{"id":3509,"date":"2009-02-27T18:08:55","date_gmt":"2009-02-27T23:08:55","guid":{"rendered":"http:\/\/underhost.com\/blog\/?p=3509"},"modified":"2025-03-07T08:19:04","modified_gmt":"2025-03-07T13:19:04","slug":"track-mail-php-run-nobody","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/track-mail-php-run-nobody\/","title":{"rendered":"Updated MARCH 2025: How to Track PHP Mail Function Usage on Shared Hosting"},"content":{"rendered":"<h2><strong>Problem: Tracking Spam Emails on Shared Hosting<\/strong><\/h2>\n<p>\nOne of the biggest challenges with shared hosting is that PHP runs under the web server user instead of the actual account owner (unless PHP is running as CGI or using suPHP).\n<\/p>\n<p>\nThis creates a significant problem when a website is compromised and used for spamming. Since all emails originate from the same server user, it becomes difficult to track down which website, script, or page is responsible.\n<\/p>\n<h2><strong>Solution: Add PHP Mail Headers for Better Tracking<\/strong><\/h2>\n<p>\nA simple solution to this issue is applying a patch that modifies PHP\u2019s <strong>mail.c<\/strong> file. This patch adds an <strong>X-PHP-Script<\/strong> header, which records the exact script location from which an email originates.\n<\/p>\n<p>\nFor example, when an email is sent, the header will contain:\n<\/p>\n<blockquote><p>\n<strong>X-PHP-Script:<\/strong> <a href=\"http:\/\/www.example.com\/~user\/testapp\/send-mail.php\" target=\"_blank\">www.example.com\/~user\/testapp\/send-mail.php<\/a> for 10.0.0.1\n<\/p><\/blockquote>\n<p>\nThis information allows you to quickly track down spam sources and take necessary action.\n<\/p>\n<h2><strong>How to Apply the PHP Mail Header Patch on cPanel Servers<\/strong><\/h2>\n<p>\nFollow these steps to implement the patch on a cPanel server:\n<\/p>\n<h3><strong>Step 1: Create a Patch Script<\/strong><\/h3>\n<p>\nRun the following commands as the root user:\n<\/p>\n<pre>\r\nmkdir -p \/var\/cpanel\/buildapache\/scripts\r\ncat &gt;&gt; \/var\/cpanel\/buildapache\/scripts\/phppost &lt;&lt; EOF\r\n#AUTO PATCH FROM http:\/\/choon.net\/php-mail-header.php\r\nPHPVER=`find -type d -iname \"php-*\"|sed \"s\/.\/\/\/g\"`\r\nwget http:\/\/choon.net\/opensource\/php\/$PHPVER-mail-header.patch\r\npatch -p0 &lt; $PHPVER-mail-header.patch\r\nEOF\r\n<\/pre>\n<h3><strong>Step 2: Rebuild Apache with EasyApache<\/strong><\/h3>\n<p>\nOnce the patch script is created, rebuild Apache using EasyApache:\n<\/p>\n<pre>\r\n\/scripts\/easyapache\r\n<\/pre>\n<p>\nThis will compile PHP with the new mail header patch, allowing you to track the source of emails sent via PHP\u2019s mail function.\n<\/p>\n<h2><strong>Additional Security Tips<\/strong><\/h2>\n<ul>\n<li><strong>Enable suPHP<\/strong>: Run PHP scripts under individual user accounts instead of the shared web server user.<\/li>\n<li><strong>Use SMTP Authentication<\/strong>: Prevent unauthorized email sending by requiring authentication for outgoing mail.<\/li>\n<li><strong>Monitor Email Logs<\/strong>: Regularly check <code>\/var\/log\/exim_mainlog<\/code> for unusual email activity.<\/li>\n<li><strong>Limit PHP Mail Usage<\/strong>: Restrict the number of emails a single account can send per hour in cPanel\u2019s Exim configuration.<\/li>\n<\/ul>\n<h2><strong>Need Secure Web Hosting? Choose UnderHost!<\/strong><\/h2>\n<p>\nIf you&#8217;re running a website on shared hosting and want better security, consider switching to a <a href=\"https:\/\/underhost.com\/cloud-vps.php\">Cloud VPS<\/a> or <a href=\"https:\/\/underhost.com\/dedicated-servers-offshore.php\">Dedicated Server<\/a> for full control over mail functions and security patches.\n<\/p>\n<p>\nGet expert support anytime at <a href=\"https:\/\/customerpanel.ca\/client\">UnderHost Customer Panel<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Struggling to track down spam emails on shared hosting? This guide explains how to patch PHP&#8217;s mail function to include headers that identify the source of outgoing emails.<\/p>\n","protected":false},"author":1,"featured_media":5015,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,11,25],"tags":[],"class_list":["post-3509","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-controlpanel","category-how-to","category-linux"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=3509"}],"version-history":[{"count":3,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3509\/revisions"}],"predecessor-version":[{"id":5089,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3509\/revisions\/5089"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/5015"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=3509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=3509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=3509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}