.combrk-wlc.netwk.etsy.combrk-checkmk.netwk.etsy.combrk-esxi01.netwk.etsy.combrk-esxi02.netwk.etsy.combrk-esxi04.netwk.etsy.com+20 more

Check certificate history in SSL Checker tool →

Valid SSL / TLS certificate active

Issued by C=US, O=Let's Encrypt, CN=YR1, valid for 33 remaining days.

+10

Content & Transparency Policies

Linked privacy policy, terms of service, about page, social channels, and published contacts.

Warning

Key Legal & Transparency Pages

privacy PageNot linked

terms PageNot linked

contact PageNot linked

about PageNot linked

refund PageNot linked

shipping PageNot linked

cookies PageNot linked

Policy pages could not be checked

The site showed our scanner a bot-check or short page, so privacy, terms and contact pages were not verified. This is common for large sites and is not counted against them.

Robots.txt & Sitemap Discoverability

Search engine crawler directives, indexability, and declared XML sitemaps.

Present

Robots.txt Directives: Present & Configured
Sitemaps Declared: None in robots.txt
Disallow Rules Count: 1711 rules

View Raw robots.txt

User-agent: Spinn3r
Disallow: /

User-agent: AdsBot-Google-Mobile
Disallow: /people
Disallow: /uk/people
Disallow: /au/people
Disallow: /ca/people
Disallow: /de-en/people
Disallow: /dk-en/people
Disallow: /fi-en/people
Disallow: /hk-en/people
Disallow: /ie/people
Disallow: /il-en/people
Disallow: /in-en/people
Disallow: /no-en/people
Disallow: /nz/people
Disallow: /se-en/people
Disallow: /sg-en/people
Disallow: /es/people
Disallow: /mx/people
Disallow: /us-es/people
Disallow: /de/people
Disallow: /at/people
Disallow: /ch/people
Disallow: /fr/people
Disallow: /ca-fr/people
Disallow: /it/people
Disallow: /nl/people
Disallow: /be/people
Disallow: /jp/people
Disallow: /pl/people
Disallow: /pt/people
Disallow: /se/people

User-agent: *
Disallow: /api/
Disallow: /your/
Disallow: /r/group/
Disallow: /appeals/
Disallow: /transactions/
Disallow: /treasury
Disallow: /teams
Disallow: /cart
Disallow: /conversations
Disallow: /conversations/
Disallow: /locale/overlay
Disallow: /locale/overlay_secure
Disallow: /guest-pass/
Disallow: /mailinglist/
Disallow: /mini.php
Disallow: /update_check.php
Disallow: /invites/buy
Disallow: /share
Disallow: /bcn
Disallow: /listing/*/stubs/*
Disallow: /market/confederate_flag
Disallow: /market/rebel_flag
Disallow: /market/dixie_flag
Disallow: /help/sitemap.php
Disallow: /help/sitemap/*
Disallow: /*?order=*
Disallow: /*handmade/
Disallow: /*color=*
Disallow: /*my_etsy=*
Disallow: /*gift_card=*
Disallow: /*customizable=*
Disallow: /*locationQuery=*
Disallow: /*min=*
Disallow: /*max=*
Disallow: */people/*/circle*
Disallow: */people/*/favorites*
Disallow: */shop/*/sold*
Disallow: */shop/*/favoriters*
Disallow: */listing/*/favoriters*
Disallow: /search*attr_*=*
Disallow: /c/*attr_*=*
Disallow: /c?*attr_*=*
Disallow: /search*price_bucket=*
Disallow: /c/*price_bucket=*
Disallow: /search*ship_to=*
Disallow: /c/*ship_to=*
Disallow: /search*search_type=*
Disallow: /c/*search_type=*
Disallow: /shop_name_search_service
Disallow: /messages
Disallow: /apps
Disallow: /search?*q=
Disallow: /search/?*q=
Disallow: /search/*?*q=
Disallow: /search/*/?*q=
Disallow: */shop/*/rss_shop.php
Disallow: /uk/api/
Disallow: /au/api/
Disallow: /ca/api/
Disallow: /de-en/api/
Disallow: /dk-en/api/
Disallow: /fi-en/api/
Disallow: /hk-en/api/
Disallow: /ie/api/
Disallow: /il-en/api/
Disallow: /in-en/api/
Disallow: /no-en/api/
Disallow: /nz/api/
Disallow: /se-en/api/
Disallow: /sg-en/api/
Disallow: /es/api/
Disallow: /mx/api/
Disallow: /us-es/api/
Disallow: /de/api/
Disallow: /at/api/
Disallow: /ch/api/
Disallow: /fr/api/
Disallow: /ca-fr/api/
Disallow: /it/api/
Disallow: /nl/api/
Disallow: /be/api/
Disallow: /jp/api/
Disallow: /pl/api/
Disallow: /pt/api/
Disallow: /se/api/
Disallow: /uk/your/
Disallow: /au/your/
Disallow: /ca/your/
Disallow: /de-en/your/
Disallow: /dk-en/your/
Disallow: /fi-en/your/
Disallow: /hk-en/your/
Disallow: /ie/your/
Disallow: /il-en/your/
Disallow: /in-en/your/
Disallow: /no-en/your/
Disallow: /nz/your/
Disallow: /se-en/your/
Disallow: /sg-en/your/
Disallow: /es/your/
Disallow: /mx/your/
Disallow: /us-es/your/
Disallow: /de/your/
Disallow: /at/your/
Disallow: /ch/your/
Disallow: /fr/your/
Disallow: /ca-fr/your/
Disallow: /it/your/
Disallow: /nl/your/
Disallow: /be/your/
Disallow: /jp/your/
Disallow: /pl/your/
Disallow: /pt/your/
Disallow: /se/your/
Disallow: /uk/r/group/
Disallow: /au/r/group/
Disallow: /ca/r/group/
Disallow: /de-en/r/group/
Disallow: /dk-en/r/group/
Disallow: /fi-en/r/group/
Disallow: /hk-en/r/group/
Disallow: /ie/r/group/
Disallow: /il-en/r/group/
Disallow: /in-en/r/group/
Disallow: /no-en/r/group/
Disallow: /nz/r/group/
Disallow: /se-en/r/group/
Disallow: /sg-en/r/group/
Disallow: /es/r/group/
Disallow: /mx/r/group/
Disallow: /us-es/r/group/
Disallow: /de/r/group/
Disallow: /at/r/group/
Disallow: /ch/r/group/
Disallow: /fr/r/group/
Disallow: /ca-fr/r/group/
Disallow: /it/r/group/
Disallow: /nl/r/group/
Disallow: /be/r/group/
Disallow: /jp/r/group/
Disallow: /pl/r/group/
Disallow: /pt/r/group/
Di

robots.txt published

Export & Share Intelligence

Download the complete official PDF verification report (all sections and technical signals expanded), or export raw JSON telemetry.

Scan Engine Performance

Automated multi-signal inspection pipeline

v5.1.0 Engine

Signals Analyzed

This scan

Sources Checked

Live security feeds

Scan Duration

4.67s

Full live scan

Last Scan

11/13/2026

Live timestamp

Overall Risk

Low Risk

User reviews of etsy.com

No reviews yet. Be the first to share your experience.