Anyone with a website sooner or later gets an email that looks official but isn't. A domain that is 'about to expire', a site that was 'hacked', an invoice from a company you never worked with. That is phishing: a fake message meant to make you click in a hurry.
Why website owners get them
Domain names and company details are listed in public registers. Scammers use those lists to send targeted emails about renewals, security or search ranking. A small business owner, a holiday-home host or a maker rarely has an IT department looking over their shoulder, which makes the email convincing.
Five signs an email is not right
- The sender address is off. The name is not enough; check the address behind it. An email 'from the bank' sent from a free mail address is fake.
- There is a rush. 'Within 24 hours', 'final warning', 'account will be blocked'. Real companies rarely apply that pressure.
- The link goes somewhere else. Hover over the link (without clicking) to see the real address. If it doesn't match the sender, don't open it.
- It asks for login details or a payment. Passwords and PINs should never be sent by email or chat.
- An unexpected attachment. Invoices as .zip, .html or .exe files are almost always malicious.
What to do when in doubt
Don't click and don't reply. Contact the sender through a channel you already know, such as the phone number on your own invoice, not through the email itself. If a client of mine gets a message like this, it can always be forwarded to lets@manonit.com. I'll take a look and tell you honestly whether it's genuine.
What I do to keep websites safe
- Secure connection (SSL) on every site, so visitors and forms connect encrypted.
- Security updates are part of the subscription, because outdated software is the biggest risk.
- Daily backups. If something goes wrong, a working version is back quickly.
- Monitoring with maintenance plans, so a problem is noticed right away.
- Domain in the client's name. No one else can renew, transfer or let it expire without the client knowing.
- Cookie and privacy statement under the GDPR on every site.
Forms and contact through the website
A contact form can also be a weak spot: fake messages, spam and visitors who enter personal details on an unsafe page. This is how I build forms and contact:
- Hidden spam field (honeypot): automated messages are stopped without visitors having to solve a puzzle.
- Secure connection: form data is sent encrypted (HTTPS) to a secure form service.
- Only what is needed: name, email address and message. A form never asks for a password, PIN or payment details.
- Limited retention: data is not kept longer than necessary (at ManonIT a maximum of one year), as stated in the privacy policy.
- Server settings: security headers prevent the website from being loaded inside a fake site and limit which scripts may run.
- Contact by WhatsApp or email: replies always come from lets@manonit.com or via WhatsApp.
An example from practice
With Villa Vredestein and The Big Three the domain is in the owner's name, the site runs over a secure connection, backups are made daily and a handover document comes with it. That sounds dull, and that is the point: security should be arranged so well that nobody has to think about it.
How to recognise an email from ManonIT
Messages come from lets@manonit.com or via WhatsApp. I never ask for a password by email and never for a payment outside a regular invoice. In doubt? A quick WhatsApp message is enough.
Honest about the limits
No website is one hundred percent safe, and no mail filter catches everything. Good habits, current software and backups keep the risk small and the damage limited. Want to read more about what is included? See the FAQ or maintenance.