Free tools Windows power users keep installed
One-click scans. No signup required.
If mail sent by www-data is filling your queue, treat the event as a compromised web application until you prove otherwise. Preserve the mail and web logs first, identify the PHP script, scheduled task, upload, or stolen credential submitting messages, then restrict the transport used by the web account. A quick block can stop delivery, but lasting protection requires fixing the entry point and choosing an explicit mail policy.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The safest design is to prevent unauthenticated web processes from relaying to arbitrary Internet recipients. If the application must send notifications, give it a narrowly scoped authenticated SMTP submission account and monitor its queue and volume. If it does not need mail, disable or replace PHP’s local sendmail path for the web SAPI.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What www-data is—and why it appears in spam reports
www-data is the service account commonly used by web servers and PHP workers on Debian- and Ubuntu-derived systems. It is not normally a person. When a message log attributes mail to that UID, a web request or background PHP worker probably invoked the server’s sendmail-compatible transport. The account itself is therefore an attribution clue, not the root cause.
PHP’s mail() function does not deliver directly to recipients. On Unix-like systems it passes the message to the configured sendmail-compatible program, whose behavior is controlled by PHP’s sendmail_path setting and the local mail-transfer agent (MTA). The same path can be used by legitimate password resets and contact forms or by an injected web shell. PHP’s manual cautions that acceptance by the local mail system does not guarantee delivery to the destination.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Common origins include a vulnerable CMS extension, an uploaded web shell, unsafe file permissions, a scheduled task, application code that calls mail() or executes a sendmail wrapper, and SMTP or API credentials exposed in a configuration file. Do not assume one vector without evidence; investigate the process, file and credential trail on the affected host.
What to do in the first 30 minutes
- Preserve evidence before cleanup. Record the current time in UTC, copy the MTA log, queue listing, web access and error logs, PHP-FPM or Apache process information, and any alert showing senders or recipients. Make read-only copies where practical. Do not delete the queue or suspicious files before saving representative messages and their headers.
- Reduce harm without destroying attribution. If the queue is growing rapidly, temporarily stop outbound delivery or place new mail on hold using the administrative procedure documented for your MTA. A network egress block is an additional emergency measure, but keep the local logs and queue metadata intact.
- Map messages to an account and process. Search the MTA log for envelope sender, queue ID, executable, UID and timestamps. Correlate those times with web requests, PHP-FPM workers, cron entries and process execution records. On Linux systems with auditing enabled,
auditdrecords can be searched withausearchand summarized withaureport. - Find and close the entry point. Inspect recently modified PHP files, writable upload directories, plugins and themes, scheduled tasks, web shells, environment files, and leaked SMTP or API keys. Compare files with a known-good release rather than merely deleting a suspicious line.
- Rotate and repair. Patch the CMS and extensions, remove persistence, rotate every mail credential that may have been readable by the web process, review privileged accounts, and restart from a clean process identity. Assume a credential is compromised if it was present in a readable web directory.
- Apply a transport policy and test it. Decide whether this site needs mail. Disable local PHP submission when it does not; otherwise require authenticated SMTP submission with least privilege, recipient and volume controls, and monitoring. Release held mail only after the source is fixed.
Preserve the evidence that identifies the sender
Mail headers alone may show a forged From address, so begin with the envelope and queue records. Save the queue ID, envelope sender, recipient count, arrival time, authenticated identity (if any), client address, executing UID and the command or transport that accepted the message. Keep the original log files and a working copy for searches.
Web logs provide the request path, method, status and remote address at the same time the message was submitted. PHP-FPM and Apache logs can show the pool, worker and script. Process listings and open-file information can reveal a shell or interpreter still running under www-data. If your host uses Linux audit rules, preserve the relevant execution records before log rotation; ausearch can filter execution events and aureport can summarize them.
Use a consistent time zone when correlating sources. A five-minute difference caused by local time, UTC and MTA timestamps can send an investigation toward the wrong request. Keep a copy of the system’s time-synchronization status and note any gap in logging.
Map queue activity to the web account
Postfix and similar MTAs
Search for the queue ID across the MTA log, then follow every line associated with it. Look for the submitting client, SASL identity, cleanup or pickup service, envelope sender, delivery status and the UID or executable recorded by your integration. The key question is whether the message entered through local submission as www-data, through an authenticated SMTP account, or through an unintended relay path.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Postfix’s normal relay model is moderately restrictive: trusted networks and SASL-authenticated clients may relay, while unauthenticated destinations are deferred or rejected. If your logs show unauthenticated Internet recipients being accepted, treat that as a policy failure as well as a possible compromise.
