Documentation

1. 01

   Create your organisation account

   Register at phishshield.uk/register with your work email. A free demo account is created instantly — no credit card required.
2. 02

   Verify your domain

   Go to Dashboard → Verify domain. Since you're already signed in as an admin, your domain is confirmed instantly — no DNS changes or email required.
3. 03

   Add your targets

   Navigate to Targets and import your team via CSV, or add employees one at a time.
4. 04

   Run your first campaign

   Go to Campaigns → New campaign, pick a template, select your targets, and schedule or send immediately. Results appear in real-time on the Reports page.

Creating a campaign

From Campaigns → New campaign, choose a template (or build your own), select a target audience, configure the sender details, and set a schedule. Campaigns can be sent immediately or queued for a future date and time.

Templates

PhishShield ships with 20+ pre-built templates covering credential harvesting, invoice fraud, IT helpdesk impersonation, package delivery scams, and more. Each template is fully editable — customise the subject line, body, sender name, and landing page.

Tracking events

PhishShield tracks the following events per target per campaign:

• Email delivered
• Email opened (1×1 tracking pixel)
• Link clicked (redirect tracking)
• Credentials submitted (landing page form)
• Training viewed (post-click education page)

Spam filter guide

If campaign emails are landing in spam, follow the spam filter guide inside your dashboard (Campaigns → Spam filter guide) to whitelist PhishShield's sending infrastructure in your mail gateway.

Adding targets

Targets can be added three ways:

• Manually — click Add Target and fill in the form.
• CSV import — upload a file with the format below.

CSV format

Column headers are flexible — email, Email, and EMAIL all work. Only the email column is required.

email,first_name,last_name,department,position
[email protected],Alice,Smith,Finance,CFO
[email protected],Bob,Jones,Engineering,Developer

Licence limits

The number of targets you can add depends on your plan. Purchase additional licence slots at any time from Dashboard → Billing. Only email addresses matching your verified domain can be added.

Groups let you segment your workforce so you can run department-specific campaigns (e.g. a Finance-targeted invoice fraud simulation) or assign training to a subset of employees.

1. 01

   Create a group

   Go to Groups → New group, give it a name and optional description.
2. 02

   Assign targets

   Open the group and use the Targets tab to add members. A target can only belong to one group at a time.
3. 03

   Use in campaigns

   When creating a campaign, choose a group as the target audience instead of selecting individual recipients.

How it works

PhishShield includes 24+ security awareness modules covering phishing, ransomware, password hygiene, MFA, social engineering, and more. Admins assign modules to employees; employees complete them in a separate learner portal.

1. 01

   Assign training

   Go to Training → Assign to employees. Select one or more modules, then choose your audience — all targets, a specific group, or a manual list of email addresses.
2. 02

   Employees receive an invite

   Each newly assigned employee gets an email with a one-click magic link valid for 7 days. Clicking it logs them straight into the training portal — no password needed.
3. 03

   Employees complete modules

   Learners visit phishshield.uk/training-portal, work through lessons at their own pace, and take a quiz to earn a completion certificate.
4. 04

   Track progress

   Monitor completion rates per module and per employee from Training → Assignments.

Employee portal login

After the initial magic link expires, employees sign in at phishshield.uk/training-portal using their work email. A 6-digit one-time code is sent to their inbox — no account or password is ever required.

Plan availability

Security training is available on Essentials and above. Individual modules may require higher plans — locked modules are visible but show an upgrade prompt.

Campaign reports

The Reports page shows aggregate and per-campaign metrics including open rate, click rate, credential submission rate, and training engagement. Use the date range filter to compare performance over time.

Key metrics

• Click rate — Percentage of targets who clicked the phishing link
• Submission rate — Percentage who entered credentials on the landing page
• Repeat clickers — Targets who fell for more than one campaign
• Training completion — Percentage who completed the post-click education page

Exporting data

Reports can be exported as CSV from the Reports page. Enterprise customers also have access to board-ready PDF compliance reports.

Domain verification

Domain verification proves you own the domain your targets use. Once verified, you can send phishing simulations and your employees can access the training portal. Go to Dashboard → Verify domain — since you're already authenticated as an administrator, your domain is confirmed instantly.

Notifications

Configure email alerts for campaign events — new clicks, credential submissions, and weekly digests — from Settings → Notifications.

Billing & plans

Upgrade, downgrade, or purchase additional target licence slots from Billing. All plan changes take effect immediately and are prorated.

Authentication

All API requests must include your API key as a Bearer token in the Authorization header.

Authorization: Bearer ps_live_your_api_key_here

Base URL

https://phishshield.uk/api/v1

Endpoints

{
  "organization": { "id": "...", "plan": "ENTERPRISE" },
  "targets": 312,
  "campaigns": 18,
  "groups": 7,
  "overallClickRate": 14,
  "recentCampaigns": [ ... ]
}

{
  "email": "[email protected]",
  "firstName": "Jane",
  "lastName": "Smith",
  "department": "Finance",
  "position": "CFO",
  "groupId": "clx..."   // optional
}

{
  "id": "clx...",
  "name": "Q1 Finance Phish",
  "status": "COMPLETED",
  "stats": {
    "sent": 80,
    "opened": 52,  "openRate": 65.0,
    "clicked": 18, "clickRate": 22.5,
    "submitted": 4,"submissionRate": 5.0,
    "reported": 12,"reportRate": 15.0,
    "trained": 18
  }
}

Error responses

All errors return a JSON body with an error field and a standard HTTP status code.

401  { "error": "Invalid or missing API key" }
403  { "error": "API access requires an Enterprise plan" }
404  { "error": "Not found" }
409  { "error": "Target with that email already exists" }