I got a scary email or notice about my site

What you are seeing

Website owners get a steady stream of alarming messages. Some are real and have deadlines. Many are scams that copy the look of real notices. The rule for all of them is the same: never act from inside the message. Confirm it by going to the service yourself.

What arrived	What it usually is
Your host says the account is suspended for malware, phishing or spam	Often real. Confirm by logging in to the hosting panel directly. See hosting account suspended.
A stranger reports a "vulnerability" such as a missing DMARC record or clickjacking header and asks about a bounty	A beg bounty: an automated scan sent in bulk, hoping for payment. Rarely urgent.
A copyright or DMCA claim with a link or attachment to "see the evidence"	Often a malware lure. Real takedown notices usually reach you through your host and name the exact URL and work.
An invoice or "final notice" to renew your domain or a "search engine listing" from a company that is not your registrar	A renewal or listing scam. Paying may transfer your domain to them or buy nothing.
"Your domain or SEO will be suspended" or "we found errors on your site, reply for an audit"	Sales spam dressed up as a warning.
A login alert or "verify your account" message from your host, registrar or email provider	Either real or a phishing copy. Check the sending domain and never sign in through the link.
Search Console: a new owner was added, or Security issues or Manual actions were found	Real if you see it inside Search Console. An unknown new owner is a sign of compromise.
A legal letter or email about website accessibility	Can be real and have deadlines. See accessibility complaint or demand letter.
A plugin vendor or security service says a plugin you use has a vulnerability	Usually real and public. See plugin vulnerability alert.

Nothing on this page is legal advice. If a message claims legal consequences and it checks out as genuine, talk to a lawyer where you are.

Confirm it in two minutes

1. Check who your real registrar is and when the domain expires.

whois example.com | grep -iE 'registrar:|expir'

Run it in your own computer’s terminal, replacing example.com with your domain (or use the domain lookup tool). Good: the renewal notice comes from the registrar named here and the date matches. Bad: a letter from a company that is not listed here, or a "final notice" months before the real expiry.

2. Read the message headers. In Gmail, open the message, then the three-dot menu, Show original. In Outlook, open the message, then File, Properties, or View message details. Find the Authentication-Results line. Good: spf=pass, dkim=pass and dmarc=pass for the provider’s real domain. Bad: a fail, or a pass for a different look-alike domain (an extra word, a swapped letter, or the brand name inside a free email address). A pass only proves who sent it, not that the content is honest.

3. Check every link before you click. Hover the mouse over a link (on a phone, press and hold) and read the real address. Good: the provider’s own domain. Bad: a shortener, a file-sharing site, or a domain that only looks similar. When in doubt, type the provider’s address into the browser yourself.

4. Compare a vulnerability report with what you actually run.

wp core version
wp plugin list --fields=name,status,version,update_version

Run these in an SSH terminal inside the site’s folder (the one with wp-config.php). update_version shows the newer version waiting to be installed. Good: the report names something you do not use, or a version you already updated past. Bad: it names a plugin and version you run that has a published fix. Update that first, whoever sent the report.

5. See whether you publish a security contact.

curl -s https://example.com/.well-known/security.txt

Run it on your own computer. A security.txt file tells researchers where to report problems and whether you offer rewards. Nothing found is normal for small sites. The hardening cheat sheet shows how to add one.

Most likely causes, in order

1. A bulk scam with no real problem behind it. Tell: generic greeting, urgency, payment request, and a sender that is not one of your providers. Fix: do not reply or click; delete it or report it as phishing in your mail app.
2. A beg bounty. Tell: a low-impact finding (missing headers, SPF or DMARC advice, a version number shown) and a question about rewards. Fix: check the claim against check 4, fix anything real on your own schedule, and reply once with the vulnerability report replies template, or not at all.
3. A genuine host or service notice. Tell: the same notice is shown inside the panel or dashboard when you log in directly. Fix: follow it, keep the reference number, and reply through the provider’s ticket system.
4. A renewal or listing scam. Tell: check 1 names a different registrar. Fix: ignore it. Renew only inside your real registrar account, and turn on auto-renew there.
5. Phishing for your hosting, registrar or email login. Tell: a sign-in link that lands on a look-alike page. Fix: if anyone entered a password there, change it now from the real site, turn on two-factor, and check for forwarding rules and new users.
6. A real legal or accessibility claim. Tell: it names your business and specific pages, comes from an identifiable law firm or authority, and gives a deadline. Fix: preserve it, do not ignore the deadline, and get advice from a lawyer licensed where you operate.

What it usually is not

• Something to reply to just to say no. Replying to bulk scams confirms your address is read.
• Safe because it uses your name, logo or domain. Scammers copy all of these from your website and public records.
• Fake because it is scary. Host suspensions, Search Console alerts and some legal letters are real. Confirm, do not dismiss.
• A hack, just because someone emailed about one. Check the site itself before you panic.

What to send your host or the relevant provider

• To the provider the message claims to be from: the message forwarded as an attachment (or with full headers), and the question "Did you send this?"
• For a suspension: the notice ID, the files or URLs they named, and what you have cleaned.
• For a copyright claim through your host: the URL named and whether you own or licensed the content. Do not open attachments from unknown senders.
• To your registrar: any renewal letter from another company, so they can confirm and, if they choose, report it.
• To a lawyer, for genuine legal letters: the full letter, the dates, and the pages it names.

Which guides to read

• Scary emails about your website: beg bounties, fake DMCA notices, renewal scams and fake suspension notices.
• Hosting account suspended and WordPress site hacked: the first hour.
• A plugin on your site has a vulnerability.
• Accessibility complaint or demand letter and does the European Accessibility Act apply.
• Someone is spoofing your domain, if the message seems to come from your own address.
• Email account hacked, if someone entered a password on a phishing page.
• Reference: the security headers and hardening cheat sheet (includes security.txt) and the domain lifecycle cheat sheet.