{"id":3509,"date":"2009-02-27T18:08:55","date_gmt":"2009-02-27T23:08:55","guid":{"rendered":"http:\/\/underhost.com\/blog\/?p=3509"},"modified":"2026-10-23T08:59:14","modified_gmt":"2026-10-23T12:59:14","slug":"track-mail-php-run-nobody","status":"publish","type":"post","link":"https:\/\/underhost.com\/blog\/track-mail-php-run-nobody\/","title":{"rendered":"How to Find the Source of Spam on a cPanel Server (Exim Queue, Logs and Scripts)"},"content":{"rendered":"<div class=\"uh-blog-hero\" style=\"margin:0 0 40px;text-align:center;padding:48px 24px;border-radius:20px;background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;box-shadow:0 20px 40px -15px rgba(13,31,60,0.28);position:relative;overflow:hidden;\">\n<div style=\"display:inline-flex;align-items:center;gap:8px;padding:7px 14px;margin-bottom:16px;border:1px solid rgba(0,212,255,0.32);border-radius:999px;color:#DFF8FF;font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;background:rgba(0,212,255,0.10);\"><i class=\"fas fa-sliders-h\" style=\"color:#00D4FF;\"><\/i> Control Panels<\/div>\n<h1 style=\"color:#ffffff;font-size:clamp(32px,5vw,46px);line-height:1.12;margin:0 0 14px;font-weight:800;\">How to Find the Source of Spam on a cPanel Server (Exim Queue, Logs and Scripts)<\/h1>\n<p style=\"font-size:18px;color:#EAF6FF;max-width:800px;margin:0 auto;line-height:1.7;\">Struggling to track down spam emails on shared hosting? This guide explains how to patch PHP&#8217;s mail function to include headers that identify the source of outgoing emails.<\/p>\n<\/div>\n<div class=\"uh-blog-excerpt\" style=\"border-left:4px solid #00D4FF;padding:18px 20px;margin:0 0 34px;background:#F8FAFC;color:#1F2937;border-radius:0 14px 14px 0;box-shadow:0 8px 28px rgba(13,31,60,0.08);line-height:1.75;\"><strong style=\"color:#0D1F3C;\">Short answer:<\/strong> Look at the mail queue first (<code>exim -bpc<\/code> and WHM&#8217;s Mail Queue Manager) to see who is sending. Then find out how the mail is being sent: by a hacked email account (logins in <code>\/var\/log\/exim_mainlog<\/code> with <code>A=dovecot_login<\/code>) or by a script on a website (the <code>cwd=<\/code> folders in the same log). Stop the source, clear the spam from the queue, then clean the site or reset the password, so it does not start again.<\/div>\n<nav aria-label=\"Table of contents\" class=\"uh-toc\" style=\"background:#ffffff;border:1px solid #E5E7EB;border-radius:16px;padding:20px 22px;margin:0 0 34px;box-shadow:0 4px 12px rgba(13,31,60,0.08);\">\n<div style=\"font-size:12px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;color:#176EA5;margin-bottom:10px;\"><i class=\"fas fa-list\" style=\"color:#00D4FF;\"><\/i> In this guide<\/div>\n<ol style=\"margin:0;padding-left:20px;columns:2 260px;column-gap:28px;line-height:1.9;\">\n<li><a href=\"#signs-that-your-server-is-sending-spam\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Signs that your server is sending spam<\/a><\/li>\n<li><a href=\"#step-1-look-at-the-mail-queue\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 1: look at the mail queue<\/a><\/li>\n<li><a href=\"#step-2-check-for-a-hacked-email-account\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 2: check for a hacked email account<\/a><\/li>\n<li><a href=\"#step-3-check-for-a-script-on-a-website\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 3: check for a script on a website<\/a><\/li>\n<li><a href=\"#step-4-stop-the-source\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 4: stop the source<\/a><\/li>\n<li><a href=\"#step-5-clear-the-spam-from-the-queue\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 5: clear the spam from the queue<\/a><\/li>\n<li><a href=\"#step-6-clean-up-and-prevent-a-repeat\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Step 6: clean up and prevent a repeat<\/a><\/li>\n<li><a href=\"#check-the-cpanel-tools-as-well\" style=\"color:#176EA5;text-decoration:none;font-weight:600;\">Check the cPanel tools as well<\/a><\/li>\n<\/ol>\n<\/nav>\n<div class=\"uh-post-content\" style=\"color:#1F2937;font-size:16px;line-height:1.75;\">\n<h2 id=\"signs-that-your-server-is-sending-spam\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-server\" style=\"color:#00D4FF;\"><\/i> Signs that your server is sending spam<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\">The mail queue grows to hundreds or thousands of messages.<\/li>\n<li style=\"margin:0 0 8px;\">Customers report that their email is rejected or lands in spam.<\/li>\n<li style=\"margin:0 0 8px;\">Your server&#8217;s IP address appears on a blocklist.<\/li>\n<li style=\"margin:0 0 8px;\">Bounce messages arrive for mail your users did not send.<\/li>\n<\/ul>\n<p style=\"margin:0 0 18px;\">Spam from a hosting server almost always comes from one of two places: an email account whose password was stolen, or a hacked website with a script that sends mail.