Security teams keep running the same experiment: send a fake phishing email, count who clicks, then try to lower that number. The open-source tool most of them reach for is GoPhish, a self-hosted phishing simulation framework that has sat near the top of GitHub’s phishing-tools list for years and now carries roughly 14,200 stars on its main repository. This tutorial walks through a full GoPhish deployment, from downloading the release to reading your first campaign report, using the current stable build (v0.12.1) and the official Docker image maintained alongside it.
Phishing simulation is not a nice-to-have anymore. According to KnowBe4’s 2025 Phishing By Industry Benchmarking Report, the average untrained workforce has a baseline “phish-prone” rate of 33.1 percent, meaning roughly one in three employees will click a simulated phishing link before any training. After twelve months of consistent simulation-based training, that figure drops to 4.1 percent, an 86 percent reduction. Separately, Check Point Research found that trained employees click through at a rate 32 percent lower than untrained staff. Those numbers are the entire business case for running your own program instead of paying a vendor to do it, and GoPhish is how a lot of security teams build that program without a subscription.
Why Phishing Simulation Testing Matters in 2026
Email is still the cheapest way into a company. Credential phishing, business email compromise, and malicious attachments remain the opening move in the majority of breach chains security teams investigate, and no firewall rule stops an employee from typing a password into a page that looks right. Awareness training closes that gap, but only if it is measured. A slide deck nobody remembers does not change behavior. A simulated phishing email that a third of the office clicks on, followed by a short explanation of what gave it away, does.
GoPhish exists because commercial platforms like KnowBe4, Proofpoint Security Awareness, and Cofense are effective but expensive at scale, and some organizations want full control over recipient data, template content, and hosting. A self-hosted tool also matters for internal red teams and penetration testers who need a phishing simulation platform they can point at a specific engagement scope without routing client data through a third-party SaaS product. That is the audience this guide is written for: security engineers, IT administrators, and authorized penetration testers running sanctioned exercises, not anyone targeting a system they do not have written permission to test.
There is also a budget argument that matters more in 2026 than it did a few years ago. Security teams are being asked to do more with flat headcount while attackers increasingly automate the reconnaissance and pretext-writing side of phishing, which means the volume and realism of incoming attacks keeps rising even as training budgets stay static. A self-hosted, free tool that a single security engineer can stand up in an afternoon and run quarterly closes that gap without a procurement cycle. It will not replace a mature commercial awareness platform for a five-thousand-person enterprise, but for the mid-sized company, the internal red team, or the consultancy running a one-off assessment for a client, it is usually the fastest path to a real, measured baseline.
What Is GoPhish and How the Open-Source Framework Works
GoPhish is a phishing framework written in Go, distributed as prebuilt binaries and as a Docker image (gophish/gophish) under the gophish/gophish GitHub repository. It ships as a single binary that runs both an admin web interface and a public-facing phishing server, backed by a local database. It is built around five objects that map directly onto how a phishing campaign actually works:
- Sending profiles define the SMTP server and sender identity GoPhish uses to deliver simulated phishing emails.
- Email templates are the messages recipients receive; GoPhish can import an existing email and automatically rewrite its links into trackable URLs.
- Landing pages are what a recipient sees after clicking, and can be configured to capture submitted data or simply record the visit.
- Users and groups hold the recipient list, organized so a campaign can target a department instead of individual employees one at a time.
- Campaigns tie a group, a template, a landing page, and a sending profile together, then track every email sent, opened, clicked, and submitted in real time.
That structure is why GoPhish remains the reference implementation for open-source phishing simulation even though, as covered later in this guide, its official release cadence has slowed considerably. The GoPhish organization on GitHub lists 12 repositories, with the core gophish project as the primary toolkit and a separate user guide repository maintaining documentation.
