Your Website Has Become a Spam Machine
It rarely shows on the website itself. Instead, your inbox fills with bounce messages for emails you never sent. Customers say your invoices are landing in junk. Your host writes to say the account has hit its outgoing mail limit, or that sending has been blocked. Someone runs a check and tells you your domain or your server’s IP address is on a blocklist.
All of these can mean the same thing: something on your website or hosting account is sending large volumes of email without you. It may be a malicious script dropped after a hack, a contact form being abused, or an email account whose password was stolen. Each needs a different fix, and the first job is finding which one it is. The wider response to a compromise is described under our hacked website repair service. This page is about stopping the spam at its source, cleaning up your sending reputation and getting your genuine email delivered again.
Three Very Different Causes
When people say “my website is sending spam” they usually mean the domain is. Pinning down where the messages actually start makes everything else simpler.
A mailer script on the website
After a break-in, attackers often upload a small PHP file that does one thing: take a list of addresses and a message, and send it through the server’s mail function. These scripts are usually tucked into the uploads folder, a plugin directory or a random new folder, and are sometimes run remotely in bursts so the server’s mail queue suddenly fills overnight. This is a true website hack, and it needs a full cleanup rather than a quick delete.
A compromised email account
Here the website is fine. Someone has the password to one of your mailboxes, perhaps from a phishing email or a password reused elsewhere, and is logging in to send spam through your mail server like a normal user. Mail logs show it clearly: the messages are authenticated as a real address on your domain. Telling a hijacked mailbox apart from a hacked site is covered step by step in a separate post.
A form being misused
Contact forms, registration pages and “send to a friend” features can be abused by bots without any break-in at all. If a form lets the visitor choose the recipient, or sends a copy of the message to whatever address is typed in, it can be used to relay spam. The server is sending exactly what the form tells it to; the form just needs fixing.
These three can overlap. A hacked website may also have had its mailbox passwords taken from the configuration. So we check all three rather than stopping at the first thing we find.
Why It Matters Beyond the Annoyance
Spam sent from your server harms your own email in ways that can last after the spam stops.
- Blocklists. Services such as Spamhaus, Barracuda and SpamCop keep lists of IP addresses and domains seen sending spam. Many receiving mail servers check those lists, so a listing can mean your legitimate messages are rejected or junked by people you have never spammed.
- Host limits and suspension. Hosts protect their shared servers by throttling or blocking accounts that send too much. Repeated abuse can lead to the account being suspended; if your account has already been switched off, see what to do about a malware suspension.
- Shared IP reputation. On shared hosting, your site may send mail from the same IP address as many others. Your spam can hurt them, and theirs can hurt you.
- Customer trust. If the spam pretends to come from you, recipients may think your business is sending scams.
How We Stop the Spam and Repair the Damage
Pause outgoing mail where possible
The first goal is to stop more spam leaving while we find the cause. Depending on your hosting, that may mean asking the host to hold the mail queue, temporarily disabling PHP mail for the account, or changing a mailbox password. We take a backup of the site and database before any of this so nothing is lost.
Read the mail logs and the queue
The messages themselves say a lot. The headers of a few queued or bounced emails often show which script or account sent them. On control panels such as cPanel and Plesk, the mail queue and delivery reports show volume, timing and the sending user. We use these to point us at either a file on the website, a mailbox, or a form.
Remove mailer scripts and the way they got in
If the source is a script, we find and remove it along with any copies, and then look for the entry point and any backdoor left behind. That cleanup follows the same method as our WordPress malware removal service, because a mailer script is almost never the only thing an attacker uploads. If we find malware in the uploads folder, our WordPress backdoor removal work goes after the hidden access that let the mailer be placed there.
Secure the mailboxes
If a mailbox was abused, we help you reset its password, check for forwarding rules or filters the attacker added, and review other mailboxes on the domain. Where possible, the person who uses the account should also check their own computer and phone, since the password may have been taken from there.
Fix or replace abused forms
Forms are changed so the recipient is fixed and cannot be set by the visitor, and spam protection is added. If a form plugin is outdated or abandoned, we replace it.
Set up sending properly
Once the abuse has stopped, it is a good moment to move WordPress away from the server’s basic mail function and onto authenticated sending through a proper SMTP or mail service. It makes genuine messages more reliable and gives you a cleaner record of what the site sends. Our guide to WordPress emails not arriving explains how that setup works. We also check that your domain’s SPF, DKIM and DMARC records are in place and correct, since they help receiving servers tell your real mail from forged messages. If your business mail itself needs reorganising, our business email setup service covers that side.
Request delisting
Each blocklist has its own lookup and removal process, and most expect the cause to be fixed before you ask. We check where your IP address and domain are listed, follow each list’s own procedure, and tell you which ones depend on your host because they list the host’s IP rather than your domain. Some lists remove entries automatically once spam stops; others need a request. We cannot control how each one responds, but we make sure every request is accurate.
What to Do Right Now
- Do not delete the bounce messages yet. Keep a few. Their headers are often the fastest way to find the source.
- Change the passwords of every mailbox on the domain. Start with any that staff say has been acting oddly.
- Tell your host what you have noticed. If they have not already contacted you, letting them know shows good faith and may help them limit damage on a shared server.
- Warn key customers if spam used your name. A short, calm note that your domain was misused and that you never ask for payment changes by email can prevent a lot of confusion.
- Do not set up a new domain to get around the problem. The cause will follow you if it is on the hosting account.
When Spam Is Only One Part of It
A server sending spam is sometimes the first visible sign of a bigger compromise. The same attacker may have added phishing pages, injected links into your posts, or created admin accounts. If any of that turns up while we are working on the mail, we will tell you before doing anything more, and explain what else needs attention. For other symptoms worth checking, read our list of warning signs of a hack.
Getting Help
Spam leaving your server gets priority over routine work, since the longer it runs the deeper a blocklisting can go. Send a WhatsApp note that leads with the word HACKED and includes the domain and one pasted bounce message if you have it. You can also reach us by the contact form or phone.
First we inspect the site and the mail setup. Then you hear frankly what turned up and the earliest point we can start, and a backup comes before any change. You get progress updates on WhatsApp as the source is found, the spam stops and the delisting requests go out.