Outgoing spam detected on my account – contact form abuse and how to stop it

If we've contacted you about outgoing spam from your hosting account, a script or email account on your service has been sending a large volume of email. The most common cause is a website contact form being abused by bots, followed by hacked websites and compromised email passwords.

Why we act quickly

Spam sent from one account can get the whole server's IP address blacklisted. When that happens, providers like Microsoft and Gmail start rejecting mail from every customer on that server. To protect everyone, we may temporarily disable the script or email account that is sending the spam until the cause is fixed. This is covered by our Acceptable Use Policy.

If we've disabled something on your site, such as WordPress's mail function, we'll tell you what was changed in your ticket. Please let us know once you've secured the site so we can re-enable it.

If the spam is coming from a website form or script

• Add CAPTCHA or bot protection to every form, for example Cloudflare Turnstile, Google reCAPTCHA, or the built-in anti-spam option in your form plugin (Contact Form 7, WPForms, Gravity Forms, Elementor Forms and others all support this).
• Don't send auto-replies to the address typed into the form. Spammers use this to send their message to other people through your site.
• Update WordPress, plugins and themes. Outdated form plugins are a common entry point.
• Remove unused plugins, themes and old copies of your site (for example /old or /test folders).
• Scan for malware with a security plugin such as Wordfence. If the site has been hacked, a malicious script may be sending the mail rather than your form.
• Change your WordPress admin and FTP passwords, and remove admin users you don't recognise.

If the spam is coming from an email account

• Change the password on the affected email account straight away, and use a unique password that isn't used anywhere else, especially not for WordPress.
• Update the saved password on every phone and computer that uses the account.
• Check the account for forwarders or autoresponders you didn't set up.
• Run a virus scan on the devices that use the account.

Checking what's being sent

In cPanel, Track Delivery (under Email) shows recent messages sent from your account and where they came from. This helps confirm whether the mail is from a script or a particular email account.

Related articles

• How many emails can I send per hour?
• WP Toolkit Security Alert Emails – What do they mean?
• How to identify a WordPress plugin causing issues

If you need a hand tracking down the source, open a support ticket and we'll help.