Unexpected outbound mail can come from an abused public form, a stolen SMTP credential, injected PHP or another site sharing the hosting account. Blocking all mail stops symptoms but does not identify the sender or protect access.
Contain abuse, preserve queue/log evidence and keep legitimate transactional messages distinguishable.
Stop ongoing harm
Ask the host or mail provider to restrict outbound sending for the affected account, script or credential. Preserve essential business mail through a separately controlled provider only after its source is trusted.
Do not raise mail limits or release the queue while spam continues. Display an alternative contact route if form notifications cannot be relied upon.
Record containment time and affected domains.
Preserve mail evidence
Save the mail queue, delivery logs, provider events and volume by sender/script/time. Record representative queue IDs, return paths and originating filesystem paths without copying message bodies unnecessarily.
Do not forward spam samples from the compromised server; that creates more unwanted mail. Protect logs because they may contain recipients and authentication data.
Note whether the host attributes messages to PHP, SMTP login or a mailbox.
Separate form abuse from injected code
Compare spam messages with stored form entries and web requests. If normal form code sends confirmations to arbitrary supplied addresses, bots may be abusing a legitimate workflow.
If mail originates from an unknown PHP path, cron job or direct SMTP credential, treat it as compromise. Multiple mechanisms can coexist.
Do not add CAPTCHA and assume injected malware is gone.
Identify the sending script or account
Use hosting mail headers/log fields, PHP mail tracking and provider authentication events to correlate the source. Inspect recent files, executable content under uploads/cache, must-use plugins and scheduled tasks.
For SMTP login abuse, review account sessions, IP/time patterns and app passwords. Avoid publishing these details or treating an IP as definitive attribution.
Preserve suspicious files without running them.
Check all sites under the account
A compromised cPanel/Plesk user can modify sibling sites and use any writable directory. Inventory domains, document roots, cron tasks, database users and shared credentials.
Contain the account at the appropriate level rather than repeatedly cleaning one WordPress installation. Check parked domains and abandoned staging copies.
Separate sites and credentials during recovery where hosting architecture permits.
Clean and close persistence
Replace WordPress core/plugins/themes with trusted versions, validate custom code, inspect database/users and remove malicious scheduled tasks. Update or remove the vulnerable component.
Rotate hosting, SSH/SFTP, WordPress, database, SMTP and primary email credentials from a clean device. Revoke unknown keys and enforce MFA.
Do not restore a backup until its date and entry vector have been assessed.
Check DNS and domain control for unexpected SPF includes, DKIM selectors, MX changes and forwarding rules. A stolen DNS or mailbox account can continue authorising abuse after WordPress files are replaced.
Preserve the old public records and account audit events before correction.
Repair sender reputation
Configure a verified transactional provider, aligned SPF/DKIM/DMARC and controlled From addresses. Process bounces and suppress invalid recipients.
Request blocklist or provider review only after spam has stopped and the cause is corrected. Releasing old legitimate queue messages should be gradual and deduplicated.
Document expected daily volume and alert thresholds.
Verify sustained recovery
Submit a synthetic form and trace one legitimate message to its final mailbox. Monitor queue size, outbound counts, changed files, privileged accounts and provider events over several days.
Reconcile genuine leads/orders from the containment window. Retire temporary mail routes and credentials.
Request emergency rescue when the source path is unknown or several domains share the account. Share counts, timestamps and redacted log fields—never credentials, full recipient lists or malware through email.