Clone UIs reverse the order on purpose: password form first, verification “later.” If a page wants your password before you can check a canary or phrase, leave.
Wallet seeds are never a “support recovery” step. Guide: Anti-phishing checklist.
PGP and phrase before password — non-negotiable
Clone UIs reverse the order on purpose: form first, verification “later.”