Under the hood, GoPhish runs two separate HTTP listeners from one binary. The admin server hosts the React-based management UI and a REST API that every UI action ultimately calls, which is why scripting a campaign through curl or a Python client works identically to clicking through the browser. The phishing server is the one recipients actually touch: it serves the rewritten tracking links, renders the landing page, and records every event against the campaign’s result set. Keeping those two listeners on separate ports, and separate trust boundaries, is the architectural decision the rest of this guide’s security advice is built around.
Prerequisites and System Requirements
Before you install anything, confirm you have explicit written authorization to run a phishing simulation against the intended recipients. That is not optional and it is covered in detail later in this guide. On the technical side, you need the following.
| Requirement | Recommended | Notes |
|---|---|---|
| Operating system | Linux (Ubuntu 22.04+ or Debian 12+) | GoPhish also ships binaries for macOS and Windows; Linux is standard for a persistent server deployment |
| GoPhish version | v0.12.1 | Current stable release on the GitHub Releases page; the official documentation site lags behind and may show an older version number |
| Go toolchain (source builds only) | Go v1.10 or later | Only required if you are compiling from source rather than using the binary or Docker image |
| Docker (optional path) | Docker Engine 24.x+ and Docker Compose v2 | Official image is gophish/gophish; CISA also maintains ghcr.io/cisagov/gophish |
| Memory / CPU | 1 vCPU, 1 GB RAM minimum | GoPhish is lightweight; scale up only for large recipient lists or high send volume |
| Network | Outbound SMTP access, an isolated admin port | Admin interface must never be exposed to the public internet |
| DNS / domain | A dedicated simulation domain | Never reuse your production domain for landing pages |
You will also need SMTP relay credentials (a dedicated mailbox or transactional email service, not your corporate Exchange account), a short list of pilot recipients who have agreed to participate, and sign-off from HR or legal if you are running this inside a company rather than a lab. It helps to have a registered domain set aside purely for simulations, since reusing a lookalike of your production domain risks confusing employees in ways that undercut the lesson, and it complicates any later takedown request if a domain-monitoring service flags it as suspicious. With that in place, here is the 13-step build.
Step 1: Download and Verify the GoPhish Release
Get the release archive directly from the official GitHub Releases page for gophish/gophish rather than a third-party mirror. Pick the archive that matches your OS and architecture (linux-64bit, windows-64bit, or darwin depending on your host).
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
sha256sum gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip -d gophish
cd gophish
chmod +x gophishCompare the checksum against the value published on the release page before you extract anything. This matters more for GoPhish than for most tools you install, because its releases move slowly and stale or unofficial mirrors circulate.
Step 2: Install GoPhish With Docker
Most teams running GoPhish in 2026 use the Docker path because it isolates the admin server and simplifies upgrades. Pull the official image and confirm it runs before layering configuration on top.
docker pull gophish/gophish
docker run -d
--name gophish
-p 127.0.0.1:3333:3333
-p 80:80
gophish/gophishNote the port binding: 3333 (the admin interface) is bound only to 127.0.0.1, meaning it is reachable from the host machine but not from the public internet. Port 80 (the phishing server that serves landing pages to recipients) is bound to all interfaces because recipients need to reach it. Getting this reversed is the single most common GoPhish misconfiguration, covered again in the pitfalls section below. If you prefer a CISA-maintained build, the Cybersecurity and Infrastructure Security Agency publishes a parallel image at cisagov/gophish-docker, which some federal and enterprise teams standardize on for provenance reasons.
Step 3: Install From the Prebuilt Binary (Alternative Path)
If you would rather run GoPhish directly on a VM without Docker, use the binary you extracted in Step 1. Running it for the first time generates a default TLS certificate and prints the randomly generated admin password to the terminal, so keep that output.
./gophish
# Sample output on first run:
# time="2026-09-25T14:02:11Z" level=info msg="Please login with the username admin and the password 8f2a91d4c7e3b0aa"
# time="2026-09-25T14:02:11Z" level=info msg="Starting admin server at https://127.0.0.1:3333"
# time="2026-09-25T14:02:11Z" level=info msg="Starting phishing server at http://0.0.0.0:80"Copy that password somewhere safe immediately. It is generated once, shown once, and stored only as a bcrypt hash after that. If you lose it before your first login, you will need to reset it directly in the SQLite database rather than through the UI.
