Website Hosting Scam Email? How to Tell It's Fake (October 2026)

Assume a website hosting email is a scam if it pushes you to click, pay, log in or install something within hours, and you can't find the same notice inside your hosting account. Real hosts post notices where you can check them. Scammers need you to act before you do.

Expect more of these over the next few weeks. On 21 October, the accounting and advisory firm UHY told organisations to watch for "phishing messages or suspicious downloads claiming to provide an 'urgent PHP update'" in its PHP2Shell briefing. As of 24 October I haven't found a public report of a PHP2Shell-themed scam campaign. But earlier security scares went exactly this way:

• December 2023: Wordfence warned about emails dressed up as the WordPress team, claiming a site had a serious flaw and urging owners to install a "Patch" plugin from a lookalike website. The plugin quietly added an administrator account for the attackers.
• Last year: a "scanner" for the React2Shell bug, published on GitHub as a free checker, turned out to carry malware.

Same pattern both times: real, scary news, then a fake fix. With PHP2Shell, the fake fix could be a plugin, a file to upload, a "checker" forwarded on WhatsApp, or an invoice for an emergency patch.

The website scams going round in 2026 fall into five types: fake host warnings, fake domain renewals, fake security patches, cold "your site is vulnerable" pitches, and fake invoices. Here's what each one looks like:

These aren't made up for the table. Security sites keep catalogues of fake cPanel emails like the "password expiration notice" that threatens a lockout within 48 hours. In June 2026, Malwarebytes described fake renewal emails sent from "an ordinary Gmail address", leading to a "Secure Checkout" page with countdown timers that asked for card details and renewed nothing. And in May 2026 the Singapore Police Force said that "since 1 January 2026, at least 66 cases were reported, with total losses amounting to at least $19 million" from emails asking businesses to pay a vendor's "new" bank account.

The red flags in a website hosting scam email are a sender that doesn't match your host, a deadline measured in hours, a link that asks you to log in or pay, and any request to install, upload or download something. One flag is a reason to slow down. Two is a reason to stop. Check for:

• The sender. A Gmail, Outlook or oddly spelled address, or a host you don't actually use.
• A countdown. "24 hours", "today", "final notice". Real renewals and suspensions come with weeks of reminders.
• A login button. Press and hold it on your phone, or hover on a computer, and read where it really goes. A lookalike address is the giveaway.
• Something to install. A plugin, a .zip, a file to upload to your site, a "scanner" to run. Hosts patch PHP on their own servers.
• A new way to pay. A card form on a site you've never used, or a bank account that's changed.
• Wrong or missing details. No account number, no plan name, your domain spelled oddly, or a price that doesn't match your last invoice.
• Attachments you weren't expecting, especially .zip, .html or .exe files.
• Requests for passwords or one-time codes. No real host needs your OTP.

Most of this matches the six signs on CSA's spot the signs of phishing page, which also flags "unexpected emails" such as invoices you never asked for.

A real notice from your host names your account, appears in your hosting dashboard or on the host's status page as well as in your inbox, and sends you to the host's own website, never to a stranger's checkout. This week's PHP notices are good examples:

• SiteGround posted on its own blog that it had patched every server and told customers: "There's nothing you need to do."
• Vodien updated its public status page as shared hosting patching finished.
• Bluehost said on its status page that it was emailing the customers who needed to act.

Notice what none of them asked for. No payment, no plugin, no file. On shared hosting the fix lives on the host's servers, so the most a real host will ask is that you pick a newer PHP version in your control panel.

Check an email with your host by going around it: find the host's real address from your own records, type it into the browser yourself, log in, and look for the same notice there. Step by step:

1. Don't click, reply or call any number in the email. Leave it open so you can compare.
2. Find out who your host really is. Search your inbox or bank statement for the last hosting or domain renewal. That company is your host, whatever the email says.
3. Type the host's address yourself, or use a bookmark, and log in. Look at notifications, billing and any messages.
4. Check the host's status page or blog for the same announcement.
5. For a domain renewal, check the real expiry date in your registrar account. Malwarebytes gives the same advice for its fake renewals.
6. Still unsure? Contact the host through the chat or phone number on its own website and read them the email.

Can't log in because the person who built the site has the password? That's worth fixing now, scam or no scam. Ask the host to move the account into your company's name.

Yes. A genuine PHP update email from your actual host is good news, and you should act on it. PHP2Shell is real, and hosts that write to customers about it are doing their job. Once you've confirmed the notice in your account, do what it says, usually moving to a newer PHP version or confirming nothing's needed. Then check the result: my guide on how to check your PHP version shows you where to read the full number and what counts as patched.

The worst outcome this week would be an owner who's been burned by a scam, starts ignoring every security email, and misses the real one. So check, then act.

Treat an unsolicited "your website is vulnerable" email or call as a sales pitch at best and a scam at worst, and never give a stranger your logins, a one-time code or remote access to your computer. Some are real companies selling a service, often with a scary automated report. Some are fishing for access. Either way, the person who contacted you decides nothing about your site.

• Don't run their scan or tool. If you want an outside look, free scanners from known security companies exist, and my roundup of free website security check tools explains what they can and can't tell you.
• Look them up. A Singapore business has a UEN you can check on ACRA's Bizfile. No company name, no address and no UEN is a bad sign.
• Ask what they found, without giving access. A real finding can be described from the outside: a PHP version in a header, an old plugin, a missing certificate.
• Then ask your own host or developer. Not the caller.

If you paid, call your bank straight away, then the ScamShield Helpline on 1799 and file a police report; if you typed a password, change it from a different device and turn on two-factor login; if you installed something, treat the website as hacked. In order of urgency:

1. Paid by card or bank transfer? Call your bank now and ask them to block the card or recall the transfer. Speed matters more than anything else on this list.
2. Call 1799. The ScamShield Helpline runs 24/7 and can connect you directly to DBS/POSB, UOB, OCBC, Citibank, Maybank, Standard Chartered and HSBC. It can't take a police report, so do that separately on the police e-services website. For anything urgent, call 999.
3. Typed your hosting, email or WordPress password? Change it from a different device, then change it anywhere else you used it. Turn on two-factor login. Check for email forwarding rules you didn't set up.
4. Installed a plugin, uploaded a file or gave someone access? Assume they're in. Remove admin users you don't recognise and follow my first 24 hours after a hack plan.
5. Report it. Forward phishing emails to SingCERT at singcert@csa.gov.sg, tell the company being impersonated, and use the ScamShield app to report scam messages or check a suspicious link or number.

Don't be embarrassed about calling. These emails are built to fool busy people, and they catch careful ones too.

Pay a domain renewal only when it comes from the registrar that holds your domain and the same amount shows in your account there; a "domain listing" or "SEO renewal" notice from anyone else is not a renewal. In March 2026 the US host Tiger Technologies warned that letters titled "Annual Website Domain Listing", designed to look like a bill, were still arriving. Its advice holds anywhere: "You never need to pay for basic search engine listings." Put your real domain on auto-renew with a card that won't expire, and fake renewals lose their sting.

Opening a scam email is rarely the problem; the damage comes from clicking its links, opening its attachments, typing a password or installing what it sends. CSA's advice is to delete unexpected emails without clicking links or opening attachments. If you've only read it, delete it and move on.

Your own host or the developer who looks after your site should be your first call, and if you don't have one, I'll check it for you. Send me the email (forward it, or a screenshot) and your web address, and I'll tell you whether it looks genuine and what your site actually runs. If the PHP update turns out to be needed and nobody is looking after the site, I can do the fix as part of my website maintenance service, at a fixed price in writing from SGD 850 before I start.