As stated in the title, what can I do on the server (or anywhere else for that matter) to protect against phishing attacks?

Some suggestions I've heard is to tell users that you'll never send them a link to click on. However, our password reset functionality is built around this.

We've also added two factor authentication, but a phishing attack can also easily bypass this through clever scripting that passes the user credentials to our site in real time.

  • What server are you talking about?
    – schroeder
    Commented Feb 5, 2020 at 20:48
  • "you'll never send them a link to click on" - i've never heard that advice, actually
    – schroeder
    Commented Feb 5, 2020 at 20:52

2 Answers 2


Phishing is a social engineering trick, so the effective way to mitigate it - is to educate your users. Create a mandatory training courses, buy or create a plugin to outlook or whatever mail clients they are using that can flag emails as phishing attacks and send to you or your team for forensics, contract a third party to sometimes perform a non malicious phishing attack (when you click on attachment it will say "this was a part of our comprehensive phishing awareness programs..." to keep your users aware.

  • I like the idea of "fake phishing" to train users not to click on links
    – Kritz
    Commented Feb 5, 2020 at 18:54
  • There are lot of companies offering the said services at a modest price. Our company uses product of Cofense for instance. Commented Feb 5, 2020 at 19:04

Phishing is a multi-faceted problem requiring many layers or response and what layers you choose will depend on your organisation.

Technical side:

  • anti-phishing domain defences on ingress email servers to block phishing attempts
  • language analysis of email content to identify likely phishing (spam filters)
  • 2FA
  • password managers that can recognise whitelisted domains before people enter credentials
  • banners on emails sent from external domains
  • anomaly detection of logins (time, location, patterns)
  • convert all HTML emails to plain text
  • convert all links sent from external sources to something benign

Human side:

  • user education and processes
  • a way for people to practice recognising and responding to phishing (simulations)
  • a way for people to report phishing emails

Organisational side:

  • move away from email as a primary means of internal comms

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .