A customer calls to say they got a strange message from your company address. Or your bookkeeper forwards a bounce for an email nobody in the office wrote. The first reaction is usually “the website has been hacked”, and sometimes that is true. Just as often the website is fine and the problem is a mailbox, or nobody’s account has been touched and someone is simply faking your address.
These are three different problems with three different fixes. Treating one as another wastes time and leaves the real hole open. This post explains how to tell them apart from the clues you already have.
Why the two get confused
Your website and your email share one thing: the domain name. When someone sees info@yourbusiness.com they think of the same business as yourbusiness.com, and so do most owners. Underneath, the two are usually separate systems.
- The website runs on a web host, often WordPress on a shared or managed server.
- The mailboxes often run somewhere else entirely, such as Google Workspace, Microsoft 365, Zoho Mail, or the mail service that came with the hosting plan.
- The DNS records for the domain decide where web traffic and email each go.
If you are unsure how your own setup is arranged, our explainer on what business email is and how it differs from free addresses is a good starting point. Once you know where each piece lives, the clues below make much more sense.
The three situations
1. A mailbox has been taken over
Someone has the password (or a session) for a real mailbox on your domain. They can read mail, send as that person, and quietly set up rules. The website may be completely untouched.
2. The website or server has been hacked and is sending mail
Malicious code on the site uses the server to send messages, usually spam or phishing. The mailboxes themselves may be fine. Your staff’s inboxes show nothing unusual, but the host or a blocklist starts complaining.
3. Nobody has been hacked; your address is being spoofed
Email lets a sender write any “From” address. Spammers often put a real company’s domain in that field. No account of yours is involved, but you still see the side effects, such as bounces and confused replies.
Clues that point to a hacked mailbox
These signs live inside the email account itself:
- Sent messages you did not write. Check the Sent folder of the affected person. If the strange messages are in there, they were sent from the account, not just faked.
- New forwarding or filter rules. Attackers commonly add a rule that forwards copies of incoming mail elsewhere, or moves replies about invoices into a folder the owner never opens. Look in the mailbox settings for forwarding, filters and rules you did not create.
- Sign-in alerts from your provider. Google and Microsoft both show recent sign-in activity for an account and send alerts about unusual sign-ins. Unfamiliar locations or devices are a strong signal.
- Payment change requests going out. A classic pattern is a reply in an existing invoice thread asking the customer to pay into “our new bank account”. If customers mention that, treat the mailbox as compromised.
- Only one person affected. When the odd mail always comes from one specific address, and other staff addresses are quiet, the problem is likely that one mailbox.
Clues that point to a hacked website
When the website is the source, the signals come from the hosting side rather than from anyone’s inbox:
- A warning from your host about outgoing spam, a mail limit being reached, or a suspended mail function.
- Bounces for addresses that do not exist on your domain, such as random names before the @ sign, especially if the host’s mail queue is full of them.
- Your server’s IP address on a blocklist, which can make even your genuine website emails (order confirmations, contact form notices) start failing.
- Other website symptoms at the same time: spam pages in Google, odd redirects, unknown admin users, or files you do not recognise.
- Clean mailboxes. Nobody’s Sent folder shows the spam, because it never went through the mailboxes at all.
A hacked site that sends mail usually does it through a dropped PHP mailer script or by abusing a form. That is a website cleanup job, not an email one. Our page on stopping a website that is sending spam email covers how that is tracked down and stopped.
Clues that point to spoofing
Spoofing leaves a particular pattern:
- You get bounce messages for emails nobody sent, but there is nothing in any Sent folder and the host reports no unusual outgoing mail.
- The bounced messages, when you open the original headers, show they came from servers that have nothing to do with your provider or your host.
- Recipients say the message “came from you” but the display name or reply-to address is slightly off.
Spoofing is not a breach of your systems, but it does point to a gap in your domain’s email records. The usual defence is having SPF, DKIM and DMARC records set up correctly in DNS, so receiving mail servers can tell real mail from forgeries. Google Workspace, Microsoft 365 and most other mail providers publish setup help for these records in their own documentation.
A quick way to sort it out
If you only have ten minutes, work through these in order:
- Open one of the suspicious messages and look at the headers. In Gmail this is “Show original”; in Outlook it is under message properties or “View source”. The “Received” lines show which servers handled the message. If they show your mail provider and the account in question, it was sent from the mailbox. If they show your web server’s hostname, the site sent it. If they show a server you have never heard of, it is probably spoofed.
- Check the Sent folder of the address that appears in the “From” line.
- Check mailbox rules and forwarding for that address.
- Check the hosting panel for mail queue warnings, outgoing mail limits, or emails from the host about abuse.
- Check the website for the usual hack signs: unknown admins, recently changed files, Google warnings.
Headers can look intimidating, but you do not need to understand every line. You are only looking for which server the message started from.
When both are hacked
Sometimes the answer is “both”, and the order they happened in matters. A few common chains:
- Email first, then website. The attacker gets into the mailbox that receives WordPress password resets or hosting account emails. From there they reset the WordPress admin password or log in to the hosting panel. If a hacked mailbox is the one your site sends reset links to, assume the site needs checking too.
- Website first, then email. Some sites keep SMTP credentials in plugin settings or configuration files so the site can send mail through a real mailbox. If the site is compromised, those credentials can be read and used to log in to that mailbox.
- Shared password. The same password was used for the mailbox, WordPress and the hosting panel. Once one leaked, all of them were open.
In any of these, fixing one side and ignoring the other means the attacker walks back in through the door you did not close.
What to do for a hacked mailbox
This is mainly an email provider task:
- Change the password from a device you trust, and sign out all other sessions if your provider offers that.
- Remove any forwarding, filters or rules you did not create.
- Turn on two-step verification for the account.
- Check connected apps and app passwords in the account’s security settings and remove ones you do not recognise.
- Warn customers who may have received a fake payment request, by phone if possible, so they do not reply to the same thread.
- Review whether that mailbox receives password resets for other services, and change those passwords too.
If your business email was set up in a hurry years ago and nobody is sure who administers it, this is a good moment to sort out ownership. Our business email setup service covers moving mail to a properly configured provider with the right DNS records.
What to do for a hacked website
If the clues point at the site, the email symptoms will not stop until the code sending them is gone. Stopping the mail function alone, or changing the mailbox passwords, will not help because the site was not using them. The cleanup has to find the script or the abused form, remove any backdoors that put it there, and close the entry point.
Take one protective step right away: turn on a second login step for every WordPress administrator. Our guide to two-factor authentication for WordPress walks through it. It will not remove anything already planted, but it makes stolen passwords far less useful.
For the wider picture of what a site cleanup involves, and how to reach us urgently, see our hacked website help page.
What to do about spoofing
There is nothing to clean, but there is something to configure:
- Check that the domain has an SPF record listing every service that legitimately sends mail for you, including the website if it sends order or form emails.
- Make sure DKIM signing is turned on at your mail provider.
- Add a DMARC record. Many businesses start with a monitoring policy and tighten it once reports show legitimate mail is passing.
Get these wrong and you can block your own genuine mail, so change them carefully and test after each step.
A note on contact forms
One grey area deserves a mention. A contact form that lets visitors enter an email address and then sends a copy “to the visitor” can be abused by bots to send spam through your site, without any code being hacked. The messages come from your server and look like website-sent mail. The fix is form settings and spam protection, not malware removal. If the only odd mail you see is copies of form submissions, check the form before assuming a hack.
Getting the right help
Once you know which of the three situations you are in, the next step is usually clear. A mailbox takeover is fixed in the email account. Spoofing is fixed in DNS. A website that is sending mail needs a proper cleanup of the site and server. If your clues point at that last one, our page on fixing a site that sends spam explains how we approach it, and you can ask us to take a look before deciding anything.
If you are moving to a properly managed mailbox after an incident, compare Microsoft 365 business email plans in India.
Next in this series: WordPress Activity Logs After a Hack: What They Show
