What Is Phishing? A Site Owner's Guide to Spotting It

On this page (6 sections)

Phishing means an attacker poses as someone you trust, such as your host, registrar, bank or a coworker, so that you hand over information, send money or take an action that benefits them. Sucuri's site-owner guide to phishing, dated 2026-10-27, is the only coverage of this topic we found, and we add practical checks on top of it.

Anyone who runs a website is exposed twice. Your own accounts are targets, and if one is taken over, your site can be turned into a host for fake pages that go after other people. Business owners, agencies and hosting administrators should all take note.

How a phishing attempt unfolds

Sucuri breaks almost every attempt into four stages: a message shows up, it gives you a reason to act, it asks for one concrete thing, and the damage appears somewhere you were not looking.

The guide illustrates this with a made-up email that seems to come from your hosting company, titled "Final notice: account suspension in 24 hours." It claims an unpaid invoice will take your site down and includes a "Review billing" button. That button opens a copy of the host's login page on a lookalike domain. The victim types a username, a password and the six-digit authenticator code, then lands on the real host's site and suspects nothing. In Sucuri's scenario, the attacker meanwhile replays the password and code immediately to start their own session.

Sucuri's takeaway is that the billing story was a pretext. Its real job was to shorten your thinking time so you would enter a password on a page you had not verified.

Per Sucuri, getting a phishing message does not mean you are compromised, and clicking a link usually does not either. A click can reveal your IP address and browser details, and a page could try to exploit the browser or push a file, but merely opening a credential-harvesting page does not hand over your accounts. The deciding factor is whether you submitted something, downloaded something or approved something.

Types of phishing

Sucuri treats two questions separately: how precisely you are targeted, and which channel carries the message.

Mass versus spear phishing

Mass phishing is sent to enormous lists with generic branding and generic pressure. Spear phishing is tailored to one person and may mention your host, your plugins, your agency or a client whose payment you expect. According to Sucuri, attackers gather material from public sources such as team pages, WHOIS records, LinkedIn, press mentions and even the confirmation message from a contact form. Language tools make tailored, clean writing cheaper, so poor grammar is a weaker warning sign than it used to be.

Delivery channels

Email: the most common route, often with a forged sender name or a lookalike domain. Sucuri adds that weak email authentication on your own domain makes it easier for others to impersonate you.
SMS and chat apps (smishing): the short format lets a shortened link hide the real destination.
Phone calls (vishing): including callers posing as your host's support who ask you to read out a code "to verify your identity."
QR codes: placed on notices, invoices or stickers, which takes the link out of your email client and its link scanning and onto your phone.
Collaboration tools such as Slack or Teams: a message from a hijacked internal account earns far more trust than an email from outside.

Each channel changes what you can inspect, yet the core ask (credentials, a code, a payment or a file) tends to stay the same.

How to recognize phishing

Sucuri recommends judging the request before the look of the message, and says most phishing wants one of four things. The text available to us stops before listing them. Credentials, a code, a payment and a file are the items its examples point to, but that is our inference, not Sucuri's list. The habits below are general good practice rather than claims from the source:

Ask what the message wants. A request to log in, approve, pay or open a file deserves a pause.
Treat deadlines and suspension threats as a cue to slow down.
Skip the link in the message. Go to your host, registrar or bank by typing the address or using a saved bookmark.
Read the domain closely, since lookalikes are near the real one but not identical.
Never read a verification code to a caller, however official they sound.
Do not count on spelling errors to expose a fake.

Related reading: SPF, DKIM and DMARC explains the email authentication that makes your domain harder to spoof.

What phishing means for your website

Sucuri's point is that if an attacker gets into your hosting panel, registrar, WordPress admin, email or payment accounts, your site can quietly serve phishing pages aimed at someone else's customers. The guide also discusses the reputational cost, but the portion we could read gives no specifics, so we cite no figures.

To look for unwanted content on your own site, try the free malware scanner and the guide to checking whether a website is hacked.

What to do now

Sucuri's guide includes a first-hour response plan, but the excerpt we have does not contain it. The checklist below is general good practice, not a summary of Sucuri's steps.

If you typed a password or code into a suspicious page, change that password at once from a trusted device, using the genuine site's address.
End other active sessions and review recent sign-ins on the affected account where the service allows.
Turn on or re-check multi-factor authentication on key accounts, using the strongest method offered.
Review WordPress administrator accounts and remove any you do not recognize.
Look in your hosting panel, registrar and email for unfamiliar forwarding rules, new users or changed DNS records.
If you opened or downloaded a file, scan that device before doing admin work on it.
Report the message to the impersonated organization and, if relevant, to your host.
Scan your site for unexpected pages or files, and follow the website hacked guide if you find any.

Tip. General advice, not from the source: after a suspected account compromise, watch for unexpected changes to certificates, DNS records and response headers. Webforta Monitor alerts on certificate, DNS and header changes for your domains. It does not detect phishing messages themselves.

Ongoing habits

These are general best practices, not claims from the Sucuri article:

Publish SPF, DKIM and DMARC for your domain to make spoofing harder.
Consider a password manager. It usually will not autofill on a domain that differs from the saved one, which can act as a warning, though it is no guarantee.
Limit admin rights on WordPress, hosting and registrar accounts and review them regularly.
Agree a separate channel for confirming payment or access requests with your team and clients.
Teach staff and clients the four stages Sucuri describes: message, reason to act, one specific action, unexpected consequence.

For a wider routine, see the WordPress security checklist. No single tool makes a site fully secure; careful account habits and fast reporting do much of the work against phishing.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

What Is Phishing? Recognizing and Preventing Attacksblog.sucuri.net · 27 October 2026

Frequently asked questions

What is phishing in simple terms?

Phishing is when an attacker pretends to be someone you trust, like your host, registrar, bank or a colleague, to get you to share information, send a payment or do something that helps them.

Does clicking a phishing link mean I have been hacked?

Usually not, according to Sucuri. A click can expose your IP address and browser details and may lead to a page that attempts a browser exploit or a file download, but the visit alone does not give access to your accounts. What counts is whether you submitted, downloaded or approved something.

Can a phishing page capture a two-factor code?

In Sucuri's hypothetical, the fake login page collected both the password and the six-digit authenticator code, and the attacker used them immediately. Sucuri does not turn this into a general rule, but it is a good reason to verify the address before entering any code and to refuse to read a code to a caller.

How can phishing affect my website?

Sucuri says that if an attacker breaks into your hosting, registrar, WordPress admin, email or payment accounts, your site can end up serving phishing pages aimed at other people's customers, which can damage its reputation.

Are spelling mistakes still a reliable sign of phishing?

No. Sucuri notes that language tools make personalized messages cheaper and cleaner, so bad grammar is no longer a dependable tell. Judge the request and the sender's domain instead.

Keep reading