Attacks Dictionary
Phishing
Definition
Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
Also called: phishing attack
Last updated
Why it matters for WordPress
Attackers email “your site is hacked, log in here” or “WordPress needs urgent verification.” The fake page captures the password. 2FA helps a lot, but rush and fear still win when people click before they think.
How it shows up in practice
- Emails that rush you to click a login link
- Domains that look almost like your host, registrar, or plugin vendor
- Unexpected password-reset emails you did not request
- A compromised site used to host phishing kits aimed at someone else’s brand
What to do
- Open admin bookmarks you typed yourself, not links from email.
- Use 2FA and a password manager that will not autofill on lookalike domains.
- Confirm urgent “security” messages through a second channel.
- If you typed a password on a fake page, rotate it everywhere it was reused and review users and plugins.
Full guide: Phishing guide.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Account takeover Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
