In recent months, there has been a surge in fraudulent emails targeting website owners, especially those using WordPress. These messages seek to create urgency and confusion so that the user clicks where they shouldn’t.
Just today, at Liberty Dreams, we have received a phishing email impersonating a supposed “Communication from the WordPress team”.
If you have also received a similar email, you have come to the right place: in this article we explain why it is a scam, how to identify it, and what measures to take to protect your website and your data.
The Fraudulent Email: What Does It Say Exactly?
The message received has the following content (with sensitive data partially hidden):
WordPress Email Address Confirmation
Please verify that your website qui****com is associated with the correct email address.
Currently registered: ayuda@quier****com
Note: This email address may differ from your main email.
Verify Now
Wg2955462549672635615048
Communication from the WordPress team
At first glance, the email may seem legitimate, especially if you manage a website or an online shop. But that is precisely where the danger lies.
Let’s Analyse It Point by Point.
1. There Is No “WordPress Team” That Carries Out This Type of Verification
WordPress isn’t a hosting company nor an email provider. It’s an open-source CMS that anyone can install on any server, like the ones we offer at Liberty Dreams.
WordPress doesn’t send emails to verify domains, associated email addresses, or internal configurations of your website.
Any official communication related to your site depends exclusively on:
- Your hosting provider
- Your domain provider
- Or specific services you have contracted
If someone claims otherwise, be suspicious.
2. The Sender Has No Relation to WordPress
When reviewing the technical details of the email, the sender appears as a person named “Mohammed”, using a private name which, for legal reasons, we do not reveal in full, but which has a format similar to:
vo***turkey.com
This domain:
- Don’t belong to WordPress
- Don’t belong to Automattic
- Don’t belong to any recognised hosting provider
So the question is clear:
Why should you confirm anything to someone who has no relation to your website?
3. Use of Urgency and Generic Calls to Action
“Verify now”, without further context, without clear technical data and without explaining what happens if you don’t verify, is a classic phishing technique.
The goal is for you to:
- Click without thinking
- Enter credentials
- Or confirm sensitive information
How Did They Get My Data?
This is one of the most frequent questions, and the answer does not always imply that your website has been “hacked”.
The most common sources are:
- Extensive web scraping (perhaps your email appears on your website)
- Data leaks or data sold legally (from someone who already had your email, like a client, supplier… or simply a third party who obtained it from your website)
- Public WHOIS data for the domain
- Contact forms visible on the website
- Social networks or business directories
That is, having your data does not mean they have access to your website, but it does mean they can try to deceive you.
What Risks Do You Run If You Click or Confirm Information?
Depending on the type of link, the consequences can be serious:
- Theft of WordPress credentials
- Unauthorised access to the admin panel
- Injection of malware into your website
- Use of your domain to send spam
- Loss of SEO ranking
- Blocking of the site by Google or browsers
- Download of viruses onto your computer
- Or simply that they see the email is “active” to resell it or flood you with spam.
For digital businesses, this translates into loss of trust, clients, and money.
What Can You Do If You Receive Such an Email?
1. Don’t click on any links
Even if it seems harmless, ignore it completely.
2. Block the sender
Mark the email as spam to help your provider’s filters.
3. Verify your website only from official sources
If you have doubts about your hosting, your email, or your WordPress:
- Access your provider’s panel directly
- Or consult with your trusted technical team
Never from external links.
Data Protection and Legislation: A Point in Your Favour
Both here in the United Kingdom and in the European Union, there are strict data protection laws (UK GDPR and GDPR).
This means that:
- Legitimate companies must clearly identify themselves
- They cannot request sensitive data ambiguously
- They must offer official contact channels
- Your data cannot be used without your legal consent (doing so would constitute a crime).
These fraudulent emails breach multiple regulations, which reinforces that this is a scam.
The Importance of Secure Hosting and Real Support
Many of these problems are aggravated when a website:
- Is poorly configured
- Lacks maintenance
- Or does not have specialised technical support
At Liberty Dreams, our hosting services are designed precisely to avoid these situations:
- Secure and monitored servers
- Real human support, not suspicious automatic emails
- Advice when you receive dubious communications
- Active protection against common threats
If you wish to know more, you can discover our services and how we can help you protect your online project.
Block the sender, but also:
• Share this article on social media
• Send it to clients, friends, or suppliers
• Help raise awareness about this type of scam
Prevention starts with information.
Conclusion
If you receive an email asking you to verify your website or your email on behalf of WordPress, don’t trust it.
WordPress doesn’t work like that, and attackers are increasingly refining their messages thanks to the use of AI.
The key lies in:
- Informing yourself
- Not acting on impulse
- And having a technology provider that supports you
At Liberty Dreams we believe that a safe website begins with informed decisions.
If you have any doubts, we are here to help you.
