Why spammers keep getting in

Before you can lock down a site that's been hit by spam, you need to know which weakness let the attacker in. The most common entry points fall into a few distinct categories, each with its own warning signs and fixes.

Weak and reused credentials

Password guessing is still one of the simplest ways in. Attackers cycle through common passwords or brute-force random combinations until something sticks. The defense starts with choosing a password that isn't easy to guess.

Two habits matter more than anything else:

  1. Never reuse a password across services. Once a username and password combo works on one site, attackers immediately try it on dozens of others. A unique password contains the damage.
  2. Turn on two-factor authentication (2FA), such as Google 2-Step Verification. A second credential via text-message code or dynamically generated PIN blocks access even if the password leaks. Many CMS platforms have official guides for setting this up, including Joomla!, WordPress, and Drupal.

Outdated software

Old versions of software carry known, high-risk vulnerabilities that attackers actively scan for. The longer a vulnerability goes unpatched, the more exposed the entire site becomes. This applies to:

  • Web server software, if you host your own servers
  • Your content management system (CMS), such as WordPress, Drupal, or Joomla!
  • Every plugin and add-on running on the site

Security releases exist for a reason. Skipping them is an open invitation.

Insecure themes and plugins

Plugins and themes add functionality, but outdated or abandoned ones are a primary source of vulnerabilities. Keep everything current and delete anything no longer maintained.

Be especially wary of free plugins or themes from untrusted sources. A common tactic is to bake malicious code into a free copy of a paid product. And when you do remove a plugin, delete all of its files from the server—disabling it isn't enough.

Social engineering and phishing

Social engineering bypasses technical controls by targeting people. Phishing is the most common form: an email that impersonates a legitimate organization and asks for confidential information like passwords.

The rule is simple—never share passwords, credit card numbers, banking details, or even your date of birth unless you're certain who's asking. If multiple people administer the site, train them to recognize these attacks.

Security policy gaps

For system administrators and self-hosters, weak policies can undo strong technical defenses. Common mistakes include:

  • Allowing users to set weak passwords
  • Granting administrative privileges to people who don't need them
  • Running without HTTPS so logins traverse plain HTTP
  • Accepting file uploads from unauthenticated users with no type checking

To close those holes: disable unnecessary services, test access controls and privilege levels, encrypt pages that handle sensitive data (especially login pages), and review server logs regularly for suspicious activity.

Data leaks

Data leaks happen when confidential information is uploaded and then misconfigured so it becomes publicly accessible. Even mundane things like web application error messages can reveal configuration details. Attackers often use a technique called "dorking"—crafting search queries to locate exposed data through search engines.

Periodically audit your site for sensitive information and restrict anything confidential. If you find exposed data that needs urgent removal from Google Search, the URL removal tool lets you request its deletion.