You are reading this article because you are running WordPress and your site is sending out spam email.
WordPress is a really attractive target for scammers, spammers and malware developers and if you have not locked down your site, then you can become a target.
So how do the hackers manage to get their spam scripts onto my account?
The most popular way is through free themes and plugins. The hackers are clever and rely on naivity on your part to make a theme or plugin attractive enough for you to install to your site. Heard of the term "mutton dressed as lamb"? Thats how they present them to you. They make WordPress themes and embed vulnerabilities or malware directly into the source code so when you upload them to your server, they can execute commands and install spam scripts. This is why you should only install themes and plugins from reputable sources.
But is it not the web hosts duty to protect my files?
To an extent yes, and we do have certain levels of protection, but if you are essentially giving spammers the keys to the front door via WordPress, there is little we can do. We do run daily malware scans which will attempt to identify spam scripts and we will quarantine those scripts. We also have excellent firewalls which provide local protection so if say the scammer try to execute a root command it will be blocked, but for spam and malware its hard to cacth if they are already in the door.
What can I do to protect myself?
The link below has some great resources on how to proactively protect your site against malware.
see:https://www.elegantthemes.com/blog/tips-tricks/how-to-scan-your-wordpress-website-for-hidden-malware
