Phishing guide: spot fake emails before they cost you

Phishing is still one of the easiest ways attackers get into WordPress sites and business accounts. They do not need a zero-day. They need someone to click a link, open an attachment, or type a password into a fake page.

Brute force still happens. Credential stuffing still happens. Phishing often wins first because it targets people, not only servers.

What phishing is

Phishing is a social engineering attack. Someone pretends to be a bank, a host, a plugin vendor, a coworker, or your own boss. The goal is sensitive data: passwords, MFA codes, payment details, or access to your site.

Attacks show up as email most often. SMS and phone calls (smishing and vishing) are common too. For WordPress teams, the payoff is usually a login, hosting panel, or email account that can reset everything else.

If you want the short definition, see phishing in our security dictionary.

How to spot phishing emails

Train people to pause before they click. A few seconds of checking beats hours of cleanup.

Check the sender and the real URL

Do not trust the display name alone. Look at the full email address. Hover links (or long-press on mobile) and read the actual destination before you click.

Fake domains often look close enough:

• paypal-secure.net instead of paypal.com
• wordpress-support.io instead of something you actually use
• odd subdomains stuffed with brand names

If the link text says one thing and the hover URL says another, stop.

Watch for urgency and fear

Phishing copy leans on pressure: “Account suspended,” “Unauthorized payment,” “Confirm within 1 hour,” “CEO needs this now.” Real vendors rarely demand passwords or MFA codes by email.

Spelling, tone, and weird requests

Typos and odd capitalization are still useful clues. So is a request that breaks your normal process: wiring money, sharing admin credentials, or disabling security settings “just this once.”

Wrong inbox, unexpected attachment

If PayPal mail lands in a work address you never registered with PayPal, treat it as hostile. Unexpected attachments (especially .html, .docm, .zip, or double extensions) should not be opened on a work machine.

Links that ask you to “log in here”

Many serious brands tell you to open the official site yourself rather than click through email. Any message that pushes you to a login form you did not navigate to yourself deserves suspicion.

Habits that cut phishing risk

Default to verify out of band

If an email claims to come from a manager, host, or bank and asks for access or money, confirm by phone, chat, or in person using a known number. Do not reply in the same thread.

Use unique passwords and a manager

Phishing often captures one password. If that password is reused, the blast radius grows. Use a password manager and unique credentials for WordPress, hosting, and email.

Turn on two-factor authentication

Two-factor authentication will not stop every phishing attack (especially real-time proxy kits), but it still blocks a large share of simple credential theft. Prefer app-based or hardware MFA over SMS when you can.

Protect WordPress logins on the site side

Phishing is human. Site defenses still matter after someone is tricked:

• Limit failed logins and watch for brute force noise
• Use strong admin hygiene and the least privilege role that works
• Keep plugins and themes updated so stolen sessions are not the only problem

See also password management tips and what to do if your website is hacked.

Teach the team once, then refresh

A short internal rule helps more than a long policy PDF:

1. Never share passwords or MFA codes by email.
2. Never click “reset” or “verify” links under panic.
3. Report suspicious messages instead of quietly deleting them.

If someone already clicked

Act fast:

1. Change the password for the affected account from a clean device.
2. Revoke sessions / app passwords where the service allows it.
3. Check WordPress users for unexpected admins.
4. Review hosting, DNS, and email forwarding rules.
5. Restore from a known-good backup if the site was changed.

Phishing is not rare or clever. It is repeated, cheap, and effective. Treat every urgent login request as guilty until proven otherwise, and your WordPress stack gets a lot harder to steal through the inbox.