<\/p>\n<h2 id=\"step-1-look-at-the-mail-queue\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 1: look at the mail queue<\/h2>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>exim -bpc                       # number of messages in the queue\nexim -bp | head -n 40           # list the oldest messages\nexim -Mvh MESSAGE_ID            # show the headers of one message\nexim -Mvb MESSAGE_ID            # show the body of one message<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">In WHM, <strong>Email &gt; Mail Queue Manager<\/strong> shows the same list in the browser. Note the sender addresses, the subjects and the time the messages were created.<\/p>\n<h2 id=\"step-2-check-for-a-hacked-email-account\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-shield-alt\" style=\"color:#00D4FF;\"><\/i> Step 2: check for a hacked email account<\/h2>\n<p style=\"margin:0 0 18px;\">When spammers steal an email password, they log in and send through your server. Each message is logged with the account that authenticated. This command counts sent messages per logged-in account:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>grep 'A=dovecot_login' \/var\/log\/exim_mainlog | sed -n 's\/.*A=dovecot_login:\\([^ ]*\\).*\/\\1\/p' | sort | uniq -c | sort -n | tail<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">An account with a very high count, often with logins from many different countries, is the likely source. Change its password at once in cPanel, and ask the owner to check their computer for malware.<\/p>\n<h2 id=\"step-3-check-for-a-script-on-a-website\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 3: check for a script on a website<\/h2>\n<p style=\"margin:0 0 18px;\">When a PHP script sends mail, Exim records the folder it ran from as <code>cwd=<\/code>. This command counts messages by folder and shows the busiest ones:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code>grep 'cwd=' \/var\/log\/exim_mainlog | grep -v '\/var\/spool' | awk -F'cwd=' '{print $2}' | awk '{print $1}' | sort | uniq -c | sort -n | tail<\/code><\/pre>\n<p style=\"margin:0 0 18px;\">A folder such as <code>\/home\/user\/public_html\/wp-content\/uploads\/2026<\/code> with many messages points straight to the script. Look in that folder for unfamiliar PHP files.<\/p>\n<p style=\"margin:0 0 18px;\">To make this easier in the future, turn on <code>mail.add_x_header<\/code> in <strong>MultiPHP INI Editor<\/strong>. PHP then adds an <code>X-PHP-Originating-Script<\/code> header to each message, naming the script that sent it.<\/p>\n<h2 id=\"step-4-stop-the-source\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 4: stop the source<\/h2>\n<div style=\"overflow-x:auto;margin:26px 0;border:1px solid #E5E7EB;border-radius:14px;-webkit-overflow-scrolling:touch;\">\n<table style=\"width:100%;border-collapse:collapse;background:#ffffff;color:#1F2937;font-size:15px;line-height:1.55;margin:0;\">\n<thead>\n<tr style=\"background:#0D1F3C;color:#fff;\">\n<th style=\"padding:14px;text-align:left;\">Source<\/th>\n<th style=\"padding:14px;text-align:left;\">What to do<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Hacked email account<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Change the password, and suspend the account&#8217;s outgoing mail in cPanel until it is safe.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Hacked website<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Rename or remove the sending script, then scan the whole site. Suspend the cPanel account if the spam continues.<\/td>\n<\/tr>\n<tr>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Contact form abuse<\/td>\n<td style=\"padding:14px;border-top:1px solid #E5E7EB;vertical-align:top;\">Add a captcha or a honeypot field, and limit how many messages the form can send.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p style=\"margin:0 0 18px;\">In WHM, <strong>Server Configuration &gt; Tweak Settings<\/strong> lets you limit how many messages each domain can send per hour. A sensible limit stops a hacked site from sending thousands of messages before you notice.<\/p>\n<h2 id=\"step-5-clear-the-spam-from-the-queue\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 5: clear the spam from the queue<\/h2>\n<p style=\"margin:0 0 18px;\">Remove only the spam, not legitimate mail. <code>exiqgrep<\/code> selects messages by sender or recipient:<\/p>\n<pre style=\"background:#0D1F3C;color:#EAF6FF;padding:18px 20px;border-radius:14px;overflow-x:auto;line-height:1.7;font-size:15px;\"><code># Count messages from one sender\nexiqgrep -c -f spammer@example.com\n\n# Remove them (check the count first)\nexiqgrep -i -f spammer@example.com | xargs exim -Mrm<\/code><\/pre>\n<h2 id=\"step-6-clean-up-and-prevent-a-repeat\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-terminal\" style=\"color:#00D4FF;\"><\/i> Step 6: clean up and prevent a repeat<\/h2>\n<ul style=\"list-style:none;padding-left:0;\">\n<li style=\"margin:0 0 8px;\">\u2713 Scan the site with <a href=\"https:\/\/underhost.com\/blog\/how-to-install-linux-malware-detect\/\">Linux Malware Detect<\/a> or ImunifyAV and remove backdoors, not only the mailer.