Recognising Phishing and Fake WordPress Emails

Phishing emails try to trick you into handing over your login details by pretending to be a legitimate WordPress or hosting notification.

Common warning signs

• A sense of urgency – “Your account will be suspended”, “Immediate action required”.
• A login link that doesn’t match your site’s actual address when you hover over it.
• Requests to “verify” your password by typing it into a form linked from the email.
• Poor spelling, generic greetings (“Dear User”), or unusual formatting.
• An email address that looks close to, but not exactly, a legitimate sender.

What to do

1. Don’t click links in a suspicious email.
2. Instead, go directly to your site by typing the address into your browser, or using a bookmark you already trust.
3. If you’re unsure, ask your site administrator before acting on the email.
4. Report or delete the email once you’ve confirmed it’s not genuine.

Careful: Legitimate password reset emails will never ask you to type your existing password into a form – if an email asks for that, treat it as suspicious.