Attacks Dictionary
Phishing
Definition
Phishing tricks people into handing over credentials or installing malware by impersonating a trusted party.
Also called: phishing attack
Why it matters for WordPress
Attackers email “your site is hacked, log in here” or “WordPress needs urgent verification.” The fake page captures the password. 2FA helps a lot, but rush and fear still win when people click before they think.
How it shows up in practice
- Emails that rush you to click a login link
- Domains that look almost like your host, registrar, or plugin vendor
- Unexpected password-reset emails you did not request
- A compromised site used to host phishing kits aimed at someone else’s brand
What to do
- Open admin bookmarks you typed yourself, not links from email.
- Use 2FA and a password manager that will not autofill on lookalike domains.
- Confirm urgent “security” messages through a second channel.
- If you typed a password on a fake page, rotate it everywhere it was reused and review users and plugins.
Full guide: Phishing guide.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Credential stuffing Credential stuffing replays usernames and passwords stolen from other breaches against your login.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Malware Malware on WordPress is unwanted code that steals data, spam-sends, redirects visitors, or keeps a backdoor open.
- Account takeover Account takeover is when an attacker gains control of a legitimate user account and can act as that user.
