Beware of Scams
Important warning about fake “compliance” and “renewal” emails
If you recently received an “urgent” or “compliance” email, or a message through your website’s contact form, claiming to be from us, the message is a scam.
It was not sent by us.
If you received the message as a direct email, please report it using the reporting tools in your email product, and forward it to the UK’s National Cyber Security Centre at report@phishing.gov.uk. If it was received by a contact form on your website, please report it to Squarespace by clicking on the “Report it here” link at the end of the message.
There are currently a lot of scam messages being sent to website owners, claiming their website is “non-compliant”, requires a “compliance setup”, “compliance licence key”, or urgent action to avoid service interruption. There is no such thing as a “compliance licence”. All these messages and emails are scams.
These messages may be sent by email or received through your website’s contact form.
They are not sent by Squarespace, and they are not sent by us - or any other legitimate Squarespace designers, Circle members, or Certified Partners.
What this scam looks like
Scam emails are becoming increasingly sophisticated and convincing. They often:
Pretend to be from a Certified Squarespace Partner (like us) or your own website designer
Use friendly, reassuring language and sign off with a real designer’s name
Use personal gmail accounts that a real designer would not use. For example, several scams have used gmail accounts based on our trading name. For example, some of the scam email addresses include contactpaulst.digital@gmail.com and contact.pauldigital@gmail.com.
Claim Squarespace has performed an “internal review”
Say your site is not compliant with something
Create urgency by warning of suspension or disruption
Ask for payment for things that don’t exist, like a:
“Compliance setup”
“Compliance license key”
Some examples of the wording of these scam emails can be found at the end of this article.
Clear and simple truth
Here is the most important thing to understand:
We do NOT use personal gmail accounts to communicate with our customers.
Squarespace does NOT send compliance warnings via third-party designers.
There is no such thing as a “compliance licence”.
If your website genuinely required action, you would see the issue when you log on to your Squarespace dashboard.
Why these emails feel so personal
This scam is particularly upsetting because it:
Impersonates real designers, like us, using their names, logos and/or photos
Targets existing clients
Uses email addresses that contain the designers company or own name (often using personal @gmail.com addresses)
Follows up repeatedly if you reply
Sends invoices to increase pressure
Many designers, myself included, are spending a significant amount of time each week reassuring clients that these emails are not from us. It impacts trust, reputation, and peace of mind.
If you received one of these emails, you did nothing wrong. These are organised impersonation scams, not a reflection of your judgement.
How to spot the scam quickly
Criminals are experts at impersonating people. They spend hours researching you for their scams, hoping you’ll let your guard down for just a moment. Stop and think. It could protect you and your money.
These are strong red flags:
The message creates urgency or fear. It’s OK to reject, refuse or ignore any requests. Only criminals will try to rush or panic you.
The email comes from an @gmail.com or generic email address - not a company domain
The sender claims to be someone who is familiar with you
You’re asked to pay outside of Squarespace, using a service like “GoFlex”, based in Nigeria
The tone doesn’t match how your real designer communicates
You’re asked to grant site access to “fix compliance issues”
If anything feels off, trust that instinct.
What to do if you receive one of these emails
1. Be wary
Be wary of unexpected requests for urgent payments. Check the sender’s email address. Always confirm details using the contact information you have on file.
2. Do not click on links. Do not reply.
Engaging encourages further messages and may lead to malicious websites.
3. Do not pay
No legitimate Squarespace fee would be handled via an unexpected email or by a foreign payment platform like “GoFlex”.
4. Do not grant access
Granting Administrator access can give full control of your website and customer data. Never grant access to someone who contacts you unexpectedly.
5. Report the email
This is critical. Volume of reports matters.
Report the emails by using the phishing and spam buttons built into your email inbox - whichever email product you use.
Report the emails by forwarding them to law enforcement. You can forward them to the National Cyber Security Centre in the UK and to the Internet Crime Complaint Center (IC3) in the US.
