Thread

Today my host told me that my site has been sending out spam emails and that they are coming from email_data.php (in the languages folder of the the system folder).

I found a few spam accounts in my members list (only have a couple) and deleted them as well as temporarily disabling registration of new accounts. I also changed the passwords for member accounts. Is there anything else I can do to prevent spammers from using my site to send spam? I do have one contact form on the site so I do need that file to be in there but is there anything I can modify in the file itself or the manager to help prevent this?

Thanks in advance.

Today my host told me that my site has been sending out spam emails and that they are coming from email_data.php (in the languages folder of the the system folder).

That’s rather unlikely, given that this file only contains a few language related strings and email templates.

I found a few spam accounts in my members list (only have a couple) and deleted them as well as temporarily disabling registration of new accounts.

Are you allowing your members to send email? Tell-a-friend forms, anything like that?

I do have one contact form on the site so I do need that file to be in there but is there anything I can modify in the file itself or the manager to help prevent this?

Make sure your users cannot modify the intended recipient of that form.

That’s rather unlikely, given that this file only contains a few language related strings and email templates.

That’s what I thought after looking at the file but that’s what they said. But somehow, they are using something to spam. We only have a coupe members and they are all members of our company. I turned off the feature that allows new people to register as members, even though we have no registration form on the site, they somehow registered themselves.

Are you allowing your members to send email? Tell-a-friend forms, anything like that?

Nope.

Make sure your users cannot modify the intended recipient of that form.

Probably a dumb question but how do I do that? Or maybe it isn’t an issue since it’s just staff and all member registrations are blocked now?

Thanks so much for the help.

In your email contact form, you’d use the user_recipients= parameter. It should be “false” to be on the safe side, abd specify the recipient yourself:

recipients="[email protected]"

You should also upgrade to the latests version, if you haven’t done so already; EE 1.6.7 is a recommended security update.

Oh, OK, I already have it set to that - just one email address. And I’ll upgrade as well. Thanks a lot!

My pleasure… Marking as “Resolved” for now, please post again if anything else comes up or you need help with something else.