Phishing threats on WordPress: email scams vs a compromised site

Phishing on WordPress usually means one of two problems. Someone tricks you (or your users) into handing over passwords. Or attackers already own the site and use it to phish visitors. Treat those as separate incidents. The cleanup and the defenses are different.

WordPress runs a huge share of the web, so fake “WordPress.com,” host, and plugin emails stay common. Compromised sites that serve fake login pages or popup “security alerts” are common too. You need a clear split between inbox scams and site infections.

Email phishing vs a compromised WordPress site

Email phishing (you are the target)

Attackers send messages that look like WordPress.com, your host, a plugin vendor, or a copyright lawyer. The goal is usually your admin password, a password-reset link, or a download that installs malware on your machine.

Classic tells still matter: odd domains, urgent legal tone, “verify your account or we delete the site,” and links that do not match the real vendor. Generative AI makes grammar less of a giveaway. Check the From address, hover the URL before you click, and open the real dashboard by typing the URL yourself.

One recurring pattern is fake copyright or DMCA mail. The message claims content on your site infringes IP and asks you to “view the complaint” on a lookalike login form. Enter credentials there and the attacker owns the admin account.

Related risk: reused passwords from older breaches (credential stuffing). Phishing and stuffing both end with someone else logging in as you.

Compromised site (your visitors are the target)

If attackers already have admin or file access, they can plant fake pages, inject popups, or redirect visitors to credential-harvesting sites. That is malware and often a backdoor, not “email phishing.” Visitors trust your domain, so the scam looks legitimate.

Plugin and theme vulnerabilities still feed this path. Unpatched plugins, nulled themes, and abandoned extensions give attackers a foothold. From there they add phishing pages, spam redirects, or hidden admin users.

Do not confuse this with “someone emailed me a bad link.” If Search Console flags phishing, users report fake login forms on your URLs, or you find unknown pages in the dashboard, you are in cleanup mode. Start with what to do if your WordPress site is hacked.

Signs your site may be used for phishing

Watch for several of these at once:

• Google Safe Browsing or Search Console warnings about phishing or deceptive pages
• Sudden traffic drops while bounce or “redirect” reports rise
• Admin or user passwords that no longer work
• Unknown administrator accounts or odd plugin installs
• Popups or overlays you did not add (fake sales, “security alerts,” login clones)
• A spike in password-reset emails from your own site

None of these prove phishing alone. Together they are enough to pull the site into maintenance and investigate.

How to find phishing content on the site

Email phishing is handled in the inbox and with password resets. Site-hosted phishing lives in files and the database.

Practical places to look:

• Unknown pages or posts with login-like copy
• Injected scripts in themes, header.php / footer.php, or page builders
• Suspicious files under wp-content/uploads/ (especially .php or double extensions)
• Redirects in .htaccess, index.php, or siteurl / home options
• New mu-plugins or drop-ins you did not install

A malware scanner and file integrity monitoring catch a lot of this faster than a full manual walk. Still compare against a clean backup when you can. Attackers often leave more than one file.

Steps to remove site-hosted phishing

1. Put the site in maintenance mode (or take it offline) so fewer visitors hit the scam pages.
2. Take a full backup of files and database before you delete anything. You may need it for forensics or rollback.
3. Scan with a security plugin, then review flagged paths by hand.
4. Remove malicious pages, scripts, and unknown admin users. Prefer restoring clean copies of core, themes, and plugins over “editing out” obfuscated code line by line.
5. Reset all privileged passwords. Turn on two-factor authentication before you reopen the site.
6. Follow through with malware removal. Cleaning one phishing page while leaving a backdoor means reinfection.

If you are locked out or the infection keeps returning, involve your host or a professional cleanup. WordPress.org support cannot clean your site for you.

How to defend against WordPress phishing

No single control stops every scam. Layer a few that matter:

• Unique, long passwords in a password manager for every admin and every site.
• Two-factor authentication (MFA) on administrators and anyone who can install plugins. A stolen password from a fake email should not be enough.
• HTTPS everywhere with a valid SSL/TLS certificate so browsers and users see a normal secure connection.
• Fewer administrators and least privilege for day-to-day work. See WordPress user roles.
• Keep core, themes, and plugins updated. Remove what you do not use.
• A firewall to cut common exploit and brute-force noise before WordPress handles it.
• Sane login hardening from the login security guide: limit failed logins, watch for unknown users, log security events.

About “hiding” /wp-login.php or /wp-admin: it can cut casual probes, but it is not a substitute for MFA, strong passwords, and updates. Attackers who phish credentials, steal cookies, or exploit a plugin never needed the default URL. Treat hide-login as optional obscurity, not your main defense.

Bottom line

Email phishing steals your login. A compromised WordPress site uses your domain to steal from visitors. Separate those problems, clean malware and backdoors properly, then lock privileged accounts behind MFA. That combination protects you and the people who trust your site.