WordPress website sending spam: what to check on the server

Your hosting provider tells you that your WordPress site or server is sending spam. The message can talk about abnormal outgoing emails, saturated queues, PHP scripts that send messages, degraded email reputations or temporary blocking of mailings.

However, the site may seem normal. The home page appears, the administration answers, the form still exists. The problem is mainly on the server side, in the logs, in the email returns or in the hosting provider panel.

Installing an SMTP plugin or restarting email without identifying the source is the wrong response. If spam comes from an abused form, injected file, compromised account or scheduled task, sending can restart as soon as restrictions are lifted.

What a spam sent from the server means

A spam sending from the server means that messages leave, or attempt to leave, from the environment that hosts the site. This can go through the server mail function, a WordPress form, a plugin, a PHP script, an SMTP account or an automated task.

The hosting provider can only cut the sending of emails, limit the account, suspend the site or request a correction before reactivation. The subject, therefore, is not just the reception of messages. It also affects the security of the site, the reputation of the domain and the confidence of email services.

Difference with spam received by form

Receiving a lot of unwanted messages in an email box is not exactly the same as seeing the server sending spam to the outside.

If your box receives noise, the subject may be the form, the antispam or the captcha. The article on the WordPress form that sends spam deal with this scenario. Here, the signal is more server: the hosting provider sees abnormal outgoings or scripts that generate emails.

Read the message of the hosting provider before acting

The message from the hosting provider often gives the best clues. Before editing WordPress, get the available information: time of sending, volume, script path, sender address, recipients, queue, error return or blocking rule.

Frequent causes

The outgoing spam can have several origins. The correct diagnostic review is to separate them instead of correcting them at random.

What should not be done too quickly?

Do not assume an SMTP plugin cleans up the problem. SMTP can make email more reliable on a healthy website, but it can also provide a better sending route for a website that remains compromised.

Do not reactivate emails with hosting provider without proof of correction. Don't just change the WordPress password if the script comes from the server. Do not delete a useful form without checking if it is actually the source. Don't restore an unknown backup if you don't know how long the mailings started.

Method to stop spam without breaking the site

The goal is to stop unwanted mailings, find the source, clean what needs to be cleaned and test useful emails after correction.

1. Keep hosting provider message, available logs and rejected email examples.
2. Create a backup of the current status before deleting files or plugins.
3. Identify whether the mailings originate from a form, script, SMTP account, WordPress or server.
4. Check files, uploads, plugins, theme, admin accounts and planned tasks.
5. Control the email settings: sender, SMTP, SPF, DKIM, DMARC and addresses used by the forms.
6. Remove suspicious scripts, correct the form, update or replace vulnerable plugins.
7. Change critical access details: WordPress, hosting, SFTP, database, SMTP and linked boxes.
8. Test useful forms and emails before requesting the removal of the blockage.

If the hosting provider blocked the emails or the site

If the hosting provider blocked only outgoing email, the website may remain visible while forms, notifications, orders or WordPress alerts stop sending. Test these functions after correcting the problem.

If the hosting provider has suspended the site, start with the exact reason for blocking. The article on the WordPress site blocked by hosting provider details this scenario. If suspicious files are also reported, read the guide on malicious files detected by the hosting provider.

What about the domain's email reputation?

When a server sends spam, the email reputation can be affected. Legitimate messages may then arrive in spam or be rejected, even after the technical correction.

You must check the sending settings, the addresses used by WordPress, the email DNS, the error returns and the reception tests. Then check that the useful messages are well sent and received.

When to ask for an intervention

Ask for help if hosting provider threatens to suspend the account, if logs mention an unknown script, if emails are blocked, if WooCommerce is active, if forms generate important requests or if you don't know which access is still reliable.

The budget is discussed after the first reading of the hosting provider message, logs and available access. A simple abused form, an injected script, a suspended server or a reinfection do not require the same work. In order to understand the criteria of the quote, the article on the hacked WordPress website cleanup page remains the right complement.

Frequently asked questions