If your website is sending spam emails, an attacker has almost always found a way to use your server’s mail. It’s usually a hacked file, an abused contact form or a stolen email password. You need to stop the sending first, clean up the cause, then repair your email reputation so your real messages reach customers again.
Key takeaways
- The first sign is often your own email bouncing or landing in customers’ junk folders.
- There are three usual causes: a hidden mailer script, a contact form being abused, or a compromised mailbox.
- Stop the sending, find the cause and clean it before asking any blocklist to remove you.
- Blocklist removal is free. Anyone charging to “delist” you is not to be trusted.
How do I know my website is sending spam?
You rarely see the spam itself. Watch for these signs:
- emails from your domain bounce back with messages mentioning a blocklist
- customers say your invoices or quotes are going to junk
- your inbox fills with bounce notices for emails you never sent
- your host warns you, limits outgoing mail or suspends your account
- your contact form shows hundreds of strange submissions full of links
Check the same day. The longer spam flows, the harder your domain’s reputation is to repair.
Why would my website send spam?
Spammers want a server with a good reputation, because their own addresses are already blocked. There are three common ways in.
1. A hacked file sending mail
Attackers who break into a site often upload a small PHP script that sends mail on command. They usually get in through an out-of-date plugin or theme. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins (Patchstack). The same hack may also add spam pages, which can lead to the this site may be hacked label in Google.
2. A contact form being abused
This one doesn’t need a hack. Bots fill in your form using a victim’s email address and a spam message. If the form emails a “thanks for your enquiry” copy back to the sender, your server delivers the spam for them. Forms with no spam protection are the usual target.
3. A compromised mailbox
If someone has guessed or phished an email password, they can send directly through your mail account. Email compromise was the most common cybercrime businesses reported to ASD in 2024–25, at 19% of reports (ASD).
How do I stop my website sending spam?
Work through these steps in order.
- Stop outgoing mail. Ask your host to pause outgoing mail from the site or clear the mail queue, so the spam stops while you investigate.
- Change passwords. Reset every email account, WordPress admin, hosting and FTP or SFTP password. Turn on two-factor login wherever you can.
- Find the source. Your host’s mail logs show which script or account sent the messages. That tells you which of the three causes you’re dealing with.
- Remove the cause. Delete unknown PHP files and backdoors, update or remove the plugin that let the attacker in, and check for admin users you don’t recognise.
- Lock down forms. Add spam protection such as a CAPTCHA or honeypot, and turn off any option that emails a copy to whatever address is typed in.
Don’t stop at the mailer script. Sucuri found backdoors on 49% of compromised sites (Sucuri). Miss one and the spam starts again within days. If visitors are also being sent to scam sites, read our guide to the WordPress redirect hack, because the two often come together.
How do I get off an email blocklist?
Only request removal once the cause is fixed. Then:
- Check the listing. Look up your domain and your mail server’s IP address on the Spamhaus reputation checker and other major blocklists. Each shows why you’re listed.
- Request removal. Each list has its own process. Spamhaus says that for compromised websites, you should secure the site first, then ask for removal through its checker (Spamhaus).
- Ignore paid “delisting” offers. Spamhaus states there is never a fee to remove a listing, and that any offer to do it for a fee is a scam.
If your server shares an IP address with other sites, your host may need to handle the request or move your mail.
How do I restore my email deliverability?
Mail providers also judge your domain on its setup and recent history. Gmail requires every sender to set up SPF or DKIM, have valid forward and reverse DNS, and keep reported spam rates below 0.3% (Gmail Help).
So check your SPF, DKIM and DMARC records are in place and correct. For newsletters, use a proper email service rather than your web server. Then send normal business email for a few weeks and watch for bounces. Reputation recovers with clean sending over time, not overnight.
How do I stop it happening again?
Most of these incidents trace back to skipped updates, weak passwords or unprotected forms. Regular updates, malware scans, a firewall and form protection close those gaps. Our website maintenance plans include all of them, and secure web hosting adds account isolation and server-level scanning. If you’re dealing with it right now, start with our hacked website repair. For the wider recovery process, see our step-by-step guide for when your website is hacked.
Frequently asked questions
Can my website send spam without being hacked?
Yes. Bots can abuse a contact form that emails a copy of each enquiry to the address typed in. Your server then sends their message to victims. Spam protection on the form and turning off the copy option usually stops it.
Why are my emails going to junk all of a sudden?
A sudden change often means your domain or mail server has landed on a blocklist, or your SPF, DKIM or DMARC records have broken. Check the bounce messages, look up your domain on a blocklist checker and review your DNS records.
How long does it take to get off a blocklist?
It depends on the list. Some remove a listing soon after a valid request, while others expire listings automatically once the spam stops. Rebuilding your reputation with Gmail and Microsoft can take a few weeks of clean sending.
Will my host suspend my account for sending spam?
Many hosts will limit or suspend outgoing mail to protect other customers on the same server. Work with them: they can see the mail logs, which show exactly which script or account sent the spam.
Should I use a separate service for email newsletters?
Yes. A dedicated email service handles unsubscribes, authentication and sending reputation properly. It also keeps marketing email separate from the mail your website sends, so one problem doesn’t take down the other.
Sources
- State of WordPress Security in 2026, Patchstack
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- FAQs: Domain Blocklist (DBL), Spamhaus
- Email sender guidelines, Gmail Help, Google