What to Do If Your Server Is Being Used for Spamming

August 13, 2025

This is easily one of the most common issues we see on our servers, and if you've spent any real time running a VPS, chances are you've bumped into it at least once. So we figured it was worth writing this up properly, walking through what's likely going on and what you can actually do about it.

Why is your server sending spam?

There are plenty of possible causes, but almost every case comes down to one of three:

• Your VPS was hacked.
• Your website was hacked.
• You're sending spam on purpose.

We'll set the third one aside (that's a quick conversation, and not one that ends well). The first two are where most people find themselves, so let's take them one at a time.

If your VPS was hacked

Let's say your VPS isn't being used for web hosting at all. Maybe it's handling data storage, processing, a VPN, or something else entirely. In that case, you probably don't need mail services running on it in the first place.

So the first move is simple: disable or remove the mail services you aren't using, things like Exim, Postfix, or Sendmail.

Next, block the SMTP ports, 25, 465, and 587. You can do this with iptables or whatever firewall software you prefer.

There's also a sneakier route attackers sometimes take. Email can be pushed out through SSH tunnels in a way that makes the spam look like it's coming from localhost. This works by forwarding a port over SSH, which sets up a secure connection between a local machine and your server that services like SMTP can ride through. The catch is that it requires access to a user account on your server in the first place, which is exactly why your login security matters so much. Use a strong password, run SSH on a custom port, set up SSH keys, and keep access limited to you and people you actually trust.

And the timeless advice: keep your software updated, always. Run routine security checks and antivirus scans, put a firewall in place to block connections you don't want, and keep logs so you can actually see what's happening on your server.

If your website was hacked

This is the big one for us, because our VPS plans are built mainly for web hosting, so this is where most spam incidents start. Here's how to work through it:

1. Scan the server with antivirus software. Most attacks aren't especially creative. They've been done before, which means a decent antivirus tool will usually spot the malware or injection.

2. Update your CMS. Updates aren't just about shiny new features. A lot of them exist to patch vulnerabilities that have gone public and are being actively exploited. Turn on automatic updates if you can, or at least check manually now and then.

3. If you're running Apache, use ModSecurity. It's a web application firewall that scans and blocks bad requests before they reach your sites, and it does a great job of stopping the most common injections. You can also tune it by hand to block anything suspicious.

4. Use strong passwords for your CMS, and don't share them.

5. Avoid unknown plugins. Some are published specifically to sneak access into your site, so stick to sources you trust.

6. Limit which file types can be uploaded to your sites.

7. Set sensible file and folder permissions, and steer well clear of "777."

What if you did everything and your server still got reported?

Here's something that catches people off guard: even though mass-mailing and spamming aren't allowed on our VPS, your websites will naturally send the occasional legitimate email. Confirmation messages, password resets, system change-logs, that sort of thing. Those emails can still get flagged as spam or rejected by other mail servers, and that can eventually land your server on a blacklist.

A few things make your legitimate mail look more trustworthy to the rest of the world:

1. Set up SPF and DKIM records for your domain.

2. Steer clear of spam trigger words, basically anything that reads like selling, offering, or marketing. There are plenty of published lists of these if you want to check your wording.

3. Keep your emails informational. They should serve a genuine, general purpose, not double as newsletters or marketing blasts.

A few closing thoughts

Make a habit of checking your mail logs and server access logs. They're usually the first place anomalies or intruders show up.

Keep your system and software updated. (Yes, we've said it three times now. That's on purpose.)

And if you do end up blacklisted, that's just the reality of the moment, so don't get stuck on it. Put your energy into finding the cause and fixing it.

The most important thing to remember: spamming is against our Terms of Service. If you want to revisit exactly what that covers, you'll find it linked there.