How to Install GoPhish - Free Phishing Simulation Tool

GoPhish is an open-source phishing simulation framework that helps security teams test how users respond to simulated phishing emails. It provides a web-based interface for creating target groups, email templates, landing pages, phishing simulation campaigns, and reports.

In this guide, we will install GoPhish from scratch on Linux and walk through the complete setup process. We will also create a safe test campaign, configure SMTP with Mailpit, review campaign results, export reports, configure email reporting, test webhooks, and use the GoPhish API.

The guide is designed for beginners, so each step explains what we are doing and why.

Important: GoPhish should only be used for authorized phishing simulations, security awareness exercises, or controlled security testing.

GoPhish provides precompiled releases for Linux, Windows, and macOS. The official project describes the installation process as downloading the appropriate release, extracting it, and running the binary.

What Is GoPhish?

GoPhish is a free and open-source phishing framework designed for businesses, penetration testers, and security professionals.

It allows security teams to create phishing simulation campaigns and measure user actions such as email opens, link clicks, submitted data, and reported emails. Campaigns are built around reusable components such as target groups, sending profiles, email templates, and landing pages.

GoPhish can be useful for security awareness testing because it provides control over both campaign creation and reporting without requiring a commercial phishing simulation platform.

GoPhish Lab Environment

For this guide, we used the following test environment:

Operating System: Kali GNU/Linux Rolling

Architecture: x86_64

GoPhish Version: 0.12.1

GoPhish v0.12.1 is the latest release listed on the official GitHub releases page, and it was published in September 2022. The project has not shipped a new release since then, so anything you deploy today you also maintain yourself, including patching the environment around it.

How to Install GoPhish on Linux

Download GoPhish

Go to the official GoPhish release page and select the correct package for your operating system.

For our 64-bit Linux system, we downloaded GoPhish v0.12.1 with:

     
       

         

           $ wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
          

       
     
      Copy
    

After the download is complete, verify that the file exists:

     
       

         

           $ ls -lh
          

       
     
      Copy
    

Verify the Downloaded File

Before extracting a downloaded security tool, it is good practice to verify its checksum.

Run:

     
       

         

           $ sha256sum gophish-v0.12.1-linux-64bit.zip
          

       
     
      Copy
    

Compare the value you calculate with the checksum published for that release on the official GoPhish releases page. The two must match exactly before you run the binary.

Compare the calculated checksum with the value published for the official release.

This step helps confirm that the file you downloaded matches the expected release before you execute it.

Extract GoPhish

Create a directory for GoPhish:

     
       

         

           $ mkdir gophish
          

       
     
      Copy
    

Extract the ZIP archive:

     
       

         

           $ unzip gophish-v0.12.1-linux-64bit.zip -d gophish
          

       
     
      Copy
    

Then enter the directory:

     
       

         

           $ cd gophish
          

       
     
      Copy
    

Check the directory contents:

     
       

         

           $ ls -la
          

       
     
      Copy
    

You should see files and directories such as:

     
       
Output:
       

         config.json
       

         db
       

         gophish
       

         LICENSE
       

         README.md
       

         static
       

         templates
       

         VERSION
       

     

    

The gophish file is the application binary, while config.json controls important settings such as the administration server, phishing server, database, and logging.

Understand the Default GoPhish Configuration

Before starting GoPhish, check the default configuration:

     
       

         

           $ cat config.json
          

       
     
      Copy
    

In our installation, the important settings were:

     
       
Output:
       

         "admin_server": {
       

             "listen_url": "127.0.0.1:3333",
       

             "use_tls": true
       

         },
       

         "phish_server": {
       

             "listen_url": "0.0.0.0:80",
       

             "use_tls": false
       

         }
       

     

    

The administration interface and phishing server have different purposes.

The administration interface runs on:

     
       
Output:
       

         https://127.0.0.1:3333
       

     

    

This is where campaigns, users, templates, and reports are managed.

The phishing server listens on:

     
       
Output:
       

         0.0.0.0:80
       

     

    

This server provides campaign landing pages and tracking URLs.

GoPhish also uses SQLite by default, so a separate MySQL or PostgreSQL installation is not required for a basic setup.

Check Whether Port 80 Is Already in Use

Before starting GoPhish, check whether another application is using ports 80 or 3333:

     
       

         

           $ ss -ltnp | grep -E ':(80|3333)\b'
          

       
     
      Copy
    

During our installation, Apache2 was already listening on port 80.

