My Website Is Sending Spam: How to Stop It

If your website is sending email spam without your permission, it may have been compromised, an email account password may have been exposed, or a form may be abused.

Act quickly. A large volume of unwanted email can damage your domain’s reputation, lead to temporary sending blocks and cause legitimate messages to land in spam.

This guide helps you identify the source, stop the messages and strengthen the security of your website and hosting account.

Find out where the spam is coming from

Before making changes, try to identify how the messages are being sent. Common causes include:

• Malware on the website.
• A vulnerable plugin, theme or module.
• A compromised email account.
• A form without bot protection.
• An old or unfamiliar script in the hosting account.
• A scheduled task running malicious code.
• A compromised FTP, SFTP, WordPress, PrestaShop, DirectAdmin or cPanel account.

It also helps to distinguish between two cases:

1. Messages are sent through an email account, such as info@yourdomain.com.
2. Messages are sent by a website script, usually using PHP.

That distinction tells you what to investigate first.

Steps to stop spam from your website

1. Change every password

Immediately change the passwords for:

• Email accounts.
• Your hosting control panel.
• WordPress, PrestaShop or another content management system.
• FTP or SFTP.
• Databases, if you think their credentials were exposed.
• Administrator and collaborator accounts.

Use unique, long passwords. Do not reuse a password from another service.

2. Temporarily disable suspicious forms

If the messages appear to come from contact, registration, comment or password-reset forms, temporarily disable those forms while you investigate.

Then add suitable protection, such as CAPTCHA, sending limits, field validation, bot protection, duplicate-submission blocking and email confirmation where appropriate.

3. Update the website

Update every part of the installation: the WordPress, PrestaShop or other CMS core; plugins; themes; modules; templates; libraries; and custom scripts.

Remove plugins, themes or modules you no longer use. Disabling an unused component may not be enough: if it remains installed with a vulnerability, it can still pose a risk.

4. Check administrator accounts

Look for unknown users with elevated permissions.

In WordPress, review the user list and remove suspicious accounts. In PrestaShop, check employees and their permissions. Also review FTP users and accounts that can access the hosting control panel.

5. Look for changed or unfamiliar files

Review your website files and pay particular attention to:

• PHP files in folders that normally contain only images.
• Strange or randomly named files.
• Recently changed files without a known reason.
• Obfuscated or hard-to-read code.
• Duplicate copies of system files.
• Scripts that send email.
• Files inside temporary or cache folders.

Do not delete files at random. If you do not know what a file does, make a backup before changing it.

6. Review scheduled tasks

Check for unfamiliar cron jobs or commands that run suspicious scripts. A malicious scheduled task can recreate infected files even after you have cleaned the website.

7. Scan the installation with security tools

Run a malware scan from your hosting control panel if your service offers one. You can also use a security tool made for your CMS. For WordPress, for example, a security plugin can help find changed files, suspicious users and unauthorised access.

Automated scans are useful, but may not find every infection. If the problem continues, a manual review may be necessary.

8. Review activity logs

Logs can help identify the file, user or IP address involved. Check web access logs, PHP errors, mail logs, login history, FTP activity and recent file changes.

9. Restore a clean backup

If you have a backup from before the infection, you may be able to restore it. Before doing so:

1. Confirm that the backup predates the problem.
2. Change the passwords.
3. Update the website after restoring it.
4. Remove vulnerable plugins, themes or modules.
5. Check for malicious scheduled tasks.

Restoring a backup without fixing the original cause may allow the problem to return.

If spam is being sent from an email account

If a particular account is sending the messages:

1. Change its password.
2. Check whether the account is set up on unfamiliar devices.
3. Review filters, rules and forwarding addresses.
4. Sign out open sessions where possible.
5. Scan the computers and phones where the account is used.
6. Check whether its password was reused elsewhere.

An infected device can also steal email credentials and use them to send spam.

If spam is being sent from PHP

When a PHP script sends the messages, the problem is usually connected to the website itself. Check contact forms, SMTP plugins, custom scripts, recently changed files, outdated plugins and themes, cron jobs, administrator accounts and malicious code inserted into legitimate files.

Sending email through authenticated SMTP can make activity easier to trace, but it does not replace cleaning a compromised website.

How to prevent it from happening again

After stopping the messages:

• Keep the website and all its components up to date.
• Remove plugins and themes you do not use.
• Use unique passwords.
• Enable two-factor authentication where available.
• Limit the number of administrators.
• Protect forms with CAPTCHA or another suitable measure.
• Make regular backups.
• Review users and scheduled tasks regularly.
• Use supported PHP versions that are compatible with your website.
• Avoid themes or plugins from untrusted sources.

For a website that handles important information or receives substantial traffic, consider a website maintenance service or check whether your hosting plan includes suitable security tools and resources.

Common problems

I changed the password, but the spam continues

The messages may be coming from a website script rather than an email account. A scheduled task or malicious file may also still be active.

I restored a backup and the problem came back

The backup may already have been infected, or the original vulnerability may still be present. Update every component and remove the element that allowed access.

My domain is on spam blocklists

First, stop all unauthorised sending. Then review your domain’s reputation and request removal from the relevant lists when appropriate.

Legitimate emails are going to spam

After an incident, your domain or IP reputation may be affected. Also check your domain’s SPF, DKIM and DMARC records.

What to send to support

If you need help, provide:

• The affected domain.
• When the issue started, approximately.
• The email address involved, if known.
• An example of a message that was sent.
• The times when messages were sent.
• Recent changes to the website.
• The CMS you use, such as WordPress or PrestaShop.
• Plugins, themes or modules installed recently.
• Steps you have already taken.

Do not send passwords by email or through an unsecured form.

Frequently asked questions

Could my account be blocked for sending spam?

A provider may temporarily limit email sending to protect the server and prevent further harm. The response depends on the source, volume and severity of the incident.

Is changing the password enough?

Only if the issue came from a compromised account. If the website is infected, you also need to clean its files, update the CMS and fix the vulnerability.

Can a contact form send spam?

Yes. Without bot protection, a form can be abused to send messages in bulk.

Should I delete the whole website?

Not necessarily. In many cases you can clean and update the installation and fix the entry point. Make a backup before deleting files.

Should I configure SPF, DKIM and DMARC?

Yes. These records help authenticate email and reduce domain spoofing, although they do not remove an infection from your website.

Summary

When a website sends spam, first stop the sending, change the passwords, update the installation and find the responsible file, account or form.

If you cannot identify the source, contact technical support with the domain, approximate start date and any information about the messages. More detail makes it easier to investigate.