Step 4: Lock Down the Admin Interface Before First Boot
Do this before you log in for the first time, not after. GoPhish’s admin server has no built-in IP allowlisting, so the firewall has to do that job. On a standalone Linux host, restrict port 3333 to your management network with ufw or your cloud provider’s security group.
sudo ufw default deny incoming
sudo ufw allow from 203.0.113.0/24 to any port 3333 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enableReplace 203.0.113.0/24 with your own admin network or VPN range. If you deployed with Docker using the binding shown in Step 2, the admin port is already restricted to localhost, so pair that with an SSH tunnel or a reverse proxy that requires authentication rather than opening 3333 to the internet under any circumstances. Exposing the GoPhish admin console publicly is the fastest way to have your own phishing infrastructure hijacked by someone else’s campaign.
Step 5: Log In and Rotate the Default Admin Credentials
Open https://127.0.0.1:3333 (or your SSH-tunneled equivalent) in a browser, accept the self-signed certificate warning for now, and log in with the username admin and the password printed in Step 3. Immediately go to Account Settings and set a new password of at least 16 characters. Then replace the self-signed certificate with one issued by your internal CA or Let’s Encrypt, since a browser warning on your own admin panel trains your team to ignore certificate warnings, which is exactly the habit a phishing test is supposed to break.
Step 6: Configure a Sending Profile for SMTP Delivery
Under Sending Profiles, create a new profile pointing at a dedicated relay or a transactional email provider, never your primary corporate mail server. Set the “From” address to something plausible for the scenario (for example, an internal IT-support-style alias on your simulation domain) and add your admin address as the interface hostname so you can verify delivery before targeting real recipients.
Name: Internal-IT-Sim
SMTP Host: smtp.yoursimdomain.com:587
Username: sim-sender@yoursimdomain.com
Password: ********
From Address: IT Support <support@yoursimdomain.com>
Ignore Certificate Errors: falseClick Send Test Email before saving. If it fails, check the troubleshooting section below before touching the SMTP settings again, since most failures here are authentication or port issues rather than GoPhish bugs.
Deliverability is worth planning for before you launch, not after your first campaign lands entirely in spam. Configure SPF and DKIM records for the simulation domain the same way you would for a production sending domain, and consider a DMARC policy set to at least p=quarantine once DKIM is passing consistently. Mail providers in 2026 filter unauthenticated bulk senders aggressively, and a phishing simulation domain with no authentication records behaves, from the receiving mail server’s perspective, exactly like a spam source. If your simulation emails never reach the inbox, your click-rate data is meaningless, since you are measuring your spam filter instead of your employees.
Step 7: Build a Landing Page That Logs Behavior, Not Passwords
Under Landing Pages, either import a real login page’s HTML (GoPhish can pull a page by URL and rewrite its form action) or write a simple static page. The important decision is whether to capture submitted data. For an awareness program, the safer default is to record only the click and page visit, then redirect to a short educational page explaining what the recipient just fell for. If your program does capture submitted values for measurement purposes, disable “Capture Passwords” and instead log placeholder field names, so no real employee credentials ever land in your GoPhish database.
The redirect-after-capture setting is where most of the actual training value lives. Instead of dumping a clicked employee onto a generic “you failed” page, point the redirect at a short, specific breakdown: the sender address that should have looked wrong, the urgency language that was a red flag, and the one-click reporting button they should have used instead. GoPhish also supports a “before you click” variant where the landing page itself doubles as a two-minute micro-lesson rather than a gotcha screen, which several published awareness-program write-ups describe as producing better long-term retention than a scolding message alone, even though it takes a little longer to build the page content.
