Someone is sending your clients phishing emails with your logo on them.

The email looks right. It uses your colors, your signature block and the way you write. It asks a client to “confirm their Microsoft 365 login” after a routine update. And it may have taken an attacker less time to write than this paragraph took to read.

October is Cybersecurity Awareness Month, and most MSPs spend it reminding clients to stay alert. This post is about the other side: your own website and your own domain, and why website security matters more for an MSP than for almost anyone else.

What AI changed for attackers

Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches now start with an exploited software vulnerability, overtaking stolen passwords, and that attackers are using generative AI to sharpen their methods. Your website is software too.

For an MSP, the shift shows up in three ways:

• Phishing that sounds like you. AI tools can read your website, your LinkedIn posts and your newsletters, then write an email in your voice with no spelling mistakes. The old “bad grammar” warning sign is gone.
• Scanning at scale. Automated bots probe websites around the clock for outdated plugins, exposed login pages and known vulnerabilities. Your site doesn’t need to be a target. It only needs to be on the list.
• Brand impersonation. Lookalike domains, one letter off from yours, are quick to register and quick to dress up with a copy of your site.

None of this needs a skilled attacker anymore. That’s the shift.

What a prospect sees before they call you

Before a buyer books a discovery call with an MSP, someone on their side checks you out. For some, that means pasting your domain into a free security scanner.

An expired certificate, a missing DMARC record or a blacklist warning tells them more than your services page does. You sell security, so they judge you by your own. They won’t tell you why they went with someone else. Your pipeline just gets quieter.

That’s the part of website security that never makes the risk register: it’s a sales problem long before it’s a breach.

Your clients’ trust is the target

Your clients trust links and emails that come from you. That trust is the whole point of a managed service relationship, and it’s exactly what an attacker wants to borrow.

If your website or domain is compromised, the damage doesn’t stop at your brand. Your site can host a fake login page. Your domain can be spoofed to send invoices. And the people most likely to fall for it are the clients who trust you most.

How did they hack my website? The usual ways in

It is rarely clever. Plugins are the biggest open door: Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, and 91% of them were in plugins.

Most MSP website compromises start with one of these:

1. Outdated plugins or themes. Abandoned plugins stop getting security fixes.
2. Weak or shared admin logins. A password reused from somewhere else, with no multi-factor authentication.
3. Forgotten accounts. The login for the agency that built the site three years ago, or the employee who left last spring.
4. Unprotected forms. Contact and upload forms that accept anything, including scripts.
5. No email authentication. Without SPF, DKIM and DMARC on your domain, anyone can send email that claims to come from you.

Sound familiar? All of that is fixable, and most of it is quick.

Stop phishing that borrows your domain

You can’t stop someone from writing a convincing email. You can make it much harder to send one from your domain, and much easier for clients to spot one that isn’t.

• Move DMARC from monitoring to enforcement. Since February 2024, Google and Yahoo have required bulk senders to publish a DMARC record, and Microsoft followed for Outlook.com in May 2025 (details). But a policy of “none” only monitors. Quarantine sends spoofed mail to spam, and reject refuses it outright. Start at none, read the reports for a few weeks so you don’t block your own legitimate mail, then tighten.
• Watch for lookalike domains. Register the obvious misspellings of your domain, or use a monitoring service that alerts you when one appears.
• Tell clients how you will contact them. One line in every onboarding packet and newsletter: “We will never ask you to confirm a password by email.” It gives clients a rule to check against.

DMARC protects your exact domain, not lookalikes, which is why the last two steps matter.

A 15-minute check you can run today

You don’t need a full audit to find the obvious gaps. Run these on your own domain this week:

1. Put your domain into SSL Labs to check your certificate, then securityheaders.com to check your security headers.
2. Look up your DMARC record with a free DMARC checker. No record, or a policy of “none” that nobody reads the reports for, means your domain can still be spoofed.
3. Open your website’s user list. Remove any admin account you can’t put a name to, and turn on multi-factor authentication for the rest.
4. Check your site’s status in Google Safe Browsing.

You’ll find more checks like these in The MSP Website Security Check [LINK]. For malware scanning and keeping plugins patched safely, see our guide to website management for MSPs [LINK to Blog 2].

Where we’re coming from

MSP MarketingStack started as the web department inside First Call, a Montana MSP for close to 30 years. Before we marketed MSPs, we looked after websites for an MSP’s own IT clients. These checks come from that job.

FAQ

Why does website security matter for an MSP? An MSP’s website and email domain carry its clients’ trust. If either is compromised, attackers can use them to reach those clients, and prospects who spot security warnings on an MSP’s site rarely book a call.

Can AI hack my website? AI doesn’t break into sites on its own, but it makes attackers faster: writing convincing phishing, finding sites with vulnerable plugins and helping build attack code. The defense is the basics, applied consistently: updates, multi-factor authentication, monitoring and an enforced DMARC policy.

How do I know if someone is spoofing my domain? Publish a DMARC record with reporting turned on. The aggregate reports show every server sending email as your domain, including ones you don’t recognize. Clients forwarding strange emails “from you” is the other common sign.