This would prevent the GoPhish phishing server from starting because both applications would try to use the same port.

Since Apache was not required for this lab, we stopped it:

     
       

         

           $ systemctl stop apache2
          

       
     
      Copy
    

Then verified the port again:

     
       

         

           $ ss -ltnp | grep -E ':(80|3333)\b'
          

       
     
      Copy
    

If you need Apache or Nginx on the same server, another option is to change the GoPhish phishing server port in config.json.

Fix GoPhish Permission Denied Error

When we first tried to start the binary:

     
       

         

           $ ./gophish
          

       
     
      Copy
    

the shell returned:

     
       
Output:
       

         permission denied: ./gophish
       

     

    

The file did not have executable permission.

Check the permissions with:

     
       

         

           $ ls -l gophish
          

       
     
      Copy
    

Then add executable permission:

     
       

         

           $ chmod +x gophish
          

       
     
      Copy
    

Run GoPhish again:

     
       

         

           $ ./gophish
          

       
     
      Copy
    

On the first run, GoPhish also initializes its SQLite database and performs the required database migrations.

Start GoPhish for the First Time

After the migrations are complete, GoPhish starts both servers.

The terminal output should include information similar to:

Starting phishing server at http://0.0.0.0:80

Starting admin server at https://127.0.0.1:3333

GoPhish versions after v0.10.1 print temporary administrator credentials in the startup logs for the initial login.

Do not publish the temporary administrator password in screenshots or documentation.

You can verify the listening ports in another terminal:

     
       

         

           $ ss -ltnp | grep -E ':(80|3333)\b'
          

       
     
      Copy
    

How to Log In to GoPhish

Open a browser on the GoPhish server and navigate to:

     
       
Output:
       

         https://127.0.0.1:3333
       

     

    

Because the default administration interface uses a self-signed certificate, your browser may display a certificate warning.

In our isolated lab environment, we continued to the local GoPhish administration interface.

The login username is:

     
       
Output:
       

         admin
       

     

    

Use the temporary password displayed in the GoPhish startup terminal.

After signing in for the first time, change the administrator password immediately.

The Account Settings page also contains the GoPhish API key. Treat this API key like a password and do not expose it in screenshots, repositories, tickets, or public documentation. GoPhish allows administrators to reset the API key from this page.

After changing the password, the Dashboard is ready to use.

Understanding the GoPhish Dashboard

The GoPhish Dashboard provides access to the main components required for a phishing simulation.

The most important sections are Campaigns, Users & Groups, Email Templates, Landing Pages, and Sending Profiles.

A basic campaign follows this structure:

Target Group

+

Sending Profile

+

Email Template

+

Landing Page

↓

Campaign

↓

     
       
Output:
       

         Results
       

     

    

We will configure each component before launching the first campaign.

Create a Target Group in GoPhish

Go to:

Users & Groups → New Group

Create a group name. For our test environment, we used:

Keepnet GoPhish Lab

Add a test recipient with a first name, last name, email address, and position.

Click Add to add the recipient to the group, and then click Save Changes.

The group will now appear under Users & Groups.

GoPhish manages campaign recipients through groups, and a group can contain one or more recipients. For production phishing simulations, only use recipients that are within the approved scope of the security awareness exercise.

Configure SMTP for GoPhish

GoPhish requires an SMTP server to send campaign emails. These SMTP settings are configured under Sending Profiles.

For this guide, we used Mailpit instead of sending emails over the Internet.

Mailpit is an open-source SMTP testing tool that captures email locally and provides a browser-based inbox. By default, Mailpit uses port 1025 for SMTP and port 8025 for its web interface.

This is useful when learning GoPhish because no real phishing simulation email needs to leave the lab environment.

Install Mailpit

Install Mailpit using its installation method for your Linux environment.

