Why Is My Website Sending Spam Emails? What It Means

Let's be direct: if your website is sending spam emails you never wrote, it's been hacked. This isn't a setting you misconfigured or a bug in your form. Someone got in and planted code that uses your site to send junk mail, and it needs to come out. Here's what's actually going on and what to do about it.

What's actually happening on your server

Most sites run on PHP, and PHP has a built-in mail function. That function is what legitimately sends your contact form notifications and password resets. When an attacker gets a file onto your server, they drop in a small script that calls that same function in a loop, sending thousands of spam messages that all appear to come from your domain.

You didn't do anything, and you often can't see it, because the script hides in a folder you never open. The first sign is usually a flood of bounce-back messages for emails you never sent, or a note from your hosting company saying your account is sending too much mail.

Confirm it's your site, then stop the bleeding

Ask your host to check your outbound mail logs. A spike of outgoing messages you didn't send confirms the site is the source. While you sort out the cleanup, ask them to pause outbound mail from your account or take the site offline temporarily. That stops the spam immediately and protects your reputation while you work.

Find and remove the injected code

Cleanup means locating the malicious files and deleting them, then hunting for any others the attacker left as a backdoor. On WordPress, a reputable security plugin can scan for known malware, and comparing your files against clean copies of WordPress core, your theme, and your plugins reveals anything that doesn't belong. Recently modified files in odd locations are a common giveaway.

This is fiddly, and if you miss a single backdoor the spam comes right back a week later. If you have a clean backup from before the compromise, restoring it and then immediately patching the hole is often faster and safer than picking through files by hand. Our overview of how to tell if your website has been hacked covers the other signs worth checking while you're in there.

Close the door so it doesn't happen again

Removing the script isn't the end. The attacker got in somehow, and if you don't close that path they'll be back. Update WordPress core, every plugin, and your theme to current versions, since an outdated one is the usual entry point. Change all admin and hosting passwords. Add spam protection to your contact forms. Then ask the major blacklist services to re-review your domain now that the source is gone.

How we handle this for clients

When a client's site starts spewing spam, we take it offline, find and remove the injected code and any backdoors, patch whatever let the attacker in, and work through delisting the domain. Then we keep it from recurring. Our maintenance plans start at $99 a month and keep plugins and core patched, which closes the exact holes these mailers exploit.

We're a Seattle-area studio in Mill Creek, Washington, and we handle cleanups for clients across the Puget Sound and remotely nationwide. If your site is sending mail you didn't write, call us at (425) 314-1415 and we'll help you shut it down.