My website is sending spam email
This one has a sting in the tail. A compromised site sending spam gets your hosting account suspended, and it gets your domain onto email blocklists, which means your ordinary business email stops reaching customers. Cleaning the site fixes the cause; repairing your email reputation is a second job that people often forget about.
We reply within 1 business day (Mon–Fri, 9–5 ET)
What you're seeing
- Your host warns you about spam, phishing, or abuse, or limits your outgoing mail
- Your mail queue is full of messages to people you've never heard of
- You're getting floods of bounce messages for emails you never sent
- Customers say your emails arrive in spam, or don't arrive at all
- Your domain or server IP turns up on an email blocklist
Why it happens
A mailer script on your site
Attackers upload a small script that sends bulk mail through your server. It's often one file, hidden in an uploads or plugin folder.
A contact or newsletter form being abused
A vulnerable form can be turned into a way of sending mail to anyone, using your domain.
Stolen sending credentials
If your site stores SMTP details for sending email, an attacker who reads your configuration can send as you from anywhere.
A compromised email account
Sometimes the site is fine and an email account password was reused or phished. Same symptoms, different fix.
Spoofing, with no compromise at all
Anyone can forge your address in the From line. If nothing is actually sending from your server, this is likely, and the fix is email authentication rather than a cleanup.
What to do right now
Do this
- Ask your host for the mail logs and queue. They usually show the exact script doing the sending
- Change your email and hosting passwords, and any SMTP password stored on the site
- Check one of the bounce messages: the headers show whether it really came from your server
- Check whether your domain or IP is listed on the main email blocklists
Don't do this
- Don't just clear the mail queue. It refills within hours while the script is still there
- Don't assume it's spoofing without checking the logs. It's the comfortable answer and often the wrong one
- Don't send a bulk apology email from the same domain while you're still blocklisted. It makes your reputation worse
How we fix it
- 1Work from your host's mail logs to find exactly what's sending, then remove it and the backdoor behind it
- 2Check forms and plugins that can send mail, and close anything being abused
- 3Rotate stored sending credentials and clear the queue with your host
- 4Request removal from the blocklists your domain or IP has landed on
- 5Set up proper email authentication (SPF, DKIM, and DMARC) so your mail is trusted again and harder to forge
Cleanups start at $349, with a money-back guarantee: if we can't clean your site, you don't pay.See pricing
Questions
Could this just be someone forging my address?
It could. Forging a From address takes no access to your site at all. The difference shows in your host's mail logs: if messages are leaving your server, it's a compromise. If not, it's spoofing, and the answer is email authentication rather than a cleanup. We check before assuming either way.
How long until my email works normally again?
Most blocklists remove a domain within a few days of the sending stopping, and some clear automatically. Reputation with the big providers takes a little longer to recover, which is why we set up authentication as part of the work.
Do I have to tell my customers?
If spam or phishing went out in your name, a short, plain note is usually worth sending once your mail is working again. It protects the people who received it and it protects your reputation. We'll help you word it.
Other symptoms
- Visitors get redirectedYour site sends people to spam, scam, or adult sites, often only on mobile or from Google.
- "This site may be hacked"Google shows a warning in search results, or Chrome shows a red "Deceptive site ahead" screen.
- Strange pages in GoogleJapanese, pharma, or casino pages you never created show up under your domain.
- Your host suspended youYour hosting company took the site offline or quarantined files for malware.
- You're locked outYour admin password stopped working, or there are admin users you didn't create.
- It keeps coming backYou cleaned the site, and the malware was back within days.
- Card skimmer on checkoutCustomers' card details are being captured at checkout by injected code.
- Fake login pagesSomeone is hosting fake bank or Microsoft login pages in a hidden folder on your site.
- Pharmacy spam in GoogleYour search listings mention pills or pharmacies, even though your pages look normal.
- A scanner says I'm infectedWordfence, Sucuri, or another plugin reports malware you can't get rid of.
Hacked right now? Let's get it fixed.
Start your cleanup and we'll take it from there. If we can't clean it, you don't pay.
We reply within 1 business day (Mon–Fri, 9–5 ET)