1. Introduction

Phishing simulation with Gophish is one of the most effective tools for turning the human link of an organization into a measurable layer of defense, and Gophish is, without question, the most widely used open source platform for it. Every campaign launched with Gophish returns objective, quantifiable data: how many employees opened the email, how many clicked the link and how many went as far as entering their credentials on the capture page. Thanks to that data, the awareness program stops being an annual lecture and becomes a continuous improvement process. In this article we carry out a complete lab of phishing simulation with Gophish, step by step: we install the platform, configure SMTP sending profiles, design realistic templates and landing pages, launch a campaign against a group of fictional users and analyze the resulting metrics. Phishing simulation with Gophish allows us to rehearse credential theft scenarios with full ethical and legal control, provided we work on an authorized environment, and this guide covers exactly how to do it the right way. Phishing simulation with Gophish, well executed, becomes the thermometer of the human factor.

2. Why Phishing Simulation with Gophish Is Essential in Your Security Program

91% of documented breach incidents begin with a phishing email, according to the annual industry reports. Phishing simulation with Gophish fights this vector directly: every employee who falls for a simulation receives immediate, personalized feedback, and the security team obtains metrics that are comparable across departments, quarters and scenarios, and that comparability is the great value of phishing simulation with Gophish. Compared with commercial solutions that bill per user, Gophish delivers the essentials at no cost: sending profiles, HTML templates with variables, credential capture pages, REST API integration and real-time results. The philosophy of the tool is simple and right: the point is not to catch people, but to train them. That is why every campaign ends with an educational screen on the landing page, informing the user and giving concrete guidelines for recognizing a real malicious email. With this approach, phishing simulation with Gophish demonstrably reduces the click rate on real suspicious emails, provides objective evidence ahead of regulatory audits, and no serious defense strategy should omit phishing simulation with Gophish.

3. Installing Gophish and Initial Configuration

The installation of phishing simulation with Gophish starts on an Ubuntu 22.04 server. We download the latest release from the official repository, unpack it and start the binary:

$ curl -sS -L -o gophish.zip \
    https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
$ unzip gophish.zip -d gophish/
$ cd gophish/ && chmod +x gophish
$ sudo ./gophish

Fig. 1 – Starting the Gophish server with the admin port 3333 and the campaign server port 80 in the lab (own lab).

The administrative server listens on port 3333 and the phishing server on port 80; we log in with admin and the password printed at first boot. In production we edit the config.json file to set the public base URL, change the TLS certificates and restrict the administrative interface to the management network:

{
  "admin_server": {
    "listen_url": "0.0.0.0:3333",
    "use_tls": true,
    "cert_path": "/etc/gophish/admin.crt",
    "key_path": "/etc/gophish/admin.key"
  },
  "phish_server": {
    "listen_url": "0.0.0.0:80",
    "use_tls": true,
    "cert_path": "/etc/gophish/phish.crt",
    "key_path": "/etc/gophish/phish.key"
  }
}

Also place the admin panel behind a VPN or additional authentication and run Gophish with an unprivileged system user. To survive reboots and manage its logs with systemd, we create a unit like the following and enable it:

[Unit]
Description=Gophish phishing simulation server
After=network.target

[Service]
User=gophish
Group=gophish
ExecStart=/opt/gophish/gophish
Restart=on-failure

[Install]
WantedBy=multi-user.target

On the firewall we expose only port 80 publicly for the landing pages; port 3333 stays restricted to the administration network, an isolation that any serious phishing simulation with Gophish deployment requires. The next step within phishing simulation with Gophish is preparing the sending stage.

4. Configuring SMTP and Realistic Templates

In the Sending Profiles section we create the profile that will deliver the emails: an SMTP server with TLS, the credentials of a dedicated outbound account and the sender. For the campaign to be realistic, the sender must look legitimate (for example, “notification@corp-news-security.com”) and the server must be properly authenticated to avoid SPF and DKIM blocking:

Name         : Simulator-SSO
From         : notifications@security-news-corp.com
Host         : smtp.corp-news.com:587
Username     : phisim@smtp-relay.corp-news.com
Password     : ********
From Address : SAT <notifications@security-news-corp.com>

Fig. 2 – SMTP sending profile configured for the simulated emails in the lab (own lab).