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Update the CMS, themes and plugins, and remove any you do not use.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Change the passwords for the cPanel account, FTP, email and the CMS admin users.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Check whether the server IP is on blocklists, and request removal once the spam has stopped.<\/li>\n<li style=\"margin:0 0 8px;\">\u2713 Review the anti-spam settings in our <a href=\"https:\/\/underhost.com\/blog\/cpanel-tweak-to-prevent-spamming\/\">cPanel spam prevention guide<\/a>.<\/li>\n<\/ul>\n<h2 id=\"check-the-cpanel-tools-as-well\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-clipboard-check\" style=\"color:#00D4FF;\"><\/i> Check the cPanel tools as well<\/h2>\n<p style=\"margin:0 0 18px;\">Account owners can use <strong>Email &gt; Track Delivery<\/strong> in cPanel to search for messages by sender or recipient, and see whether they were accepted, deferred or rejected. In WHM, <strong>Email &gt; Mail Delivery Reports<\/strong> gives the same view for the whole server.<\/p>\n<div aria-hidden=\"true\" class=\"uh-section-divider\" style=\"width:min(100% - 32px, 1080px);margin:44px auto;display:grid;grid-template-columns:1fr 32px 1fr;align-items:center;gap:18px;pointer-events:none;\"><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(0,212,255,0.40),rgba(23,110,165,0.24),transparent);\"><\/span><img alt=\"\" decoding=\"async\" height=\"32\" loading=\"lazy\" src=\"https:\/\/cdn.underhost.com\/android-chrome-192x192.webp\" style=\"width:32px;height:32px;display:block;border-radius:8px;filter:drop-shadow(0 0 14px rgba(0,212,255,0.30));\" width=\"32\"\/><span style=\"height:1px;background:linear-gradient(90deg,transparent,rgba(23,110,165,0.24),rgba(0,212,255,0.40),transparent);\"><\/span><\/div>\n<\/div>\n<div class=\"uh-blog-cta\" style=\"background:linear-gradient(135deg,#0D1F3C 0%,#125A8A 58%,#176EA5 100%);color:#ffffff;padding:36px 24px;border-radius:20px;text-align:center;margin:44px 0;box-shadow:0 20px 40px -15px rgba(13,31,60,0.32);\">\n<h2 style=\"margin:0 0 12px;font-size:28px;line-height:1.25;color:#ffffff;\">Need help with this?<\/h2>\n<p style=\"font-size:17px;margin:0 auto 22px;color:#EAF6FF;max-width:720px;line-height:1.7;\">Spam coming from your server? Our team can trace the source, clean the account and protect your mail reputation.<\/p>\n<p><a href=\"https:\/\/underhost.com\/server-management.php\" style=\"background:linear-gradient(90deg,#00D4FF,#0077FF);color:#ffffff;padding:13px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;\">See server management plans<\/a><a href=\"https:\/\/customerpanel.ca\/client\/\" style=\"background:transparent;color:#ffffff;padding:12px 28px;border-radius:10px;text-decoration:none;font-weight:800;display:inline-block;margin:8px;border:1px solid rgba(255,255,255,0.32);\">Contact @CustomerPanel<\/a><\/div>\n<div class=\"uh-faq-section\" id=\"faq\" style=\"margin:34px 0;scroll-margin-top:90px;\">\n<h2 style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:0 0 18px;border-bottom:2px solid rgba(0,212,255,0.22);padding-bottom:10px;\">Frequently asked questions<\/h2>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">How do I find which account is sending spam on cPanel?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Check the mail queue for the sender, then search \/var\/log\/exim_mainlog for A=dovecot_login (email accounts) and cwd= (scripts) to find the source.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">How do I delete spam from the Exim queue?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Select the messages with exiqgrep, for example exiqgrep -i -f sender@example.com, and pass the IDs to exim -Mrm. Check the count first.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Why does spam show as sent by the account user and not an email address?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Scripts on a website send mail as the account&#8217;s system user. Use the cwd= entries in the Exim log to find the script.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">Can I limit how much mail an account can send?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Yes. Set the maximum hourly emails per domain in WHM Tweak Settings, or per package.