Good post! The only thing I would add is to compute checksums if they're publicly available. To those that don't know what a checksum is, keep reading.
A hashing algorithm is something that takes an arbitrary amount of information and maps it to a fixed size. For example, the phrase "the quick brown fox jumps over the lazy dog" maps to "77add1d5f41223d5582fca736a5cb335" (32 characters) through the md5 hashing algorithm. Many legitimate sites will provide a hash value for the site. To figure out if you're on a legit site, you can take the html page and hash it via whatever the listed algorithm is, and verify that it matches the listed hash. These listed hashes will be called hashes or checksums. For more information, check out wikipedia. If you're still reading, the md5 algorithm is vulnerable to hash collisions, so use a collision-resistant algorithm like SHA-3.