UK licensed gambling sites: what the scores mean

Why a UKGC licence isn't the whole picture

Most people checking a gambling site look up its UKGC licence number and stop there. That's a reasonable first step. But a licence number tells you one specific thing: the operator was authorised to run a gambling business at the point they applied. It doesn't tell you whether the site is currently built to a secure standard.

What a UKGC licence actually certifies

The UKGC authorises operators to offer gambling services to UK consumers. To get that licence, a company has to pass checks on its financial stability, its directors, its anti-money laundering processes, and its responsible gambling procedures. That's real scrutiny. But the licence is a regulatory status, not a technical audit. The UKGC doesn't grade your SSL certificate.

What licensing doesn't cover

A licensed site can run an outdated TLS configuration. It can hide its domain ownership behind a proxy, or have a domain that was only registered months ago. None of those things violate a gambling licence. They're just signs of weaker technical practice that a consumer can't see by checking the UKGC register alone.

Where Domain Score fits in

Domain Score sits alongside the licence check, not in place of it. It measures whether a gambling site's technical infrastructure meets the standard you'd expect from any trusted online service, not just a gambling operator. The licence question and the Domain Score question are different questions. You need both answers.

How Domain Score is calculated

Domain Score is a technical assessment applied uniformly to every site in the database. Each component captures a different signal about how a gambling domain is built and managed. SSL carries the highest weight because it directly affects the security of personal and payment data, but the other components fill in a picture that SSL alone can't provide.

SSL grade

SSL (Secure Sockets Layer, now implemented as TLS) encrypts the connection between a user's browser and the site. But HTTPS alone isn't enough. The grade reflects the quality of that encryption: the protocols in use, the cipher suites offered, and whether security headers are properly set. An A+ grade means everything is correctly configured and up to date. A C grade or lower means something is wrong, whether that's outdated protocols, missing headers, or a misconfigured certificate. On a site that handles payment details, that matters.

DNS maturity

DNS (Domain Name System) is the internet's address book. It's what turns a domain name into a web address. DNS records also carry security configuration: SPF, DKIM, and DMARC records tell email systems whether messages claiming to come from a domain are legitimate, which limits phishing. CAA records specify which certificate authorities can issue SSL certificates for the domain, and DNSSEC adds a digital signature to DNS responses to prevent tampering. Taken together, these records show whether an operator has put proper security controls on their domain, or just pointed it at a server and left it running.

Domain age

Domain age measures how long a domain has been registered. A long-running domain suggests an established site with a track record. A recently registered domain isn't automatically a problem. New brands launch, and white-label products go live, but it does mean there's no history to assess. Domain age doesn't penalise new sites harshly; it simply scores the presence or absence of a track record.

WHOIS transparency

When a domain is registered, the owner's details go into a publicly searchable database called WHOIS. Privacy protection replaces those details with a proxy service, hiding the actual owner. Legitimate gambling operators are publicly licensed entities. Their company details appear on the UKGC register, in Companies House records, and on their own site. There's rarely a reason to also hide domain ownership. A site that chooses to conceal its WHOIS record is worth a closer look, though it doesn't automatically indicate wrongdoing.

Regulator status

This component confirms that the domain appears on the UKGC's register of licensed operators. It's a binary check. The domain either maps to a licensed operator or it doesn't. For sites in this database, this component reflects whether regulator confirmation was achieved at the time of assessment.

Site presence

Site presence verifies that the domain resolves to an actual gambling product. Every site in this database has a screenshot captured at the time of assessment, confirming the domain serves real content. A domain that redirects to an error page or an unrelated site would score poorly here.

SSL grades and what they mean for gamblers

SSL grading runs from A+ at the top to F at the bottom. An A+ grade means the site has implemented encryption correctly: strong protocols, up-to-date cipher suites, and proper security headers in place. An A grade is still acceptable. Minor improvements are available but there's no real risk to users.

Below that, grades reflect progressively weaker configuration. A B grade means something is slightly off, such as an older protocol still enabled. C or D indicates real gaps in the configuration. F means the implementation has failed or the certificate has expired. On any site where you're entering payment or identity details, a B or lower grade is worth paying attention to.

WHOIS transparency and who owns a gambling domain

WHOIS records were designed to keep domain ownership accountable. Privacy tools that mask them are legal and widely used, but the question is whether a gambling operator, which is already a publicly disclosed legal entity, has a good reason to also hide its domain ownership. Most don't. A site that holds a UKGC licence but hides the domain owner's identity isn't necessarily fraudulent. It's a signal worth noting, and Domain Score reflects WHOIS transparency for exactly that reason.

Domain Score and operator Trust Score: two layers

A single operator often runs several gambling domains. Bet365, for example, isn't just one domain. It's a business that operates multiple sites and platforms under the same licence. Domain Score is assigned at the individual domain level. Operator Trust Score sits at the company level. They measure different things, and it's possible for the two to point in different directions.

The difference between a site and its operator

A site with a strong Domain Score has good technical infrastructure. Its SSL is correctly configured and its domain ownership is transparent. That tells you the site itself is built well. It doesn't tell you whether the company behind it has a history of regulatory problems or enforcement actions. That's what Trust Score covers.

How enforcement history connects to operator scoring

When the UKGC takes enforcement action against an operator, whether that's a fine, a licence review, or a formal warning, that record feeds into the operator's Trust Score via the Enforcement component. Domain Score doesn't include enforcement data. A domain can have excellent technical configuration while its operator carries a history of regulatory sanctions. The reverse is equally possible.

Reading both scores together

Neither score alone gives you the full picture. A site with a high Domain Score and a high Operator Trust Score is in the strongest position on both dimensions. A site with a high Domain Score but a poor Trust Score warrants a closer look at the operator's enforcement history. You can follow through from any site in this listing to its operator page to see the Trust Score and any enforcement records.

What to look for when checking a gambling site

The listing on this page gives you a Domain Score for every site. Here's how to read those scores and what to do if something looks off.

Interpreting a Domain Score at a glance

A high Domain Score means the site meets the technical standard you'd expect from a well-run online service. It doesn't guarantee a good gambling experience, and operator reputation sits elsewhere. A low Domain Score means one or more technical signals are weak. That's worth knowing before you hand over payment details.

1. Confirm the UKGC licence first. Check the UKGC register directly to confirm the operator currently holds authorisation. A Domain Score doesn't replace this step.
2. Check the Domain Score. A score in the upper range means the site's technical infrastructure is in good shape. A lower score means one or more components are weak. Look at the individual component breakdown to see which ones.
3. Check the Operator Trust Score. Follow through from the site page to its operator. A strong Domain Score combined with a poor Trust Score is worth investigating before you proceed.
4. Look at the SSL grade specifically. This is the highest-weighted component and the most directly relevant to the security of your personal and payment data. Anything below a B grade deserves attention.

Red flags worth investigating further

WHOIS privacy on a new domain is the most specific of these signals. An established operator launching a new brand will typically have transparent domain ownership because the company is already a public entity. A site that's both new and hiding its ownership doesn't match that pattern. That's not a conclusion, it's a reason to check the operator page and the UKGC register before proceeding.