WordPress Phishing Emails: How to Spot Them and What to Do

Most WordPress phishing emails fail. A handful work, and those are the ones that lead to a hacked site. They do not need to be clever, because they land in the inbox of someone busy, at a moment when "your domain is about to expire" sounds plausible.

This guide covers the four fakes WordPress owners see most, how to spot any of them in about ten seconds, what to do if you already clicked or installed something, and how to get a team to stop doing it by accident.

What WordPress Phishing Emails Want From You

Phishing is an email that pretends to be someone you trust to get you to do something. For a WordPress site, the prize is usually one of three things:

• Your login. A fake page collects your password. Now the attacker is an administrator.
• Your payment. A fake invoice or renewal gets you to pay the wrong person.
• Your hands. The email gets you to install something yourself, which is the most direct route in. No password theft needed.

That last one is the nastiest because it skips the lock. You hand over the key and say thank you.

Four Common WordPress Phishing Emails

1. "Your Domain or Hosting Is Expiring"

An email says your domain is about to lapse, or your hosting will be suspended in 24 hours. It links to a "renewal" page that looks like your registrar's, collects your login or card, and either steals the account or charges you for nothing.

The tell is the pressure and the generic wording. Real registrars send the domain name and the account email, and they rarely threaten to switch your site off tonight. Go to your registrar by typing its address yourself, and check the expiry date in your account.

2. A Fake WordPress or Plugin Security Alert

This is the one that does the most damage. The email claims to come from WordPress, a "WordPress Security Team" or a plugin company. It says a serious flaw affects your site, and it urges you to download and install a "patch" plugin.

WordPress.org has published an official alert about exactly this. In it, the WordPress Security Team says phishing emails impersonate the team to persuade administrators to install a malicious plugin, with links to a fake plugin repository on a domain WordPress does not control. The team says it will never email you asking you to install a plugin or theme, will never ask for an administrator username and password, and only communicates through its security blog and the WordPress news site.

That is a clear, memorable rule: a real WordPress email never tells you to install something.

Publicly reported versions of this scam have used a fake patch plugin that created a hidden administrator account and then planted a backdoor. What a backdoor is and how to find one is in our guide to the WordPress backdoor.

3. A Fake Admin Password Reset or Login Alert

You get an email saying someone tried to sign in to your site, or that your password was reset, with a button to "secure your account". The button leads to a page that looks like your WordPress sign-in screen.

The giveaway is often the address. Your real sign-in page is on your own domain. A page on a look-alike domain, a link shortener, or a web address with extra words in it is not yours. If you are worried, do not click: open your site's sign-in page by typing the address and check from there.

4. A Fake DMCA or Copyright Notice

The email says you have copied an image or article, and gives you 48 hours to respond. A link goes to the "evidence": really, a download of malware, or a page asking you to sign in. This works because a legal threat makes people click first and think later.

Real copyright notices usually name the exact page and the work in question, and come from an identifiable person or company. If it does not, or it only offers a file to open, do not open it. Reply to nothing. Look at your own site and find out whether the claim makes sense.

How to Spot WordPress Phishing Emails in Ten Seconds

You do not need security training. You need a short list you actually run through.

WordPress.org's own alert gives useful pointers for the official side: genuine emails come from a @wordpress.org or @wordpress.net address, and the official plugin repository is at wordpress.org/plugins, sometimes with a regional prefix. It also suggests finding plugins through the Plugins menu in your dashboard rather than following email links, which is good advice for any plugin, from any email.

Pro tip: If an email says there is a problem with your site, close it and go to the site yourself. Check the Updates screen, your host's dashboard and the real WordPress.org news. A real problem will be there when you look.

What to Do If You Clicked or Installed Something

Different actions need different responses. Work out which one applies to you.

You Clicked a Link but Entered Nothing

Close the page. Run a quick scan on your computer, and keep an eye out for strange behaviour. Nothing has been given away, so the risk is low, but tell whoever else uses the account.

You Typed in a Password

Treat that password as public. Change it now, from a trusted device, and change it anywhere else you used it. Turn on two-factor sign-in. Then check:

1. Users. Look for administrators you do not recognise.
2. Recent sign-ins. Check the activity log for sign-ins from places you do not recognise.
3. Your email account. If it was your email password, check for forwarding rules and recent sign-ins there too, since email access unlocks every password reset.

You Installed a Plugin or Opened an Attachment

Assume the site is compromised, and act in this order.

1. Back up the site as it is. You want evidence and a way back.
2. Deactivate and delete the plugin. Do not just leave it switched off.
3. Check Users for new administrators and remove the ones you did not create.
4. Scan the site. Look for added files and unknown plugins. See how to scan WordPress for malware.
5. Change every password for WordPress administrators, hosting, SFTP and the database, and rotate the security keys to end existing sessions.
6. Look for backdoors. Removing the plugin does not remove what it dropped. Check uploads, must-use plugins, wp-config.php and scheduled tasks, as described in the guide to WordPress backdoors.

The full process is in our guide to recovering a hacked WordPress site. If you want to know whether the site is already showing symptoms, the signs your WordPress site has been hacked will help you decide.

How Stack Guard Helps Against WordPress Phishing

No plugin can stop a convincing email from arriving, and you should be wary of any that says it can. What a plugin can do is make a successful phish harder to use, and make the damage visible quickly.

• Two-factor sign-in (Free). With two-factor authentication, a stolen password alone is not enough to sign in. Stack Guard supports authenticator app codes and email codes, gives every user backup codes, and can require it for administrators. A fake sign-in page can in theory relay a code in real time, so it lowers the risk and does not remove it. It does nothing against a plugin you install yourself.
• Activity log (Free for core events). The activity log records sign-ins, failed attempts, lockouts, user and role changes and password resets, with who did it and from which address. That tells you whether a new administrator appeared after the email arrived. Free keeps core events for 7 days. Pro keeps them longer and also logs plugin and theme changes, which is the record you want after "I installed a patch plugin".
• Alerts (Pro). Email alerts can tell you about a new administrator, a role change or a sign-in from a new device while there is still time to act. Free includes the lockout alert only, and the rest of the catalogue is part of Pro.
• Malware scanning. A scan can flag added files and known back door and web shell signatures. Manual scans are in Free.
• Breached-password check. Password rules can refuse passwords that already appear in known breaches, so a reused password is less likely to work.

Training Your Team to Spot WordPress Phishing Emails

If more than one person has access to your site, they are part of your security. A short, specific rule beats a long policy.

• One rule: Nobody installs a plugin or signs in from a link in an email. Plugins come from the Plugins screen. Sign-ins start by typing the address.
• One person to ask: Name someone who checks anything unusual. People are far more likely to forward an email than to guess.
• Use real examples. Show your team a real phishing email next to a real notice. Two minutes of that teaches more than a slide deck.
• Give people their own accounts. Shared logins make it impossible to tell who was phished. Give everyone the lowest role that lets them do their job (our guide to WordPress user roles helps).
• Remove old access. Former freelancers and old agency logins are the accounts nobody watches.
• Make reporting safe. Someone who clicked and tells you straight away saves you days. If they get shouted at, you will hear about it from the attacker instead.

If you look after sites for clients, a short note to them explaining the same rule is worth sending, and it is a good fit for the agency security checklist.

A few minutes of preparation also pays off when something does slip through. Keep a short incident note somewhere your team can find it: who to call, where the latest backup is, and which passwords to change first. When the moment comes, nobody should be searching for that list while the clock runs.

Phishing works because it borrows trust. The best defence is a habit of going to the source yourself, which costs thirty seconds and has no downside.