If the email purports to be from Squarespace themselves, report it to Squarespace by forwarding it to phishing-report@squarespace.com
5. If money was lost, file a report
If you or someone you know paid a scammer, report this immediately to your bank or credit card provider to have the payment stopped. You should also report the crime to law enforcement because the bank will not do this on your behalf.
If you’re unsure, pause and ask
If you ever receive an unexpected message about your website:
Pause
Do not click links
Do not rush
Contact your real designer or Squarespace directly using known contact details
A genuine professional will never pressure you to act immediately or punish you for asking questions.
Why this page exists
This page is published as a public warning.
People affected by these scams often paste exact phrases from the emails into Google searching for reassurance. My hope is that this page helps those people find clarity, avoid financial loss, and feel supported rather than panicked.
The scammers are not just targeting clients of Squarespace designers; they are also targeting users of other website platforms including Wix and WordPress.
If, by sharing this information, we help even one person avoid being scammed, it’s worth it.
Please help spread awareness
If you know someone with a Squarespace website, or you’ve seen these emails circulating, feel free to share this page with them.
The more visible accurate information becomes, the harder it is for scammers to succeed.
Other useful information
Here are some other useful resources for anyone based in the UK:
Stop! Think fraud (UK Government)
Friends against scams (UK Trading Standards)
National Cyber Security Centre (part of GCHQ)
Report Fraud - previously Action Fraud (run by the City of London Police)
Examples of scam emails
Here are some of the phrases being used in these scam emails:
“While reviewing the work from our previous project, I noticed that the Compliance License Key on your Squarespace site was installed but not fully configured.
To clarify — installation and full configuration are two separate steps. The key was added correctly, but certain backend validation elements sometimes require an additional compliance pass to ensure everything is fully active and logging properly.
Over time, platform updates and regulatory changes can also affect how these tools function, which is why periodic verification is important.
Why This Matters
A fully configured Compliance License Key enables important functions such as:
• Accurate cookie-consent banners and user-preference tools that meet GDPR, CCPA, and other privacy requirements
• Secure logging and storage of user-consent records
• Automatic updates to scripts and compliance settings as regulations evolve
Risks of Leaving It Incomplete
If the configuration remains unfinished:
• Your site may fall short of regional or international privacy standards
• Consent-tracking tools may not operate correctly
There is a higher risk of compliance issues that could affect credibility or introduce legal exposure
Recommended Next Steps
To ensure full compliance and optimal site performance, I recommend completing the configuration process. Since the key is already installed, I can:
• Finalize all setup and validation steps
• Perform a full compliance audit to ensure everything is functioning properly
Kindly let me know when you’d like me to proceed. Completing this setup will help ensure your website remains secure, compliant, and aligned with current best practices.”
“I hope you're doing well.
I need to bring an urgent matter to your attention regarding your Squarespace website. During a review of the previous project, it became clear that while the Compliance License Key is installed, it has not yet been fully configured at the backend. Because of this, several critical compliance enforcement mechanisms remain inactive — even though the cookie banner is visible on the site.
It's important to note: compliance is determined by technical enforcement, not appearance. A visible banner alone does not guarantee that your website meets GDPR, CCPA, or other regulatory standards.
Why This Matters
A fully configured Compliance License Key ensures that:
Cookie-consent banners and user-preference tools operate accurately and align with privacy regulations
Consent records are securely logged and retrievable
Scripts are conditionally executed only after confirmed consent
Compliance scripts remain up-to-date as regulations evolve
Currently, non-essential scripts may be executing before visitor consent is confirmed, and there is no clear evidence of a verifiable consent log. This exposes the site to:
Regulatory scrutiny during audits or complaints
Legal exposure if visitor data is processed improperly
Reputational risk if users perceive mishandling of data
Google visibility issues, as incomplete configuration and metadata errors can negatively affect how your site appears in search results”
“We have detected an unauthorized activity on your website that requires immediate attention to avoid account termination and legal escalation.
Kindly reply to this email to receive further details and guidance on how to resolve this compliance issue.”