Step 8: Write an Email Template
Under Email Templates, write or import the message recipients will receive. GoPhish automatically replaces any link in the template with a unique tracking URL per recipient, and can insert an invisible tracking pixel to record opens. Keep the pretext realistic but avoid subject matter that is manipulative in a way that could cause genuine distress, such as fake termination notices or medical emergencies; the legal and ethical section later in this guide covers why that line matters.
Subject: Action required: verify your mailbox storage limit
Body (HTML):
<p>Your mailbox has reached 94% of its storage limit.</p>
<p><a href="{{.URL}}">Click here to request additional storage</a></p>
<img src="{{.TrackingURL}}" width="1" height="1"/>The {{.URL}} and {{.TrackingURL}} template variables are GoPhish’s built-in placeholders; the platform substitutes the real per-recipient tracking link at send time.
Step 9: Import Target Users and Groups
Under Users & Groups, either add recipients manually or import a CSV with first name, last name, email, and position columns. Start with a pilot group of 10 to 25 people who have opted in, not your entire company, on your very first run.
First Name,Last Name,Email,Position
Jordan,Alvarez,jordan.alvarez@example.com,Accounts Payable
Priya,Nair,priya.nair@example.com,IT Support
Sam,Okafor,sam.okafor@example.com,SalesThe “Position” field is more useful than it looks. Segmenting results by department later lets you show finance or HR-specific click-rate trends instead of one flat company-wide number, which is what most stakeholders actually want to see in a report.
Step 10: Configure Campaign Settings and Link Tracking
Go to Campaigns → New Campaign and tie together the group, template, landing page, and sending profile you just built. Set a launch date, and optionally a “Send Emails By” window so the batch goes out gradually instead of all at once, which both avoids overwhelming your SMTP relay and produces a more realistic click-rate curve over several hours rather than a single spike.
This is also the point to decide on your campaign naming convention, since it matters once you have run a dozen of these. A pattern like YYYY-QN-department-scenario (for example 2026-Q4-finance-invoice) keeps campaigns sortable in the dashboard and makes the quarterly trend report you build in Step 13 far easier to assemble, since you can filter by department or scenario type without hunting through a flat list of vaguely named campaigns from eighteen months ago.
Step 11: Launch Your First Campaign
Review every field one more time, since campaigns cannot be edited once launched, then click Launch Campaign. GoPhish immediately starts queuing and sending emails according to your sending profile and sending window.
curl -s -k https://127.0.0.1:3333/api/campaigns/
-H "Authorization: Bearer $GOPHISH_API_KEY" | python3 -m json.tool
# Sample response (trimmed):
# {
# "id": 4,
# "name": "Q4-2026-IT-Storage-Pilot",
# "status": "In progress",
# "created_date": "2026-09-25T14:31:02Z",
# "results": [
# {"email": "jordan.alvarez@example.com", "status": "Email Sent"}
# ]
# }Your API key lives under Account Settings and lets you script campaign creation and result pulls, which matters once you are running this quarterly rather than once.
Step 12: Monitor Results in Real Time
The campaign dashboard updates live as events come in: Email Sent, Email Opened, Clicked Link, Submitted Data, and Email Reported (if you have a report-phishing button configured in your mail client). Watch the timeline chart during the first hour especially, since a sharp early spike in “Clicked Link” combined with zero “Submitted Data” events is a healthy pattern, meaning people are curious enough to click but the landing page correctly is not fooling them into typing a password.
Pay close attention to the “Email Reported” metric if you have it wired up. A rising report rate alongside a falling click rate is the strongest possible signal that your program is working, because it shows employees are not just avoiding the bait, they are actively flagging it for the security team, which is the behavior you actually want during a real attack. If your mail platform supports a one-click “Report Phishing” add-in, integrating it with your incident response queue before you launch a GoPhish campaign turns every simulation into a live-fire drill for that reporting pipeline as well.
