Spam notice or blacklisted IP: the steps to take
PrintThese two situations look alike at first but are handled differently. In the first, we have sent you a ticket or email saying spam is leaving your account. In the second, your messages are being refused because the server's IP has been listed on a blacklist. Here is what to do in each case.
Case 1: spam is being sent from your account
Unsolicited mass mail is forbidden by the TopHost Terms and Conditions, and an account that sends spam can be blocked without notice to protect the server and other customers. So it pays to act quickly. The source is nearly always one of these:
- a mailbox password someone else has obtained, by guessing it, by stealing it from an infected computer or phone, or because the same password is used on other sites;
- a form on your website (contact, comments, sign-up) that bots use to send messages;
- a malicious file planted through an outdated plugin or theme, sending mail straight from PHP.
What to do, in order
- Change the password of every mailbox in the account: in cPanel, go to Email, then Email Accounts, then Manage for each address. Make them long and all different. Change your cPanel password too.
- Check Forwarders and Email Filters for any forwarding or rules you did not set up, and remove them.
- Scan every device the mailboxes are configured on with an antivirus.
- Protect your website forms with a CAPTCHA and validate input on the server. Form messages should be sent from an address on your own domain.
- Update the website. For WordPress, WP Toolkit in cPanel is the easiest route; updating from the WordPress dashboard is the fallback.
- Look for infected files. TopHost servers are scanned by Imunify360; if malicious code is found you are notified and have 24 hours to clean it. The steps are in There are viruses on my site, what should I do?
- Reply to our ticket with a short note on what you checked and changed. That helps us lift any restrictions sooner.
Case 2: the server's IP address is blacklisted
On shared hosting, several accounts send mail from the same IP address. If one of them sent spam, a blacklist can briefly affect everyone else's mail as well, even if you did nothing wrong.
- Open a ticket and include the complete error text or the full returned message, not just its subject.
- Our team checks which list the address is on and why.
- Once the source has been stopped, removal from the list is requested.
How long removal takes is up to each list's operator, anything between several hours and several days. Some lists drop an address automatically after a period with no complaints.
Keeping it from happening again
- Do not let browsers remember mailbox passwords on computers that several people use.
- Turn on two-factor authentication for your TopHost client area.
- Send newsletters only to people who subscribed; mailing those who opted out is not allowed. A hosting account can send at most 400 messages per hour.
- Keep your CMS, plugins and themes up to date, and delete the ones you no longer use.
Need an IP address of your own?
Shared hosting means a shared IP address. If the reputation of your sending address matters to your business, a VPS gives you an IP of your own whose reputation depends only on you. See the article on extra IPs and SMTP ports.
