The Abuse Complaint Forwarded by Your Host

An email from the host

The message arrives from your hosting company with a subject line about abuse. It forwards a complaint: a page on your website is pretending to be a bank's login, or your account is sending spam.

There is a deadline, often a day or two, after which the host will suspend the account. Sometimes the offending file has already been disabled.

Most owners' first reaction is that it must be a mistake. Nobody at the business built a bank login page.

Nobody did. Someone else did, on your site, without asking.

What the complaint usually means

The site has been broken into, most often through outdated software: an old version of WordPress or Joomla, or a plugin or theme that has not been updated in years.

Sometimes the way in was a stolen password instead, for the hosting account, the FTP account or an administrator login.

Once inside, the attacker uploads a ready-made fake login page, or a script that sends mail. The business is not the target. Its website is the tool, used against strangers.

Who sends these complaints

• Banks and payment companies, whose security teams search for copies of their login pages.
• Anti-phishing groups that collect reports from the public.
• Spam blocklist operators, who track where junk mail comes from.
• Other hosts, whose customers received the spam.
• People who received the email and complained to your host.

The first group moves fastest. A fake login page collects real customers' passwords for as long as it stays up, so banks want it gone within hours.

Answer the host the same day

Reply quickly, even before anything is fixed. Say that you have received the complaint, who is dealing with it and when you will report back.

Ask what the host has already disabled and whether its logs show when the files appeared. That date tells you how far back a clean backup has to go.

A host that hears nothing assumes nobody is looking after the site, and suspension follows. A suspension often takes the email on the same account down with it.

Deleting one file is not enough

The tempting fix is to delete the file named in the complaint and reply that it is done.

But the named file is rarely the only one. Break-ins usually leave a back door, a small script that lets the attacker return, often disguised with an ordinary file name.

And the hole that let them in is still open. Within days there is a new page in a new folder, and a second complaint.

A worked example

A copywriter who works from home has a portfolio site built on WordPress four years ago: writing samples, a biography and a contact form. Nobody had updated it since the week it launched.

Her host forwarded a complaint from a bank's fraud team about a fake login page in a folder inside the uploads directory, with forty-eight hours to respond.

She deleted the folder and replied that it was gone. Five days later a second complaint arrived, this time about spam, and the host suspended the account, email included.

The cause was still there: an abandoned gallery plugin with a known flaw, and three back door scripts tucked into the theme and the uploads.

A proper cleanup removed the scripts and an extra administrator account, deleted the gallery plugin and two unused themes, updated everything else and changed every password.

The report to the host listed each step, and the suspension was lifted. The site is now updated every month under a maintenance arrangement.

Finding everything that was added

Take a full copy of the site and its database first, as evidence and for comparison. Do not restore from it.

Then look at the folder named in the complaint, at files changed around the same date, and at any PHP file sitting in the uploads, since that folder is meant for images and documents only.

Check the list of administrator accounts, and compare the core files with a fresh download of the same version. The host's malware scan, if it offers one, is a useful second opinion.

Look in the database as well. Some break-ins add hidden links or scripts to posts and settings rather than to files.

Closing the way in

Update the core software, every plugin and every theme. Delete anything unused, including old test copies of the site in other folders.

Change every password connected to the site: the hosting control panel, FTP, the database, each administrator and the email accounts.

If the software is too old to update, as with a site still on Joomla 1.5, the honest fix is a rebuild on a supported version.

Then make updates a routine, monthly at least, with one person named as responsible. The automated tools that found the site once will keep testing it.

Reporting back and checking outside

Tell the host what was found, what was removed, what was updated and which passwords were changed. Ask them to confirm the complaint is closed.

Then open Search Console, which until last week was called Webmaster Tools, look for security issues, and request a review if Google has flagged the site. Until then, browsers may show visitors a warning page instead of your site.

If spam was sent, ask the host whether the server's address landed on any blocklists, since that can stop your own email from being delivered.

The counter-case

Occasionally a complaint is mistaken, flagging a legitimate page, or a newsletter someone forgot signing up for. Answer it the same day anyway, with the evidence.

Sometimes the host's own scanner has already removed the files. That deals with the symptom, not the cause.

And if nobody has been looking after the site, this is the moment to arrange it, before a second complaint arrives.

Either way, the response is the same: answer quickly, find everything, close the hole and report back.

The same day

1. Reply to the host and name who is handling it.
2. Copy the site and database as evidence.
3. Find every added file, not just the named one.
4. Update or remove every plugin and theme.
5. Change every password connected to the site.
6. Report back with what was found and fixed.
7. Check Search Console for security warnings.

Step three decides whether there is a second complaint. Removing only the file named in the first leaves the back door and the original hole, and both get used again.

Why people type passwords into fake pages despite the warnings is covered in staff who click through certificate warnings.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.