Website or Hosting Account Sending Spam Emails? How to Find and Stop It

On this page

1. Signs of a spam problem
2. Common causes
3. Step 1: Stop the sending
4. Step 2: Trace the source
5. Step 3: Fix the cause
6. Step 4: Clean your reputation
7. Step 5: Send website email properly
8. Prevent it happening again

Your host suspends email on your account, you get bounce-backs for messages you never sent, or your own emails start landing in spam. Your hosting account may be sending spam. It hurts your domain's reputation, so act quickly.

Signs of a spam problem

• A warning or suspension notice from your host about outgoing mail
• Hundreds of bounce messages in your inbox
• Your domain or server IP appears on email blacklists
• Genuine emails from your business going to spam

Common causes

• Malicious mailer scripts uploaded to the website after a hack
• A compromised email account password used to send spam through your mail server
• Abused contact forms that can be tricked into sending emails to any address
• Vulnerable plugins with email features

Step 1: Stop the sending

Ask your host to pause outgoing mail or clear the mail queue while you investigate.

Step 2: Trace the source

• Ask your host for mail logs: they show whether spam came from a script (and often which file) or an email account login
• Check the headers of a bounced spam message for clues about the sending script or account
• Look for recently added PHP files, especially in uploads and random folders

Step 3: Fix the cause

• Script: remove it and clean the site fully; see malware clean-up step by step
• Email account: change its password, and all email passwords, and check for forwarding rules the attacker added
• Form abuse: update or replace the form plugin and add spam protection; see stopping form spam

Step 4: Clean your reputation

• Check your domain and server IP on major blacklist checkers
• Follow each blacklist's delisting process once the problem is fixed
• Set up SPF, DKIM and DMARC so others can't easily spoof your domain; see email deliverability

Step 5: Send website email properly

Send WordPress notifications through an authenticated SMTP or transactional email service rather than the server's default mail. It improves deliverability and makes abuse easier to spot.

Prevent it happening again

• Strong, unique email passwords, with 2FA where available
• Updated plugins and themes
• Monitoring for new PHP files and unusual email volume

Need help tracing and fixing it? See WordPress malware removal.