Step 13: Export Results and Build a Report for Stakeholders
Once the campaign window closes, export results as CSV from the campaign page or pull them via the API for a repeatable reporting pipeline. Report the numbers stakeholders actually care about: overall click rate, click rate by department, time-to-first-click, and repeat-clicker count from prior campaigns. Compare against the KnowBe4 benchmark figures cited earlier in this guide (33.1 percent baseline, 4.1 percent after a year of consistent training) so leadership has an external reference point, not just your own numbers in isolation.
Common Pitfalls When Running GoPhish Campaigns
Most GoPhish problems are not bugs in the tool, they are process mistakes made by teams running it for the first time. Here are the ones that come up most often, in roughly the order teams tend to hit them, from initial setup through the first live campaign.
- Exposing the admin port to the internet. Port 3333 should never be reachable from outside your management network. If it is, anyone who finds it can attempt to brute-force or exploit the admin login and hijack your sending infrastructure.
- Launching against the entire company on day one. A botched template or a broken landing page redirect sent to 2,000 people generates a flood of help-desk tickets and erodes trust in the security team. Pilot with a small, opted-in group first.
- Reusing the production domain for landing pages. If your simulated phishing page lives on a subdomain of your real corporate domain, you are training employees to trust look-alike URLs on your own domain, which undermines the lesson.
- Capturing real passwords “just to see.” Storing submitted credentials, even fake ones typed by real employees, creates a sensitive data set you now have to protect and justify retaining. Log the click, not the password.
- Running it without HR or legal sign-off. A simulation that uses a termination notice or a paycheck-error pretext can cause genuine anxiety and, depending on jurisdiction, create employment-law exposure. Get the pretext approved before it goes out.
- Ignoring the results and never following up. A campaign that ends with an email that says “gotcha” and nothing else wastes the opportunity. The click-through moment is when people are most receptive to a 60-second explanation of what gave the email away.
- Assuming GoPhish auto-updates. It does not. Official releases have slowed considerably since v0.12.1 shipped in September 2022, so treat your installation as something you actively maintain, not a set-and-forget appliance.
Troubleshooting: 8 Common GoPhish Issues and Fixes
| Issue | Likely Cause | Fix |
|---|---|---|
| Test email never arrives | SMTP relay requires authentication GoPhish isn’t sending, or port 587/465 is blocked outbound | Verify credentials with a manual swaks or openssl s_client test against the same host and port before retrying in GoPhish |
| Admin page shows a certificate warning every login | GoPhish is using its self-signed default certificate | Replace it with a certificate from your internal CA or Let’s Encrypt and point the admin server config at the new cert and key files |
| Tracking links resolve to a blank page | The phishing server’s public hostname in config.json doesn’t match the domain in your DNS record |
Set contact_address and the listen URL to match your actual simulation domain, then restart GoPhish |
| Campaign stuck at “Queued” and never sends | Sending profile authentication is failing silently | Check the GoPhish log output for SMTP errors; resend a test email from the sending profile page to surface the exact rejection reason |
| Emails land directly in spam or are blocked | Missing SPF, DKIM, or DMARC records for the simulation domain | Configure SPF and DKIM for your simulation sending domain just as you would for production mail; unauthenticated domains get filtered aggressively in 2026 |
| Lost the admin password before first login | The one-time generated password was not saved | Stop GoPhish, update the admin user’s password hash directly in the SQLite database (or Postgres, if configured), then restart |
| Docker container restarts and loses campaign data | No persistent volume mounted for the database | Mount a named volume to the container’s data directory so the SQLite file survives container restarts and image updates |
| Landing page capture-data field shows garbled text | Form field names in the imported HTML don’t match what GoPhish expects | Rename input fields to standard names like username and password, or disable capture entirely and just track clicks |
Advanced Tips: Hardening and Scaling Your GoPhish Deployment
Once your pilot campaign runs cleanly, a few changes turn a one-off test into a repeatable program. First, put GoPhish behind a reverse proxy such as nginx or Caddy so TLS termination, rate limiting, and access logging happen outside the application itself. Second, move from SQLite to Postgres for the backend database once you are running quarterly campaigns against more than a few hundred recipients, since concurrent write performance under SQLite degrades faster than most teams expect. Third, script campaign creation through the API rather than clicking through the UI every quarter; the same JSON payload that creates a campaign can be version-controlled alongside your templates.