Templates take advantage of Gophish variables such as {{.FirstName}} or {{.Tracker}} (which injects the tracking pixel) and must clone the real format of the IT communication, including the visual layout. The landing page replicates the corporate SSO portal and records every visit; in the source code we insert the token that we will replace in the template link. Two details separate a credible simulation from a cartoonish one: the subject line and the payload consistency. We prepare several subject variants and rotate them between groups so the exercise does not become a signature hunt, keeping email body, link domain and landing page in the same fake narrative. If the email claims to come from the security operations team but the link points to a generic domain, the users will distrust the exercise and the metrics will lose validity. For the simulated phish to be believable, we build the scenario with the same ingredients a real attacker uses: urgency (“your session expires in 24 hours”), a familiar logo, a sender address close to the corporate one and a destination URL whose domain resembles the legitimate one. The difference from a real attack is ours, and it is essential: the destination page includes the awareness screen after the capture, the process remains documented and the launch happens during business hours to obtain metrics representative of real behavior; the design of these pieces largely decides the outcome of phishing simulation with Gophish.

5. User Groups and Campaign Launch

With the SMTP profile, the template and the landing page created, the next step of phishing simulation with Gophish is defining the recipient groups. We import a CSV list with first name, last name and email, and we create groups segmented by department and risk level: teams with privileged access or with a history of incidents are marked as priority, and in phishing simulation with Gophish they receive up to two campaigns per quarter. An example of the accepted CSV format:

First Name,Last Name,Email
John,Doe,john.doe@corp.com
Jane,Smith,jane.smith@corp.com
Carl,Whitmore,carl.whitmore@corp.com

Before the official launch we run a test campaign against an internal account to validate delivery, email rendering, the tracking pixel and the click registration on the landing page; any failure in this phase saves hours of debugging later; the internal pilot is the most profitable stage of phishing simulation with Gophish.

5.1. Launching Realistic Campaigns with Phishing Simulation with Gophish

We create the campaign by indicating the sending profile, the template, the landing page, the URL where the phishing server will be hosted (we can use the built-in port 80 or a fake-named subdomain) and the start date. Gophish sends the messages in a staggered fashion and begins recording every event in real time. The recipients receive an email whose appearance is identical to an internal security communication; whoever clicks arrives at the corporate identity page and, if they enter their credentials, the platform captures them securely and shows the educational screen. The campaign runs within minutes, the dashboard reflects the results instantly and the phishing simulation with Gophish remains logged end to end.

6. Results Analysis and Campaign Metrics

The Gophish campaign panel shows the complete breakdown of each send: opened, clicked, submitted credentials and reported, the common language of any phishing simulation with Gophish. Metrics can be exported to CSV or queried through the REST API. In our lab campaign we obtained the following values across 100 recipients:

Metric	Value	Rate	Desirable benchmark
Emails sent	100	100%	100%
Emails opened	64	64%	< 50%
Links clicked	23	23%	< 15%
Credentials submitted	9	9%	< 5%
Emails reported	7	7%	> 10%

With these data, the awareness program is prioritized by department: the groups with the worst rates receive targeted training and a follow-up campaign, and the values are compared quarter over quarter to measure improvement. We also recommend setting up an automated reporting address (for example, a report button in the corporate mail client that forwards to phishing@corp.com) and using a periodic calibration campaign to verify that the reporting flow works, since the reported rate is the metric most correlated with program maturity. The API query additionally allows pushing results into our security hub or SIEM, automating the complete cycle of phishing simulation with Gophish within the defense program. A minimal query example would be the following:

$ curl -k -H "Authorization: Bearer $API_KEY" \
    https://phishing.corp.local/api/campaigns/ | python3 -m json.tool | head -60

7. Conclusion

In this lab we have covered phishing simulation with Gophish from start to finish: installation, SMTP profiles, realistic templates and landing pages, segmented groups, campaign launches and metrics analysis through the panel and the API. The platform turns the human factor into a manageable indicator, and its zero cost makes it accessible even to small teams. Security managers should integrate the simulation with a continuous training program, use the data to prioritize and, above all, treat employees as allies: the goal is to reduce the click, not to punish whoever makes a mistake. Finally, always retain the campaign results and the evidence of each authorized exercise, so that the operation of the program remains reproducible and auditable in the long term. As a next step, we recommend automating reports with scripts that cross-reference the Gophish API with the department inventory and linking the campaigns with the rest of the awareness exercises (telephone social engineering, USB drop tests), because the human factor is trained as a whole, and that training starts with a well-planned phishing simulation with Gophish. To go deeper, we recommend the official documentation at docs.getgophish.com, the source code at github.com/gophish/gophish and the industry data from the Anti-Phishing Working Group (APWG), which publishes quarterly trends of the real attacks that we should use to design our training scenarios.

Related articles: running a phishing campaign with Gophish in practice and understanding DNS spoofing attacks and their link to phishing.

Need help with Phishing simulation with Gophish?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.

Contact us for a free infrastructure assessment.