Recommended Free Tools
Exim and shared hosting panels
Exim installations and hosting panels can apply different trusted-user and sender rules. Those rules affect which envelope sender data is accepted and how the account is attributed. Prefer per-account execution and logging that records the actual sender, rather than allowing every virtual host to appear as one generic system user. A panel’s account-level log can distinguish one compromised site from other tenants only if the runtime and MTA preserve that identity.
What a queue pattern tells you
- Many unrelated recipients and rapidly increasing queue IDs: likely abuse from a script, shell or stolen credential.
- Only one site’s domain and a small number of expected recipients: could be a legitimate notification path; verify the application before blocking it.
- Messages accepted with a SASL identity you do not recognize: rotate that credential and inspect every host or application that used it.
- MAILER-DAEMON or unknown-recipient buildup: recipient validation and rejection policy may be missing, allowing undeliverable traffic to consume the queue.
Find the PHP script, task or credential
Search code and recent changes
Inventory PHP calls to mail(), proc_open(), shell_exec(), system-command wrappers and libraries that invoke sendmail. Search the web root, deployment directories and writable storage, not just the main application directory. Review file modification times against the first suspicious queue event. A recently changed image, cache or upload directory containing executable PHP deserves the same attention as a changed plugin.
Compare suspicious files with the vendor’s published package or a trusted deployment artifact. Obfuscated variable names, long encoded strings, dynamically constructed function names and code hidden in image or cache files are useful indicators, but a clean-looking file does not prove that the host is clean.
Check scheduled execution and persistence
Review the web account’s user crontab, system cron directories, timer units, deployment hooks and queue workers. A malicious task can continue sending after the vulnerable request is gone. Check startup scripts and application-level schedulers as well as operating-system jobs.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Inspect uploads and permissions
Web-writable directories should not generally execute PHP. Verify the web server’s handler rules, ownership and mode bits, and inspect for recently uploaded files with executable extensions or double extensions. Tightening permissions without removing an already-running process will not stop current abuse; contain the process and then correct the directory policy.
Audit secrets
Search environment files, configuration backups, logs and source repositories for SMTP passwords, API tokens and private keys readable by www-data. Rotate them at the provider and in the application, then invalidate old sessions or tokens where the service supports it. A password change alone is insufficient if a scheduled task or backdoor can read the replacement.
Contain outbound delivery without losing control
Choose the smallest containment action that stops abuse while preserving the evidence you still need. Temporarily stopping the MTA limits delivery but may interrupt every site on the host. Holding or deferring the queue can preserve messages for analysis. A firewall egress rule can stop direct connections, but it does not prevent a local queue from filling and should not replace MTA policy.
Before releasing any held messages, remove the malicious process or file, restart the affected PHP pool or web service from a clean deployment, and test with a controlled recipient. Keep a record of what was held, discarded or released. Deleting the queue immediately can erase the only copy of a malicious message and its headers.
Postfix: enforce a closed relay policy
Inspect the live value of smtpd_relay_restrictions rather than assuming a distribution default. The documented pattern is:
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
permit_mynetworks, permit_sasl_authenticated, defer_unauth_destinationIn this model, hosts explicitly listed as trusted may relay, clients that authenticate successfully may relay, and unauthenticated attempts to outside destinations are deferred. Adapt the trusted networks to your topology; do not add an entire hosting subnet merely to make one application work.
Review older configurations that put broad permit rules in recipient restrictions. A permissive recipient policy can unintentionally create an open relay even when the administrator believes relay control is enabled. Test from both a trusted local context and an unauthenticated external context, and verify the resulting log decision.
For applications that must send, separate submission from server-to-server delivery. Require SASL authentication on the submission service, authorize only the needed sender identities, and apply per-account rate or recipient limits where your MTA or relay supports them. Keep credentials out of a web-accessible directory and make revocation independent for each application.
PHP: control sendmail_path for every SAPI
PHP documents /usr/sbin/sendmail -t -i as the usual default sendmail path, but the effective value can differ by distribution and SAPI. Check the CLI configuration, the PHP-FPM pool used by the site, and any Apache PHP module separately. A change made to the CLI configuration may leave the web pool untouched.
