Files That Can Send Mass Email

What this check and mySites.guru tool looks at on your site

This check searches every file in your Joomla site’s webspace for the literal word mail, and lists every file where it appears. That includes PHP’s own mail() function, but also anything else the word turns up in: a variable name, a comment, an email address embedded in a template, a class name from a mailing library.

It is a deliberately blunt instrument. Where checks like Files That Can Upload Other Files search for one specific PHP function, this one searches for a plain word, which means it returns more matches and more of them are entirely innocent.

What a working mail relay costs your domain

Attackers who compromise a site frequently install a mail relay or a spam script alongside whatever else they were after, because a compromised site with outbound mail capability is valuable on its own: it sends spam, phishing mail, or malware attachments from a domain with a clean reputation, often for weeks before anyone notices, and usually the first sign is your hosting provider suspending outbound mail or a blocklist listing your domain rather than anything you spot on the site itself.

PHP’s mail() function remains the tool of choice for these scripts, even though there are several other ways to send mail from PHP, because it needs no configuration, no library, and no external dependency: drop one file with mail() in it onto a compromised site and it works immediately, one small piece of the wider pattern covered in finding hacks and backdoors in WordPress and Joomla. Searching for the literal word mail is a crude way to find that, and it is crude on purpose. A narrower search for just the mail() function call would miss scripts that build the function name dynamically to dodge exactly that kind of search, or that wrap it inside another function with an innocuous name. Casting the net wider costs you some reading time; casting it too narrow costs you the actual backdoor.

The other reason it matters is what a working mail relay does to your domain’s reputation, which is a slower and less visible cost than the hack itself. Every message the script sends goes out carrying your server’s IP address and, often, your domain in the sender address. Mailbox providers and blocklist operators track abuse against both, and once either is flagged, it can affect delivery of your own genuine mail, including password resets, order confirmations and anything else your site legitimately sends, for weeks after the backdoor itself is removed. Finding and closing the relay quickly limits how much reputation damage accumulates before you notice. If your host has already suspended outbound mail or your domain has landed on a blocklist, dealing with a hacked Joomla site covers the wider recovery process, not just the mail relay itself.

Every match traced to something you recognise

A list you can account for. On a real Joomla site this will include your contact form component, any newsletter or notification extension you have installed, and template files that reference a support email address, none of which are a problem. What you are looking for is anything you cannot explain: an unfamiliar filename, a file sitting in a folder none of your extensions use, or a file whose surrounding code looks nothing like the legitimate mail-sending code around it.

There is no realistic target of zero matches on an active, healthy Joomla site, so do not treat a non-empty list as a finding on its own. Treat it as a starting inventory, then narrow it down using the steps below until what remains is either explained or escalated.

How to fix it

1. Work through the list looking for anything unfamiliar first, rather than reading every match line by line; most entries will be obviously legitimate once you see the filename and location.
2. Open anything you cannot immediately place and check whether the surrounding code matches what a contact form, newsletter tool or notification system would actually do, or whether it looks like it exists purely to send mail on demand.
3. Check the file’s modification date. A mail-sending file that changed recently, especially one that changed without you making any site updates yourself, deserves particular attention and a closer read.
4. Cross-reference against Files That Can Upload Other Files and Suspect Content, since a mail relay is frequently installed by an upload backdoor that got onto the site first.
5. If you confirm a malicious mail script, follow the cleanup steps on Hacked Files: don’t assume it is the only thing the attacker left behind, and change every password once you have secured the site.

What mySites.guru does about it

There is no one-click fix, because the majority of matches on any real site are legitimate mail-sending code and only a person can tell the difference reliably. This search runs as part of the full audit rather than the fast twice-daily snapshot, so results refresh on the site’s audit schedule, weekly by default or daily or monthly if you have set it differently, and every match is listed for you to review alongside the file’s location and last-modified date.