After installation, start it:

     
       

         

           $ mailpit
          

       
     
      Copy
    

Our Mailpit instance started with:

     
       
Output:
       

         SMTP: 1025
       

     

    

Web UI: 8025

Verify the ports:

     
       

         

           $ ss -ltnp | grep -E ':(1025|8025)\b'
          

       
     
      Copy
    

Open the Mailpit interface:

     
       
Output:
       

         http://127.0.0.1:8025
       

     

    

Create a GoPhish Sending Profile

Go to:

Sending Profiles → New Profile

For our local test environment, we configured:

Name: Keepnet Local Mailpit

SMTP From: security-lab@example.test

Host: 127.0.0.1:1025

Username and Password: left empty, because a local Mailpit instance does not require authentication. A production SMTP relay will need real credentials here.

Ignore Certificate Errors: Disabled

GoPhish requires the SMTP host in host:port format and the From value should use a valid email address format.

Before saving the profile, click Send Test Email.

If the SMTP configuration works, Mailpit should receive the message.

Opening the message confirms that the GoPhish → SMTP → Mailpit connection is working correctly.

You can now save the Sending Profile.

Create an Email Template

Go to:

Email Templates → New Template

We created the following test template:

Name:

Keepnet Awareness Lab Template

Subject:

Security Awareness Training - Action Required

For the text version:

Hello {{.FirstName}},

This is an authorized security awareness simulation.

Please visit the training page using the link below:

     
       
Output:
       

         {{.URL}}
       

     

    

Regards,

Security Awareness Team

GoPhish template variables allow campaign content to be personalized.

For example:

     
       
Output:
       

         {{.FirstName}}
       

     

    

is replaced with the recipient's first name.

The variable:

     
       
Output:
       

         {{.URL}}
       

     

    

is replaced with the recipient-specific campaign URL.

For HTML messages, the URL can be used as a clickable link:

     
       
Output:
       

         <a href="{{.URL}}">Open Security Awareness Training</a>
       

     

    

GoPhish provides an HTML editor that allows users to switch between source code and visual editing.

We also enabled Add Tracking Image so the test could demonstrate email-open tracking.

After saving, the template appears in the Email Templates page.

Create a Landing Page

The landing page is the page users see after clicking the campaign link.

Go to:

Landing Pages → New Page

For this guide, we created a safe security awareness page instead of a credential collection page.

Our page explains that the user has reached an authorized phishing awareness simulation and provides basic advice for checking suspicious links.

We intentionally left Capture Submitted Data disabled because this demonstration does not need to collect usernames, passwords, or other user information.

After saving, the page appears under Landing Pages.

How to Launch Your First GoPhish Campaign

At this point, all required components are ready.

Go to:

Campaigns → New Campaign

For our lab, we configured:

Name:

Keepnet Awareness Lab Campaign

Email Template:

Keepnet Awareness Lab Template

Landing Page:

Keepnet Awareness Training Page

URL:

http://192.168.56.102

Sending Profile:

Keepnet Local Mailpit

Group:

Keepnet GoPhish Lab

The URL field is important.

It should point to the GoPhish phishing server and must be reachable by the recipient.

In our lab, GoPhish was running on:

192.168.56.102

so we used:

http://192.168.56.102

Opening this address directly without a campaign recipient ID returned:

404 page not found

This is expected because the recipient-specific campaign URL contains additional tracking information.

After checking the settings, click Launch Campaign.

GoPhish campaigns send messages to one or more target groups and monitor events such as email opens and clicked links.

Understanding GoPhish Campaign Results

After launching the campaign, the Results page begins displaying events.

The first event in our test was:

     
       
Output:
       

         Email Sent: 1
       

     

    

The campaign message also appeared in Mailpit.

Opening the message displayed the personalized recipient name and the campaign link.

After opening the message and clicking the link, the GoPhish results changed to:

     
       
Output:
       

         Email Sent: 1
       

         Email Opened: 1
       

         Clicked Link: 1
       

         Submitted Data: 0
       

         Email Reported: 0
       

     

    

The landing page was also successfully displayed.

Because data capture was disabled, Submitted Data correctly remained at zero.

Email-open statistics should also be interpreted carefully. Image blocking, privacy features, or image proxying in modern email clients can affect open-tracking accuracy.

View the Recipient Event Timeline

GoPhish also provides detailed event history for individual recipients.

Expand a recipient in the campaign Results page.

In our test, the timeline showed:

     
       
Output:
       

         Campaign Created
       

         Email Sent
       

         Email Opened
       

         Clicked Link
       

     

    

It also recorded basic browser information for the click event.

This view is useful when investigating the exact sequence of actions performed during a simulation.

