PhishGuard Docs
A clear guide to what PhishGuard checks, how the score is calculated, what data is handled, and what the current Version 1 build can and cannot do.
Latest Update
The current build focuses on realistic phishing detection: authority-claim mismatches, optional header analysis, and better scoring when moderate signals appear together.
Version
v1.2.0
Backend
1.2.0
Ruleset
rsv.1.2
UI Build
v1.2-prod1
Released
June 16, 2026
Backend Wake-Up
PhishGuard uses a hosted backend for analysis. If the service has been inactive, the first request may take a moment while the server wakes up.
Update Log
V1.2 authority engine
June 16, 2026
Added sender authority mismatch, optional header checks, context-combination scoring, stronger real-phish calibration, and mobile Help access.
V1.1.5 identity
June 8, 2026
Updated PhishGuard product icons, added a visible version badge, refreshed docs guidance, and clarified scoring accuracy expectations.
V1.1.4 warmup
June 5, 2026
Added Render cold-start awareness, longer backend wake checks, clearer System Status states, and production-safe API startup logging.
V1.1.3 polish
June 5, 2026
Fixed Command Center section highlighting, strengthened proxy rate-limit handling, improved modal scrolling, and added report cleanup.
What PhishGuard Does
PhishGuard scans suspicious emails, texts, and links for common phishing indicators. It is meant to help someone slow down, see the evidence, and decide what to do next.
Paste the message
Add the sender, subject, message body, and any URL that appeared in the email or text.
Run the scan
PhishGuard checks the content against a rule-based model with sender, URL, authority, and optional header context.
Read the evidence
The result shows the score, matched indicators, confidence, and recommended next steps.
Export if useful
The report view can copy or export a clean summary for notes, classwork, or reporting.
Score Ranking
Low
0-24
Few or no warning signs. Still verify unexpected requests before acting.
Medium
25-49
Some suspicious context exists. Slow down and verify through an official channel.
High
50-74
Multiple warning signs are present. Avoid links and attachments until verified.
Critical
75-100
Strong phishing indicators. Do not interact and report the message if it came through school or work.
Scoring Signals
The score comes from matched rules. Strong indicators add more points, while weak context signals are kept lower so normal messages do not become scary by accident.
Urgency
Pressure words, deadlines, account locks, and immediate action language.
Credentials
Requests for passwords, logins, verification codes, or identity confirmation.
Links
Shorteners, IP addresses, HTTP links, lookalike domains, and mixed destination domains.
Mismatch
Sender names or visible link text that do not match the real destination.
Authority
Official-sounding IT, payroll, security, or account claims from personal, student, or unusual mailbox channels.
Headers
Optional From, Reply-To, Return-Path, SPF, DKIM, and DMARC clues when raw headers are pasted.
Money
Billing, invoice, refund, transaction, or payment pressure.
Writing quality
Misspellings, odd spacing, all-caps pressure, and repeated punctuation as supporting evidence.
Privacy
Messages are sent to the backend for analysis, but the backend does not store submissions.
The report page uses browser session storage so a result can be viewed without placing message content in the URL.
Optional scan history is off by default and stays in the user's browser when enabled.
Bug reports are sent through the backend by email and should not include passwords, codes, or sensitive message content.
Users should not paste passwords, verification codes, Social Security numbers, financial details, or private personal data.
How Accurate Is This?
PhishGuard is meant to make common phishing evidence easier to understand. It is strongest when a message includes text, links, sender context, or clear action requests.
Rule-based by design
PhishGuard uses transparent rules instead of a black-box model, so users can see which signals influenced the score.
Scores are evidence, not certainty
A low score means the submitted text did not contain enough warning signs. It does not guarantee the message is safe.
Context matters
Known domains, quiet wording, student mailboxes, forwarded text, and missing headers can change how much confidence the scanner should have.
Best use
Use the result as a checkpoint before clicking, replying, downloading files, or entering information.
Limitations
Rule-based detection can miss new attacks, image-only phishing, and highly targeted impersonation.
A trusted domain is not automatically safe; real services can be abused in phishing messages.
PhishGuard is built for awareness and learning, not as a replacement for enterprise email security tools.
The trusted-domain and brand lists should be expanded carefully so the model does not become too permissive.
Developer Notes
Frontend
Next.js app with same-origin routes for scanner and health checks.
Backend
Express TypeScript service that runs the scoring engine and exposes GET /health.
Analyze route
POST /api/analyze proxies to the backend through INTERNAL_API_URL.
Cold starts
On Render free tier, the backend may need a short wake-up period after inactivity. System Status shows this as Waking.
Rate limiting
Backend limits can be tuned with RATE_LIMIT_MAX_REQUESTS, RATE_LIMIT_WINDOW_MS, and TRUST_PROXY_HOPS.
Deployment path
Recommended public URL: phishguard.shivpatel.net with frontend and backend hosted separately.
Repository
The source code, setup notes, and project history are available in the public GitHub repository.