Procédure

LPI-RATE01 and LPI-RATE11 error codes: too many emails sent from your site

The LPI-RATE01 and LPI-RATE11 codes appear when a site sends a large number of emails using the PHP mail() function.

They can be triggered by particularly heavy normal activity, but also by a hijacked form, a misconfigured extension, or a compromised site. This help will help you find the source of the sends and prevent the problem from happening again.

Understanding the LPI-RATE01 and LPI-RATE11 codes

These two codes monitor emails sent with the PHP mail() function, also referred to as mail_php in LWS tools.

The temporary block protects your hosting and the reputation of its sending servers. Waiting for it to end is not enough, however: you must look for the cause of the overrun to prevent it from happening again.

Finding the emails sent by your site

From the management of your hosting in the LWS Panel, open the Mail tracking tool.

Select a period corresponding to the time when the code was detected, then search for emails sent from your domain.

Messages coming from the PHP mail() function are identified with a technical sender in the form:

mail_php@yourdomain.ext

This sender is not a real mailbox. It indicates that the message was generated directly by a site or script installed on your hosting account.

Check in particular:

• the date and time of the sends;
• the number of messages concerned;
• the recipients;
• the subject of the messages, when available;
• their delivery status.

Then try to determine whether these sends correspond to expected activity on your site.

You recognize the sends

The emails may come from a normal action, for example:

• order confirmations;
• notifications sent to administrators;
• messages from a form;
• alerts generated by an extension;
• a campaign launched from the site;
• an automated task.

When the volume is intentional, check that the site is not sending the same message multiple times. A badly configured extension, a task that runs too often, or a loop in a script can cause thousands of sends in a short time.

Reduce the frequency of notifications or fix the relevant extension. For regular sends, preferably configure authenticated SMTP sending or use a specialized service suited to bulk campaigns.

You do not recognize the sends

Unknown sends may come from:

• a form used by bots;
• a vulnerable or misconfigured extension;
• a malicious file;
• an out-of-date CMS;
• compromised administrator credentials.

Start by updating your CMS, its extensions, and its theme. Temporarily disable recently installed extensions or those that manage forms and notifications, then check whether the sends stop.

If your site has a form, add anti-spam protection or a CAPTCHA. Also check that the form limits the number of submissions and does not allow the recipient address to be chosen freely.

Then run a scan with the antivirus and anti-malware tool available in the LWS Panel.

If a compromise is confirmed, also change the passwords associated with the site:

• CMS administration;
• FTP accounts;
• databases;
• accounts with access to the hosting account.

Use different, sufficiently long passwords for each access.

Waiting for the end of the LPI-RATE11 block

The block associated with the LPI-RATE11 code lasts one hour.

Use this time to find and fix the source of the sends. Once the time has elapsed, PHP-generated emails can be sent again if no new overrun is detected.

Avoid immediately restarting a large send. Start by doing a single test.

Checking that the problem is resolved

After the block ends, send a test message from the relevant function: contact form, order, notification, or another site action.

Then open Mail tracking and check that:

• the test message appears with the sender mail_php@yourdomain.ext;
• its status indicates that it was handled;
• no new mass or unexpected sending is recorded;
• the LPI-RATE11 code does not appear again.

Common issues

The LPI-RATE11 code appears again after one hour

The blocking period has ended, but the cause of the sends is still present. Check mail tracking again and review the site’s forms, extensions, automated tasks, and files.

If necessary, temporarily disable the function or extension responsible in order to stop the sends during diagnosis.

My form still sends no message

First check that the blocking period has ended. Then perform a single test and check its status in mail tracking.

If the message does not appear, the problem may come from the form or the script itself. If it appears with another error, see the help corresponding to the new code displayed.

I do not know which site is responsible

When several sites are installed on the same hosting account, compare the time and subject of the messages with the forms and notifications used on each site.

You can also temporarily disable sending functions on one site at a time in order to identify the one generating the messages.

I cannot identify the source of the sends

Contact LWS support and provide:

• the exact code encountered;
• the domain concerned;
• the approximate date and time of the overrun;
• the CMS or application used;
• the sends observed in mail tracking;
• the checks already carried out.