- Record the current value and the configuration file that supplies it. A CLI check such as
php -i | grep sendmail_pathshows only the CLI SAPI, so verify the web SAPI through its own diagnostic method and remove that diagnostic file afterward. - If the site has no legitimate local mail requirement, disable the sendmail path for the web SAPI or point it to a controlled wrapper that logs and rejects attempts. Confirm that the wrapper cannot be used to execute arbitrary arguments.
- If notifications are required, point the application to an authenticated SMTP library or submission endpoint instead of restoring unrestricted local mail. Store the credential outside the document root and restrict its permissions.
- Restart the PHP-FPM pool or web service after changing configuration, then send a test notification and verify both the application result and MTA log.
Disabling local mail is a strong containment measure, but it can break password resets, contact forms, billing notices and game-server alerts. Test every required notification path before making the change global.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Choose the durable fix
| Control | Legitimate application mail | Site or user attribution | Credential revocation | Queue and rate visibility | Operational blast radius |
|---|---|---|---|---|---|
| Disable or reject PHP local mail | Stops it unless the application is redesigned | Strong for identifying attempted calls, if the wrapper logs them | Not applicable to local submission | High visibility for rejected attempts; no outbound queue from that path | Can affect every PHP application using that SAPI |
| Authenticated SMTP submission | Preserves mail through an explicit channel | Depends on separate credentials and logging per site | Can revoke one account without stopping others | Supports relay-side limits and account-level monitoring | Requires credential, TLS and policy management |
| Per-account execution and sender attribution | Preserves existing behavior | Best for distinguishing tenants and compromised sites | Depends on how each account submits | Improves investigation; limits vary by platform | Requires hosting/runtime support and careful isolation |
Use the first option when the site does not send mail. Use authenticated submission when notifications are essential and you can manage credentials and limits. On shared or multi-site systems, add per-account execution and sender attribution so one compromised site does not hide among unrelated traffic.
Protect the queue and recipient policy
Reject unknown recipients where that is appropriate for your role as a relay. Postfix documents this as a way to prevent queues filling with undeliverable MAILER-DAEMON messages, while noting that recipient probes during dictionary attacks can add load. Balance rejection with the recipient verification information your environment can reliably provide.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Set practical limits on message size, recipients per message, concurrent submissions and per-account volume where supported. Limits are containment controls, not a substitute for patching: a compromised script can still send a damaging amount of low-volume mail over time. Alert on sudden changes in envelope senders, recipient domains, queue age and authenticated identities.
Verify the repair
- From a clean deployment, trigger one legitimate notification and confirm the expected queue and delivery log entries.
- Run a controlled unauthenticated test from outside the trusted network. It must not be able to relay to an arbitrary external recipient.
- Attempt the same operation as the web account when local PHP mail is supposed to be disabled. The attempt should be rejected or logged by the wrapper, not silently accepted.
- Confirm that old SMTP and API credentials no longer authenticate and that no unauthorized cron job, timer or PHP process remains.
- Monitor the queue, MTA logs, web logs and audit records through at least one normal traffic cycle. A quiet queue immediately after cleanup does not prove that persistence is gone.
Common mistakes that let spam return
- Deleting the queue first: removes evidence and can conceal the submitting account.
- Changing only the visible From header: does not stop envelope-level abuse or relay access.
- Editing one PHP configuration file: leaves another SAPI, pool or virtual host able to call sendmail.
- Allowing an entire private network to relay: turns a network trust assumption into a broad compromise path.
- Rotating one password: leaves copied credentials, API tokens and scheduled persistence active.
- Blocking port 25 alone: may stop direct delivery while the local queue continues to grow or an authenticated submission path remains abused.
- Releasing held mail without a clean process: sends the attacker’s backlog as soon as the MTA resumes.
A practical decision rule
First ask whether the affected web application genuinely needs to send mail. If the answer is no, remove its local sendmail capability and monitor for rejected attempts. If the answer is yes, move it to authenticated SMTP submission with an account dedicated to that site, least-privilege sender permissions, protected secrets and observable limits. If multiple sites share one host, add per-account execution and sender attribution so a future incident can be isolated quickly.
Keep the MTA’s relay policy restrictive even after the immediate incident ends. The web account should never be able to turn a local PHP function into unrestricted Internet relay access, and every exception for legitimate notifications should be explicit, testable and independently revocable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