Export GoPhish Campaign Reports

GoPhish allows campaign data to be exported from the Results page.

Click:

Export CSV

Two useful options are available:

     
       
Output:
       

         Results
       

         Raw Events
       

     

    

The Results export gives a recipient-level summary.

The Raw Events export provides individual campaign events and timestamps.

Raw event data can be useful when campaign information needs to be analyzed in Excel, a reporting platform, or another security analytics system.

The GoPhish ecosystem also supports report generation through its API and community reporting tools.

When the campaign is finished, click Complete.

Completing a campaign stops GoPhish from processing additional events for that campaign. It does not delete the existing results.

Configure Email Reporting in GoPhish

Clicking links is not the only useful security awareness metric.

Users who correctly identify and report suspicious messages can also provide valuable information about the effectiveness of a phishing awareness program.

GoPhish supports server-side email reporting through IMAP.

Go to:

Account Settings → Reporting Settings

Configure an IMAP mailbox that GoPhish can monitor.

For our isolated lab, we used a local Dovecot IMAP server.

Our configuration used:

IMAP Host: 127.0.0.1

IMAP Port: 993

IMAP Username: gophish-report

Use TLS: Enabled

     
       
Output:
       

         Folder: INBOX
       

     

    

Because our lab IMAP server used a self-signed certificate, Ignore Certificate Errors was enabled for this local test only.

In production, certificate verification should normally remain enabled.

Click Test Settings.

After the reported campaign email was placed in the monitored mailbox, GoPhish detected it and updated the campaign:

     
       
Output:
       

         Email Reported: 1
       

     

    

The reporting event also appeared in the campaign timeline.

This allows organizations to measure positive user behavior, not only risky actions such as clicking.

How to Use GoPhish Webhooks

GoPhish webhooks provide real-time campaign event notifications.

When an event occurs, GoPhish can send an HTTP request containing JSON data to an endpoint you control. Webhook requests can also be signed, and multiple webhooks can be configured.

Go to:

Webhooks → New Webhook

For our local test:

Name:

Keepnet Local Webhook

URL:

http://127.0.0.1:9000/webhook

Is Active:

Enabled

After saving, the webhook appears in the Webhooks page.

GoPhish includes a Ping button that makes it easy to test connectivity before running a campaign.

Our local webhook receiver successfully received the test POST request and returned HTTP 200.

During a real test campaign, the receiver received events including: Campaign Created, Email Sent, Clicked Link

A link-click event included additional information such as the campaign ID, recipient, tracking ID, source address, and browser user-agent.

Webhooks can be useful when integrating GoPhish with internal dashboards, automation workflows, SIEM systems, or other security tools.

How to Use the GoPhish API

GoPhish also provides a JSON API for automation and reporting. The official documentation covers campaigns, groups, templates, landing pages, sending profiles, and other GoPhish resources.

The API key is available under:

Account Settings

Never publish a real production API key.

We stored our lab API key in an environment variable and requested the campaign list:

     
       

         

           $ curl -sk \
          

       
     
      Copy
    

     
       
Output:
       

           -H "Authorization: Bearer $API_KEY" \
       

     

    

https://127.0.0.1:3333/api/campaigns/

The API returned all campaigns created during our test.

GoPhish can also return a campaign summary.

For example:

     
       

         

           $ curl -sk \
          

       
     
      Copy
    

     
       
Output:
       

           -H "Authorization: Bearer $API_KEY" \
       

     

    

https://127.0.0.1:3333/api/campaigns/3/summary \

     
       
Output:
       

           | python3 -m json.tool
       

     

    

Our campaign summary returned:

     
       
Output:
       

         {
       

             "stats": {
       

                 "total": 1,
       

                 "sent": 1,
       

                 "opened": 1,
       

                 "clicked": 1,
       

                 "submitted_data": 0,
       

                 "email_reported": 0,
       

                 "error": 0
       

             }
       

         }
       

     

    

The API is especially useful when GoPhish results need to be integrated with automated reports or internal security tools.

