What to Do When Your HestiaCP Email Account Is Hacked

HestiaCP can manage mail domains and mailboxes on a server, but the person who owns a mailbox may not administer the server itself. If a Hestia-hosted address is sending spam or exposing incoming mail, reset its mailbox password, inspect Hestia’s account-level routing options, and involve the server administrator for log review or active-session response.

Make sure HestiaCP is hosting the mailbox

Use these steps when the email domain and mailbox appear under the Mail tab in HestiaCP. A domain’s website or DNS can be managed in Hestia while its email is hosted by another company, so confirm where the mailbox actually lives before changing credentials.

Write down what happened and when. Keep representative suspicious messages, full headers, delivery reports, and unusual destinations. Tell the server administrator what you have already changed; avoid deleting evidence while they are investigating.

Reset the mailbox password and update clients

In HestiaCP, open Mail, click the mail domain, find the affected account, and use its edit control to set a new unique password. Open the domain’s Mail account list to edit the mailbox settings. Do not reuse the password used to sign in to HestiaCP.

Update the password in all legitimate IMAP, POP3, and SMTP clients that use this mailbox. This can include phones, desktop mail programs, printers, website software, and contact forms. Remove clients or devices you do not recognize. If your device may be infected, secure it before entering the new password.

If you suspect the HestiaCP login itself was stolen, secure that panel account and ask the server administrator to review panel access. A HestiaCP account and an individual mailbox are separate credentials, though anyone who controls the panel account may be able to change mailbox settings.

Inspect Hestia aliases and mail forwarding

Edit the affected account and review Aliases, Forward mail, and Do not store forwarded mail. Remove aliases or forwarding destinations that you did not configure. Hestia’s forward option forwards incoming messages; the separate “Do not store forwarded mail” option controls whether forwarded mail is retained in the mailbox.

Check whether Discard all mail is enabled. That setting causes incoming mail to be deleted rather than forwarded, so an unexpected setting can make messages seem to vanish. Review the mail domain and other accounts for changes if the problem affects more than one address.

Check autoresponders and any filters in the installed webmail client, such as Roundcube or SnappyMail. If the interface does not expose the rule you need, ask the administrator to inspect the mail server configuration rather than guessing at server files.

Ask the server administrator to investigate

HestiaCP is often self-managed. If you do not administer the server, send the owner or hosting provider the affected address, timestamps, message examples, and list of changes made. Ask them to review Exim and Dovecot logs, the outgoing queue, suspicious SMTP/IMAP authentication, and whether other mailboxes are affected.

If unauthorized sending continues, the administrator may need to suspend the mailbox temporarily, restrict outgoing mail, terminate active connections, or investigate a compromised website or server account. Those actions can affect legitimate mail, so they belong with the person responsible for the server.

If you do administer the server, preserve relevant logs and coordinate containment before making broad changes. Command names and service paths can vary across versions and custom installations.

Check mail delivery and notify affected people

Once the administrator says the mailbox is under control, test normal sending and receiving, verify each intended alias and forward, and make sure all known clients use the new password. Confirm the mail domain is still configured to use Hestia if that is your intended mail host.

Warn recipients using a trusted channel if attackers sent messages from the account. Tell them to ignore links, attachments, payment changes, and password requests in the suspicious messages.

If you need help securing a hosted mailbox or investigating suspicious mail activity, contact Cyber Damage Control to discuss the next steps for your hosting setup.