RN
The advice you were given about this is a decade out of date, and following it now makes you easier to catch rather than harder.
For years the standard guidance was: look for the padlock, check that the address starts with https, and treat its absence as the warning sign. That was sound when certificates cost money and took paperwork. Then they became free and automatic, and the people running fake pages adopted them faster than anyone else, because a padlock makes a page look inspected.
The numbers tell the story cleanly. Around a quarter of phishing pages were served over HTTPS in late 2017. A year later it was roughly half. By early 2021 it had reached about 83% and stopped climbing — not because the trend reversed, but because it had run out of room. Essentially every phishing site that can get a certificate now has one, and the ones that do not are mostly running on hacked servers where the attacker never had the access to install it.
So the padlock tells you exactly one thing: nobody between you and that server can read the traffic. It says nothing whatsoever about who is running the server or what they intend. Its absence is still a bad sign. Its presence is not a good one, and the guides still telling you to check for it are teaching you to be reassured by the single most widely adopted feature of the pages you are trying to avoid.
Here is what to look at instead.
The disclosure that is expensive to fake
The strongest signal available on an adult site is a legal one, and almost nobody looks for it: the record-keeping compliance statement required under 18 U.S.C. § 2257.
Any operator handling sexually explicit material produced in the United States has to designate a named custodian of records, retain age-verification documentation for every performer for seven years, keep it somewhere inspectable for at least twenty hours a week, and publish a statement saying where. It has to be on the pages carrying the material or behind a clearly labelled link to it.
Look for that link — usually in the footer, usually labelled with the statute number. Then read it. A real one names a custodian and gives a physical address for the records. A page that either has no statement at all, or has one that is a paragraph of boilerplate naming nobody and nowhere, is telling you something about the operation behind it.
This works as a signal precisely because it is not cosmetic. The statement commits a named person at a real address to holding documentation that a regulator can turn up and ask for. It is a claim with a consequence attached, which is what separates it from every design cue on the page.
Two caveats. It applies to US-produced content, so a site operating entirely outside that jurisdiction may legitimately have no such statement while other obligations apply to it instead. And a statement's presence is not proof the records exist — it is proof someone was willing to name themselves, which is a meaningful bar and not the same as verification.
Behaviour, not appearance
Design quality is not a signal. It is a template, and templates are cheap. Judge what the page does.
A site that starts a download you did not ask for has already told you what it is; nothing legitimate needs you to install a player, a codec, or an unlocker. Fake controls layered over real ones are the standard trick — if a click near a play button opens a new tab instead of playing, the visible button is decoration. Any click producing a new window is a monetised redirect, and a site that does it once will do it constantly.
Two subtler ones. Watch what happens when you do nothing: a page that pops a dialogue or a permission prompt on a timer is optimising for accidental clicks. And check whether the video is actually there — a "video" that is really a static image linking somewhere else is the oldest layout in the category and still works.
The part that costs more than malware
Most people worry about their laptop and lose money to billing instead, which is the more common and more expensive failure.
Before entering a card anywhere, find three things. What appears on your statement, since adult billing usually runs through a processor under a name you will not recognise, and you need to know it in advance to tell a real charge from a fraudulent one. How to cancel, in writing, on the site, before you subscribe — if the cancellation route is not documented anywhere, that is the design, not an oversight. And whether a free trial requires a card at all, because a card-backed trial is a subscription with a delay on it and converts by default.
The other quiet cost is data. You are handing an adult site an email address and a payment identity, and these companies get breached like everyone else. A dedicated email address and a virtual or single-merchant card number cost nothing and contain the damage when it happens.
One figure I am not giving you
The version of this article that stood here previously cited a study finding that roughly one adult site in ten carried malware or phishing. I went looking for it and it does not appear to exist in the publication it was credited to. Security vendors have published research on threats aimed at adult-site users, and it reports quite different quantities of quite different things.
There is no replacement number here, because the honest position is that nobody has a reliable share. It also does not matter much: the decision procedure is the same whether the figure is one in ten or one in a thousand, and it is the one above — read the disclosure, watch the behaviour, and know your billing before you pay.