Common GoPhish Problems and Solutions

GoPhish Says “Permission Denied”

If you see:

     
       
Output:
       

         permission denied: ./gophish
       

     

    

check the executable permission:

     
       

         

           $ ls -l gophish
          

       
     
      Copy
    

Then run:

     
       

         

           $ chmod +x gophish
          

       
     
      Copy
    

Try again:

     
       

         

           $ ./gophish
          

       
     
      Copy
    

GoPhish Says Port 80 Is Already in Use

Check which process is using the port:

     
       

         

           $ ss -ltnp | grep ':80'
          

       
     
      Copy
    

If Apache is running and is not required:

     
       

         

           $ systemctl stop apache2
          

       
     
      Copy
    

Alternatively, change the phish_server port in config.json.

The Browser Shows a Certificate Warning on Port 3333

The GoPhish administration interface uses TLS and may initially use a self-signed certificate.

This can cause a browser warning in a local installation.

For production environments, use a properly trusted TLS certificate and keep the administration interface protected from unnecessary public access.

GoPhish Is Not Sending Emails

Go to:

Sending Profiles → Send Test Email

Check the SMTP host, port, From address, authentication details, and TLS settings.

Testing the Sending Profile before launching a campaign can prevent many common email-delivery problems.

The Campaign URL Shows 404

A GoPhish campaign link contains a recipient-specific tracking ID.

Opening only the base phishing server URL may return:

404 page not found

Verify that the URL configured in the campaign points to the correct GoPhish phishing server and that the recipient can reach it.

GoPhish Security Best Practices

When using GoPhish, keep the administration interface restricted, change the temporary administrator password immediately, protect the API key, use trusted TLS certificates in production, use only approved recipients, avoid collecting sensitive credentials unless the assessment specifically requires it, and always run phishing simulations with written authorization.

It is also a good idea to separate testing infrastructure from production systems and review collected campaign data according to your organization's privacy and retention policies.

Why Do Organizations Consider Keepnet Instead of GoPhish?

GoPhish provides a flexible open-source framework, but teams are responsible for configuring and maintaining much of the surrounding infrastructure themselves. This can include SMTP delivery, phishing domains, templates, reporting workflows, integrations, and infrastructure maintenance.

Keepnet's Phishing Simulator provides a managed alternative with ready-to-use simulation content, reporting capabilities, and additional social engineering simulation options within the wider Keepnet platform.

For security researchers and teams that want full control over their lab environment, GoPhish can be a useful open-source option. Organizations looking for a managed phishing simulation program may prefer a platform that reduces the infrastructure and operational work required to run simulations.

Source: GoPhish official releases page. Version and release date verified on 16 August 2026.

Conclusion

GoPhish can be installed quickly, but a complete phishing simulation requires more than simply running the application.

You need to configure recipients, SMTP delivery, email templates, landing pages, campaign URLs, and reporting before launching a useful simulation.

In this guide, we installed GoPhish from scratch, configured a safe local SMTP environment, created a complete awareness campaign, tracked user interactions, exported results, configured email reporting, tested webhooks, and queried campaign data through the GoPhish API.

This provides a practical foundation for understanding how GoPhish works and how its main components fit together in an authorized phishing simulation environment.

Editor's Note: This article was updated on March 12, 2026.

If you’re a penetration tester or a security researcher, you should watch advanced phishing simulation integration with Evilginx2.

Watch Keepnet’ “Hack Smarter, Not Harder Webinar” Webinar on YouTube below and learn how to automate social engineering tests, including Email Phishing, SMS Phishing, Voice Phishing, QR Code, MFA Phishing, and Callback Phishing, and reduce social engineering test times from days to minutes.

What Better Program Design Looks Like

Install GoPhish - Free Phishing Simulation Tool works best when the content reflects how people actually make decisions. Strong programs do not try to teach everything at once. They focus on the few behaviors that create the most risk, then reinforce them with current examples, timely reminders, and clear reporting paths.

That is also what makes training easier to defend internally. When a program changes behavior, reduces repeat-risk patterns, or improves reporting quality, leaders can see how awareness supports real business outcomes instead of acting like a standalone compliance activity.

Keepnet teams usually see the biggest gains when training is tied to a reporting path and a follow-up workflow. For most organizations, the common mistake is treating install gophish - free phishing simulation tool as content delivery instead of behavior design.

Program Checklist

• Choose the user decisions that matter most instead of covering every possible topic.
• Use short modules, current examples, and realistic follow-up after incidents or simulations.
• Measure reporting, repeat risk, and remediation behavior, not only completions.
• Give managers and team leads a role in reinforcing the habits you want to build.