How to check the trust score of a website (what automation catches, and what still needs a human)?

I've been running a batch of sites through Trustracer, Scamadviser and other website trust checkers lately. The scores are genuinely useful, but the more I check, the more I keep hitting the same nagging thought: an automated trust score tells you about the shell of a site, not always the behavior behind it.

Here's roughly how I see the split.

What automated checkers do well is the structural layer:

• Domain age and WHOIS history
• SSL/certificate validity
• Blacklist and malware flags
• Hosting reputation and known bad-network associations
• Obvious fake-review and review-volume anomalies

What they struggle with is the behavioral layer:

• Whether the business actually ships, refunds, or honors what it promises
• Support quality after you've paid
• Clean-technical scams: a fresh, well-built site can score fine and still be a front
• Coordinated-but-undetected reviews vs. genuine ones
• Rebrand/domain-swap tricks where a bad operator resurfaces under a fresh shell

That last category is where I keep feeling the gap. A high score lowers my suspicion, but it doesn't prove much, mostly that a site isn't obviously broken or flagged yet. The slow-burn scams are built to pass exactly these checks.

So the question I want to throw to this sub:

Where's the real line for you between "an automated checker settles this" and "a human has to verify it"? Which parameters do you trust the score on, and which do you always check manually before trusting a site with money or data?