A minimal nginx reverse-proxy block in front of the phishing server also gives you request logging and basic rate limiting for free, which matters if a campaign link ever gets forwarded outside the intended recipient list and starts pulling in unexpected traffic.
server {
listen 443 ssl;
server_name yoursimdomain.com;
ssl_certificate /etc/letsencrypt/live/yoursimdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yoursimdomain.com/privkey.pem;
location / {
proxy_pass http://127.0.0.1:80;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
limit_req zone=phishsim burst=20 nodelay;
access_log /var/log/nginx/gophish-access.log;
}
}Here is a complete, self-contained Docker Compose project that ties the hardening steps above together: a persistent volume for campaign data, an isolated admin network, and environment-driven configuration instead of hardcoded values.
# docker-compose.yml
version: "3.9"
services:
gophish:
image: gophish/gophish:latest
container_name: gophish
restart: unless-stopped
environment:
- TZ=UTC
volumes:
- gophish_data:/opt/gophish/data
- ./config.json:/opt/gophish/config.json:ro
ports:
- "127.0.0.1:3333:3333" # admin interface, localhost only
- "80:80" # phishing server, public
- "443:443" # phishing server TLS
networks:
- gophish_net
networks:
gophish_net:
driver: bridge
volumes:
gophish_data:{
"admin_server": {
"listen_url": "127.0.0.1:3333",
"use_tls": true,
"cert_path": "/opt/gophish/certs/admin.crt",
"key_path": "/opt/gophish/certs/admin.key"
},
"phish_server": {
"listen_url": "0.0.0.0:80",
"use_tls": false
},
"db_name": "sqlite3",
"db_path": "/opt/gophish/data/gophish.db",
"contact_address": "security@yoursimdomain.com"
}Finally, treat phishing simulation as one layer in a broader authentication strategy rather than a standalone exercise. The FIDO Alliance’s 2026 workforce report found that 68 percent of organizations have deployed, piloted, or are actively rolling out passkeys for employee sign-in, which is worth pairing with your simulation results: a company that both trains employees to spot phishing and removes phishable passwords from its highest-risk logins is addressing the same problem from two directions at once.
GoPhish vs King Phisher vs Commercial Platforms
GoPhish is not the only option, and it is not always the right one. Here is how it stacks up against the alternatives most often considered alongside it.
| Tool | Type | Best For | Cost |
|---|---|---|---|
| GoPhish | Open-source, self-hosted | Security teams and pentesters who want full control and no per-seat cost | Free |
| King Phisher | Open-source, self-hosted | Red teams that want more advanced social-engineering scenario support | Free |
| Social-Engineer Toolkit (SET) | Open-source, self-hosted | Broader social-engineering and penetration-testing engagements beyond email | Free |
| KnowBe4 | Commercial SaaS | Enterprises that want built-in training content, automation, and vendor support | Per-seat subscription |
| Proofpoint Security Awareness | Commercial SaaS | Organizations already using Proofpoint’s broader email security stack | Per-seat subscription |
| Cofense | Commercial SaaS | Companies that want phishing simulation tied to a reporting/response platform | Per-seat subscription |
The trade-off is straightforward: GoPhish, King Phisher, and SET cost nothing but require you to build and maintain your own templates, landing pages, and reporting pipeline. Commercial platforms cost real money per employee per year but ship with a content library, automated scheduling, and a support contract. Teams with a dedicated security engineer and a modest budget tend to land on GoPhish; teams without the internal bandwidth to maintain a self-hosted tool tend to land on a commercial platform instead.