“I wanted to share an important update I just received from Squarespace Support following their internal review yesterday. They've confirmed that your website is not fully aligned with the latest Squarespace platform requirements, and both your domain and connected extensions/plugins need to be renewed before [date].”
“If these items aren't renewed in time, your website may be flagged for non-compliance. In more serious cases, this could lead to temporary or even permanent downtime.”
“To avoid any disruption to your online presence and ensure everything remains secure and fully functional, it's important that we take action as soon as possible.”
“Since I manage your website, I wanted to notify you right away so we can handle this promptly.”
“I noticed that the Compliance License Key on your Squarespace site was installed but not fully configured.”
“To proceed with the full configuration and compliance audit, I’ll need access to your site again.”
“Squarespace has recently rolled out important platform and security updates that could impact how your site performs. Many websites are now showing hidden compliance or performance issues that may lead to disruptions if not addressed promptly.”
“I’m conducting professional compliance and security reviews to ensure each site stays protected, fully functional, and aligned with the latest Squarespace standards. This process verifies key security settings, licenses, and overall performance-keeping your website running smoothly and avoiding unexpected downtime.”
“Squarespace is reviewing every site for security settings, license validation, and robots. txt accuracy. Sites that fail these checks can face restrictions or removal without notice.”
“I'm reaching out with an urgent update that directly impacts your Squarespace website.”
“Squarespace has recently begun platform-wide technical reviews, focusing on:
Website configuration and license verification
Search engine access and visibility settings
Template and integration optimization
Security and performance standards”
“Any site that does not meet these requirements may face issues such as restricted visibility, search ranking losses, or even temporary downtime — often without prior notice.”
“During a recent review, I identified critical issues that will impact your website's traffic, visibility, and stability. If not addressed immediately, your site is at risk of being flagged or temporarily suspended. The issues include broken links, outdated integrations, and missing updates all of which are currently affecting your website's performance and overall user experience. Delaying action increases the likelihood of disruption, lost traffic, and reputational damage.”
“I have a ready-to-implement action plan to resolve these issues promptly. Please reply to this email immediately so we can begin implementing the necessary fixes today and protect your website from serious consequences.”
“After reviewing your Squarespace site, I noticed a few opportunities to improve its SEO performance and overall optimization. With some targeted adjustments, we can:
Help your site rank higher on search engines
Attract more qualified visitors
Improve loading speed and user experience
Increase conversions by guiding visitors smoothly through the site”
“If you'd like me to begin your review and make sure your site is fully up to date, simply reply "YES", and I'll get started right away.”
“We have identified critical security issues associated with your Squarespace website. Our monitoring systems have detected potentially malicious scripts, unsafe external redirects, and unauthorized third party injections within your site configuration.
ACCOUNT STATUS: Blacklisted
SECURITY LEVEL: Critical - Immediate Action Required
REASON: Unsafe external activity detected within site settings and/or third-party integrations”
“Site visitors may be exposed to phishing attempts, malware, or potential data compromise.”
“Your domain and email reputation may be flagged or blacklisted by browsers and search engines.”
“Failure to resolve this issue within 48 hours may result in temporary suspension and service disruption.”
“If you'd like me to begin your review and make sure your site is fully up to date, simply reply "YES", and I'll get started right away.”
“To prevent immediate suspension, reply "LIVE SUPPORT" to be connected with a Security Specialist within 15 minutes.”
“Squarespace has recently begun platform-wide compliance reviews for all hosted websites. These reviews include security configuration checks and license verifications. Websites that do not meet the updated standards may face restricted access or temporary suspension.”
“Squarespace is aligning with major global accessibility regulations, including the European Accessibility Act (EAA), American Accessibility Act (AAA), and Australian Accessibility Terms (AAT).”
“Sites that do not meet the updated standards risk restricted access or even temporary suspension.”
“Squarespace is aligning with the European Accessibility Act (EAA), American Accessibility Act (AAA), and Australian Accessibility Terms (AAT).”
“I took a quick look at yours and spotted a few things most owners usually miss especially around how pages are structured for SEO and conversions. I can break it down for you in a short audit video so you can see exactly what's happening on your site.”