<\/p>\n<\/div>\n<div style=\"margin-top:18px;background:#F8FAFC;padding:18px 20px;border-radius:14px;border:1px solid rgba(23,110,165,0.14);\">\n<h3 style=\"color:#0D1F3C;margin:0 0 8px;font-size:19px;\">What should I do after the spam stops?<\/h3>\n<p style=\"margin:0;color:#1F2937;line-height:1.7;\">Clean the site or account, change all passwords, and ask blocklists to remove your IP address once it is clean.<\/p>\n<\/div>\n<\/div>\n<p><!-- uh-related-start --><\/p>\n<div style=\"background:#F4F8FC;border:1px solid #DCE7F3;border-radius:14px;padding:18px 22px;margin:32px 0 8px;\">\n<h2 style=\"margin:0 0 12px;font-size:22px;\">Related guides<\/h2>\n<ul style=\"margin:0;padding-left:20px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/cpanel-tutorials-manage-email-accounts\/\">How to Manage Email Accounts in cPanel (Video Guide)<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/install-emdash-cms-on-cpanel-and-shared-hosting-2026\/\">Install EmDash CMS on cPanel and Shared Hosting (2026)<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/cpanel-backup-and-restore-a-domain-account-via-ssh\/\">How to Back Up and Restore a cPanel Account Over SSH<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/cpanel-backup-via-ssh-single-account\/\">How to Create and Store a cPanel Account Backup Over SSH<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/underhost.com\/blog\/howto-disable-mailman\/\">How to Disable Mailman on a cPanel Server<\/a><\/li>\n<\/ul>\n<\/div>\n<p><!-- uh-related-end --><br \/>\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"How do I find which account is sending spam on cPanel?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Check the mail queue for the sender, then search \/var\/log\/exim_mainlog for A=dovecot_login (email accounts) and cwd= (scripts) to find the source.\"}}, {\"@type\": \"Question\", \"name\": \"How do I delete spam from the Exim queue?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Select the messages with exiqgrep, for example exiqgrep -i -f sender@example.com, and pass the IDs to exim -Mrm. Check the count first.\"}}, {\"@type\": \"Question\", \"name\": \"Why does spam show as sent by the account user and not an email address?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Scripts on a website send mail as the account's system user. Use the cwd= entries in the Exim log to find the script.\"}}, {\"@type\": \"Question\", \"name\": \"Can I limit how much mail an account can send?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. Set the maximum hourly emails per domain in WHM Tweak Settings, or per package.\"}}, {\"@type\": \"Question\", \"name\": \"What should I do after the spam stops?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Clean the site or account, change all passwords, and ask blocklists to remove your IP address once it is clean.\"}}]}<\/script><\/p>\n<h2 id=\"sources\" style=\"color:#0D1F3C;font-size:28px;line-height:1.25;margin:34px 0 14px;scroll-margin-top:90px;\"><i class=\"fas fa-book\" style=\"color:#00D4FF;\"><\/i> Sources<\/h2>\n<ul style=\"margin:0 0 24px;padding-left:22px;\">\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/www.exim.org\/exim-html-current\/doc\/html\/spec_html\/ch-exim_utilities.html\">Exim documentation: exim and exiqgrep utilities<\/a><\/li>\n<li style=\"margin:0 0 8px;\"><a href=\"https:\/\/docs.cpanel.net\/whm\/email\/mail-queue-manager\/\">cPanel documentation: Mail Queue Manager<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Struggling to track down spam emails on shared hosting? This guide explains how to patch PHP&#8217;s mail function to include headers that identify the source of outgoing emails.<\/p>\n","protected":false},"author":1,"featured_media":5015,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,81,25],"tags":[108,143,136,127,185,109],"class_list":["post-3509","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-control-panels","category-hosting-guides","category-linux","tag-tag-cpanel","tag-email-deliverability","tag-tag-exim","tag-tag-malware-protection","tag-php","tag-tag-whm"],"_links":{"self":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3509","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/comments?post=3509"}],"version-history":[{"count":11,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3509\/revisions"}],"predecessor-version":[{"id":6974,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/posts\/3509\/revisions\/6974"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media\/5015"}],"wp:attachment":[{"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/media?parent=3509"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/categories?post=3509"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/underhost.com\/blog\/wp-json\/wp\/v2\/tags?post=3509"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}