How do I verify website URLs submitted during account signup?

The problem

During account creation on your platform, users submit a website URL. Some submit parked domains, freshly registered sites, or domains impersonating known brands. Without verification, fake accounts slip through, polluting your user base and creating downstream problems for trust, billing, and abuse prevention.

Manual review doesn't scale. You need an automated signal at the point of signup that separates real businesses from empty shells and bad actors.

How Unphurl solves it

When a user submits a URL during signup, pass it to Unphurl in real time. You get back a score and structured signals. Legitimate businesses with established domains sail through. Parked domains, brand impersonators, and freshly minted sites get flagged for manual review or automatic rejection. Your onboarding flow stays fast for good actors and hostile for bad ones.

Signals that matter for this use case

• – Parked domain means the submitted website is just a placeholder. No real business behind it.
• – HTTP only signals a site with no SSL at all, which is unusual for any legitimate business in 2026
• – SSL invalid indicates an expired or misconfigured certificate, a sign of neglect or abandonment
• – Domain age <7 days flags domains created in the past week, common for throwaway signups
• – Brand impersonation catches domains mimicking well-known brands with typosquatting or lookalike names
• – No MX record means the domain can't receive email, a data quality signal worth flagging during onboarding
• – High domain entropy identifies randomly generated domain names often used by disposable sites
• – Expiring soon means the domain registration is about to lapse. Not a sign of a going concern.

Suggested scoring profile

{
  "name": "onboarding",
  "weights": {
    "parked": 30,
    "http_only": 20,
    "ssl_invalid": 20,
    "domain_age_7": 15,
    "brand_impersonation": 15,
    "no_mx_record": 15,
    "domain_entropy_high": 10,
    "expiring_soon": 10
  }
}

What a result looks like

A user submits totally-real-biz.xyz during account signup. Your backend checks it before creating the account:

Score 45 exceeds your threshold. The application is flagged for manual review instead of auto-approved. Your team investigates before granting access.

Cost

Real-time, one URL at a time. Most legitimate businesses use well-known domains that resolve free from the Tranco list or cache. Maybe 10-30% of signups submit unknown domains that require a pipeline check. The Starter package covers thousands of signups before you need to top up.

Get started

For developers: Add a single API call to your signup flow.

# Check a submitted URL during signup
curl -s https://api.unphurl.com/v1/check \
  -H "Authorization: Bearer uph_your_key_here" \
  -d '{"url": "https://totally-real-biz.xyz", "profile": "onboarding"}'

# Score > 30? Flag for review. Score < 30? Auto-approve.