If you want to ensure they are only going to connect to your legitimate site, you may want to consider two-factor authentication or certificate based mutual authentication. If it doesn't work, its not legit.
Also, keep in mind that there can be a difference between a secure connection and a connection to the correct host. You can have an attacker make a spoofed site running on HTTPS (though rather unlikely), that will be secure, but not legitimate.
There are a lot of companies that offer "security seals", but as noted in some other responses, these can be faked. Some of them will click through to a vendor, but then the user had to know that the third party is one that can be trusted as well. It's a nice gimmick, but its not really providing extra assurance in a situation where you have no base trust. There are also things like Web Of Trust, where you can see ratings form other people, but again you need to trust them.
As an interesting side note, though, research has shown that people really have no concept of the page versus the browser chrome. Most users are no more likely to trust the lock in the chrome, versus a nice image in the browser page. General end users either don't care about security or don't know. Even if they look at certificate details, they don't know what to do with them. If you put instructions onto the page to check, again, an attacker could fake the same thing, claiming to "ignore the fact the name does not match ours, it is because they are our registered agent".
Whalen, T. and Inkpen, K. M. (2005). Gathering evidence: use of visual security cues in web browsers. In Proceedings of Graphics Interface 2005, GI ’05, pages 137–144, School of Computer Science, University of Waterloo, Waterloo, Ontario, Canada. Canadian Human-Computer Communications Society.
Sunshine, J., Egelman, S., Almuhimedi, H., Atri, N., and Cranor, L. F. (2009). Crying wolf: an empirical study of SSL warning effectiveness. In Proceedings of the 18th conference on USENIX security symposium, SSYM’09, pages 399–416, Berkeley, CA, USA. USENIX Association.
Another example, would be putting a message on your site for a download to tell users to ignore the security warnings about unsigned code, etc. and to continue installing anyway.
man-in-the-middle attack
) rather thanphishing attack
? -You cannot prevent client-side hacks. As always, trained user is above any anti... solution. – Xaqron Apr 5 '13 at 19:19