Attacks Dictionary
Phishing
Definition
Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
Also called: phishing attack
Why it matters for WordPress
Attackers email “your site is hacked, log in here” or “WordPress needs urgent verification.” The fake page captures the password. 2FA helps, but push-fatigue and stolen app codes still happen.
How it shows up in practice
- Emails that rush you to click a login link
- Domains that look almost like your host, registrar, or plugin vendor
- Unexpected password-reset emails you did not request
What to do
- Open admin bookmarks you typed yourself, not links from email.
- Use 2FA and a password manager that will not autofill on lookalike domains.
- Confirm urgent “security” messages through a second channel.
- If you typed a password on a fake page, rotate it everywhere it was reused and review users/plugins.
Full guide: Phishing guide.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.