Site was forced down, is back up (Patreon)

As I posted in the beginning of January, we've been having a lot of email troubles recently. Emails from the site had started getting marked as spam, which started getting us on deny lists in email centers and was causing people to not get legitimate emails from the site. We don't send any marketing emails at all, so this was both frustrating and worrying.

Since then, I've been focusing a lot on trying to track down the problem. I kept checking and adding more layers of security. My host would give me the greenlight, and then after a few days/weeks I'd receive another warning or be put on another deny list. On Sunday, the host threatened that they would shut the server down if things weren't fixed soon.

If spam is coming from the Backloggery server, the two obvious causes are hacking/malware or web form abuse.

I'd seen no signs of being hacked and no unusual files on the server, but given the threat of being shutdown, I hired a company to scan the server for malware and make sure everything was clean. Everything came back clean: no malware, no strange files, no signs of a hack. But a company like that isn't going to vet your code for you, so the problem could be there.

Having crossed that off, I turned my attention to form abuse. For the non-web devs out there, the basic idea is using certain methods to send more information through a form than is expected, and if the right holes are found, a web form that fires off a contact us email or an account activation email could be used to send spam to other email addresses.

I use a very popular library, PHPMailer to clean form input and send emails. I also use session based token matching to ensure the data is coming from the right form and a POST allow list to ensure no extra, unexpected data is being sent along when the form is submitted. I even added a reCaptcha, despite my hatred of them.

None of this has been enough to stop whatever is going on. My last idea was to pay for a service that provides a firewall/DDoS protection/etc, similar to Cloudflare. Unfortunately, the host decided to shutdown the server before I was finished setting that up.

I'm submitted a request to bring the server back up and am currently waiting for an answer. Assuming that happens, and in case the firewall doesn't help, I'd like to ask any web devs out there for any additional ideas on possible steps I could take or vulnerabilities I've overlooked. Please message me here or on Discord/Twitter.

I'm so sorry about this. Site downtime has always been a major source of stress for me, doubly now that this is my only source of income, so you can count on this getting my undivided attention until it is resolved. But for now I just have to wait.

Annnnd... just as I was about hit submit, the server comes back online. I'm gonna get that firewall in place.  I'll keep you posted!

Edit: Firewall is active, but still waiting on the company to add the new SSL cert. Sorry for the privacy warnings!