Where GoPhish specifically pulls ahead of King Phisher and SET is scope. King Phisher supports a wider range of social-engineering scenario types and is popular with red teams running broader engagements, but that flexibility comes with a steeper learning curve. SET is built for a wider range of attack simulation beyond email entirely, including USB drop and website-cloning scenarios, which is more than most security-awareness programs need. GoPhish stays narrowly focused on email phishing campaigns, and that narrowness is exactly why it is the easiest of the three to hand to a junior security analyst and have them running a clean campaign within a day.
Legal and Ethical Considerations for Phishing Simulations
Running a phishing simulation without proper authorization can cross into legally and ethically questionable territory even inside your own company. Get written sign-off from a system owner and, where relevant, legal or compliance before you send a single test email, and define the scope explicitly: which domains, which recipients, which dates, and which infrastructure are in play. Notify IT operations, the help desk, and your incident response team ahead of time so a simulated campaign is not mistaken for a real intrusion and does not trigger an unnecessary incident response.
On content, avoid pretexts built around medical emergencies, termination notices, bereavement, immigration status, or personal finances. Those scenarios can cause genuine distress and generally are not necessary to produce a useful click-rate measurement. Never collect real passwords, MFA codes, or other sensitive data through a landing page, and set a clear retention and deletion policy for whatever campaign data you do collect. Limit access to individual-level results and avoid using them punitively; a program that publicly shames the people who clicked erodes the trust you need for the next simulation to work. The guidance from the National Institute of Standards and Technology’s small business phishing resources covers this framing in more depth if you need a reference to bring to a legal or compliance review.
It also helps to coordinate allowlisting in advance rather than fighting your own spam filter mid-campaign. Loop in whoever manages your email security gateway so the simulation domain is not auto-quarantined, and agree on a signal, such as a specific header or subject-line tag, that lets the security operations team distinguish a sanctioned simulation from a genuine incident without needing to ask you in the middle of a campaign. Skipping this step is a common reason a GoPhish campaign quietly triggers a real incident response investigation, which wastes analyst time and undermines confidence in the program the next time you run it.
Frequently Asked Questions
Is GoPhish free to use?
Yes. GoPhish is open-source and free to download, self-host, and run, with no per-seat licensing cost, distributed through its official GitHub repository and Docker Hub image.
Is it legal to run a phishing simulation on my own employees?
It generally is when you have proper authorization from the organization, a defined scope, and content that avoids collecting real sensitive data, but employment law and privacy rules vary by jurisdiction. Have legal or compliance review the program design before launch rather than assuming it is automatically fine.
What is the latest GoPhish version?
The current stable release is v0.12.1, published on the official GitHub Releases page. Official development has slowed considerably since that release, so check the repository directly for any newer tags before you deploy.
Can GoPhish send SMS or voice phishing (vishing) tests, not just email?
No. GoPhish is built specifically around email-based phishing campaigns, tracking links, and landing pages. Simulating SMS phishing (smishing) or voice phishing (vishing) requires a separate tool or a commercial platform that supports those channels.
Does GoPhish integrate with Active Directory or an HR system for recipient lists?
Not natively. Recipients are added through the UI or imported via CSV. Larger organizations typically script a periodic export from Active Directory or their HR system into the CSV format GoPhish expects, then automate the import through the API.
How many people should I include in my first campaign?
Start with a small, opted-in pilot group of roughly 10 to 25 people rather than the whole company. It lets you validate your sending profile, landing page, and reporting workflow before a misconfiguration reaches a thousand inboxes at once.
Are there known security vulnerabilities in GoPhish itself?
Google’s Open Source Insights dependency-analysis service has flagged the v0.12.1 release with an “Incorrect Access Control” finding, though no formally assigned CVE identifier was available for it as of this writing. That is one more reason to keep the admin interface off the public internet regardless of version, as outlined in Step 4 of this guide.
What is a good click-rate target after a year of training?
Under 5 percent is the commonly cited target after roughly 12 months of consistent simulation-based training, based on KnowBe4’s 2025 Phishing By Industry Benchmarking Report, which recorded an industry-wide drop from a 33.1 percent baseline to 4.1 percent over that period.