---
title: Phishing
canonical: https://wpsecurityninja.com/dictionary/phishing/
---
# Phishing

Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.

[Full guide](https://wpsecurityninja.com/your-guide-to-phishing/)

## Why it matters for WordPress

Attackers email “your site is hacked, log in here” or “WordPress needs urgent verification.” The fake page captures the password. 2FA helps a lot, but rush and fear still win when people click before they think.

## How it shows up in practice

- Emails that rush you to click a login link
- Domains that look almost like your host, registrar, or plugin vendor
- Unexpected password-reset emails you did not request
- A compromised site used to host phishing kits aimed at someone else’s brand

## What to do

1. Open admin bookmarks you typed yourself, not links from email.
2. Use 2FA and a password manager that will not autofill on lookalike domains.
3. Confirm urgent “security” messages through a second channel.
4. If you typed a password on a fake page, rotate it everywhere it was reused and review users and plugins.

Full guide: [Phishing guide](https://wpsecurityninja.com/your-guide-to-phishing/).