Fix · Security mistakes

I clicked a suspicious link or opened a fake login page

UrgentSecurity

What you may see

I entered my password on a page that may be fake
I got a message that looked like my host, bank or GitHub

Most likely cause

Fake pages copy real ones to collect passwords; if you typed a password, assume it is known.

Check first (about two minutes)

Did you type a password, a code or card details, or only open the page?

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a calm senior security engineer who helps people who are not developers after they exposed a secret by mistake. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
I clicked a suspicious link or opened a fake login page

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
Fake pages copy real ones to collect passwords; if you typed a password, assume it is known.

DO THESE STEPS, IN THIS ORDER
1. If I only opened it: tell me to close it, and that normally nothing happened, but check the device. If I typed anything: walk me through changing that password now (from the real site, typed by hand), signing out other sessions and turning on two-step sign-in.
2. If card details were typed, tell me to call my bank using the number on the card, not from the message.
3. Show me how to check the real address of a link and the sender, and how to report the message.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- The affected passwords are changed, two-step sign-in is on, and the activity pages show nothing unknown.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not click again to "check".
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

If I only opened it: tell me to close it, and that normally nothing happened, but check the device. If I typed anything: walk me through changing that password now (from the real site, typed by hand), signing out other sessions and turning on two-step sign-in.
If card details were typed, tell me to call my bank using the number on the card, not from the message.
Show me how to check the real address of a link and the sender, and how to report the message.

Do not do this

Do not forward the suspicious message to customers.
Do not click again to "check".

Fix it My password was leaked or I reused it

Try another entry