What to Do When Your Plesk Email Account Is Hacked
A compromised mailbox in Plesk can leak incoming messages, send spam, or be used to impersonate your business. Changing the password matters, but check Plesk’s forwarding settings as well, then have the hosting provider review server activity if the problem continues. These steps apply to mail hosted by Plesk; a mail app such as Outlook is only a client unless it hosts the mailbox itself.
Confirm that the mailbox is hosted in Plesk
Use this guide for an address on your domain that is managed from the Plesk Mail screen. If the address is actually hosted by Google Workspace, Microsoft 365, or another mail provider, recover it with that provider. Your website and DNS may still be managed in Plesk while email is hosted somewhere else.
Before changing settings, record the time and symptoms: suspicious messages, unexpected password-reset notices, delivery failures, or messages disappearing from the inbox. Save a few examples or full headers for the host. Avoid deleting messages that may help establish what happened.
Change the mailbox password
Sign in to Plesk, open Mail, select the affected email address, enter a new unique password, and save. Plesk does not reveal an existing mailbox password; it must be reset. Do not reuse your Plesk control-panel password.
Update the password in every mail client and device you own, including phones, desktop apps, scanners, website forms, or other software that sends through this mailbox. Remove access from old or unfamiliar devices. If you cannot sign in to Plesk or suspect the Plesk user account is compromised, contact the hosting provider and secure that control-panel login separately.
Check whether “Can be used to log in to Plesk” was enabled for this email account. In some configurations, the mailbox password can also be used to access Plesk as an additional user. Ask the provider to review or disable that access if it was not intended.
Check the Plesk Forwarding tab
Go to Mail → the affected email address → Forwarding. Turn off forwarding to addresses you do not recognize, then save. Plesk’s forwarding page can keep copies in the Plesk mailbox by default; also inspect the option that controls whether forwarded copies remain there.
Check each address on the domain, not only the compromised one. An attacker with sufficient panel access may add another mailbox forwarder. Look for an address outside your organization, misspellings that resemble a legitimate account, or a destination that you cannot verify.
Review mailbox rules or webmail filters if your installed mail client provides them. Check automatic replies and recent sent mail too. If the issue is domain-wide, ask the Plesk administrator to inspect domain mail settings, aliases, and server-level routing.
Get the Plesk administrator or host involved
If spam continues after the password change, ask the provider to review the mail server logs, outgoing queue, recent authentication, and any active mail connections. Ask them to block further abuse and check whether other mailboxes on the subscription are affected.
Plesk’s available mail controls and connection handling depend on the host’s configuration and the mail service in use. A mailbox owner may not have permission to inspect server logs or end active server sessions. Do not try to change server-wide mail settings unless you administer the server.
If a website, contact form, or script may have sent the messages, ask the host to check it separately. A mailbox password reset will not fix a vulnerable website script or stolen Plesk account.
Restore normal use and limit further harm
Warn contacts through a known-good channel if the account sent suspicious requests. Tell them not to open links or attachments or send funds based on those messages.
After the host confirms the account is under control, test sending and receiving, check that forwarding is either removed or intentionally configured, and verify your mail apps use the new password. If the mailbox is used for password resets, review alerts and recovery settings on those services.
If you need help beyond mailbox settings, contact your hosting provider with the timeline and the checks above; they can review the Plesk subscription and mail server.