Posts Tagged ‘email’

Logging Emails Sent Through Wordpress

Saturday, February 13th, 2010

Ever have the need to log emails from a contact form inside of of wordpress? Here’s my solution.

The Problem

The client uses the Contact Form 7 wordpress plugin for events, registrations and subscriptions. Up until this point all the emails needed to be cut and pasted manually into a master list for marketing or other action items.

Specific actions are taken with each contact form. Some are simply added to a master email list while others are used to send content through snail mail. The need for more forms over the next few months will be increasing. These forms are very time sensitive so the solution must be dynamic enough to preclude more than a few hours in turnaround.

The Solution

If resources were unlimited (time and budget) this would be a great place to implement pre-built CRM (customer relations mangment) system. There are plenty of open source and commercial applications that would work well.

The biggest limiting resource here is time. The client knows how use wordpress and the current site is already well established with content. So we’ll hack it.

Logging Emails

Logging outgoing emails from any type of contact form is essential. This could be as simple as storing them in a database or even writing to a flat file. Logging emails will help you pick up security issues as well as troubleshooting.

The solution is pretty simple. Every email sent out through wordpress uses the wp_mail() function, including forms through Contact 7. All we need to do is capture the $_POST variables when a call is made to wp_mail().

We can use the add_action() hook from wordpress to accomplish this.

A simple example

We’ll insert our hook in the functions.php page for the theme. For this example I’ll use a theme called custom.

wp-content/themes/custom/functions.php

We’ll create a function to capture the posts. This function won’t really do anything but you’ll get the point. Then we’ll hook the function into wp_mail().

function saveContact() {
    // all of our post variables are in the $contact array
    $contact = $_POST;

    // now would be a good time to clean and filter
    foreach( $contact as $key => $value ) {
        // trim it, escape ... it you know the drill
    }

    // insert into the database or save a flat file

}

// hook it
add_action( 'wp_mail', 'saveContact' );

Now anytime wordpress sends an email it will call our saveContact() function. This is fine to just capture the data but we want to do something with it. Keep in mind Contact 7 adds in some of its own post variables so you may want to pop those off before processing the data.

If you want to echo anything back to test this turn off your javascript otherwise Contact 7 will send an ajax call behind the scenes.

An advanced example (go cURL yourself)

Wordpress is great but I want to use a MVC framework to handle all of the the different actions. I want to know what form was sent and use the information to populate various tables. I use Kohana but any of the popular frameworks can handle this in the same way. The benefit here is I can use the framework’s built in cleaning and database helpers. We’ll use cURL to send the post variables to our controller.

I’ll send the data to a controller in public_html/example. So the domain www.mydomain.com has a standard wordpress install but we have a kohana controller living in www.mydomain.com/example. I’ll also send along the URI where the form originated. We’ll take care of all the data inside the framework. Clear as mud?

Wordpress by the way does not like putting this source code inside the post. You can check it out here.

For security you can make sure the cURL posts are only sent from your domain.

With permalinks enabled you can differentiate between forms posted from something like www.mydomain.com/contact and www.mydomain.com/contact/subscribe.

Remove your IP from a blocked firewall

Thursday, January 21st, 2010

I only have to do this a couple times a year. This is so I don’t have to look it up.

Open up the file.

pico /etc/apf/deny_hosts

Find your IP and delete the entry. Then restart APF

/etc/init.d/apf restart

There, I wrote it down this time.

Dealing With Email Blacklists

Thursday, March 19th, 2009

In the list of the top three server catastrophes I would put having your IP address blacklisted as #2 just behind total data loss without a backup. In reality having a total loss of data with an off site backup will get your business back to full speed quicker than ending up blacklisted.

Ending up on the wrong lists will result in the loss of your ability to not only send email but receive it as well.

Symptoms of being blacklisted

Having your email end up in others spam boxes is not conclusive that your IP is listed but it is how some hosts deal with shady IP’s. Assuming your emails do not contain content that would flag it as spam you may have some server configurations not set up properly.

Proof positive that your being blacklisted will be a returned email that explicitly says the IP address is blacklisted.

I’m blacklisted now what?

The first step is to find out why. If your on a shared server you need to call your host and have them correct it. Chances are you or somebody who shares your IP has had a security breech. If they are unable or unwilling to correct the problem its time to switch hosts. This type of support is exactly why not all hosts are created equal, you get what you pay for.

If your on a dedicated server or VP package you probably have had a security breech. Two of the most common causes are a poorly written contact form being abused or the attacker has managed to upload and execute a script that is spitting out SPAM. Don’t even attempt to get off these lists until you have found the problem corrected.

The Cleanup

Real Time Blacklists (RBL) come in several varieties. A large portion of these RBL’s publicly list bad servers. A good resource is Mx Toolbox. These lists are probably the easiest to deal with. You can tell exactly who has you listed and how to correct the problem. Each list has their own triggers to determine who is actually sending out spam. Most of these lists talk to each other so by being listed on one you will be listed on several. Its a cascading effect and the longer your problem goes unchecked the more lists you will be on.

For the most part you will be removed after a specific period of time passes and you are not sending out SPAM. Some of these lists have forms you can fill out to expedite your removal. At least one requires a payment to be expedited. If your on these lists it will be at least 3 days until your completely removed in some cases as long as 7. Submitting a removal request when your still spitting out SPAM is only going to make it harder to get off the list so make sure your all buttoned up first.

The more difficult and time consuming lists are the private non published lists that act as firewalls for large companies or government. An example is Frontbridge’s 88.blacklist.zap. and Barracuda. You will get a bounced email with a link to a form where you can request removal. They are generally fairly quick to remove you but you won’t know there is a problem until you get the email.

The most difficult lists to deal with are the individual ISP. They are far slower to remove you. It will require allot of your time to deal with them individually as they come in.

How do I stay off these blacklists?

If your on a shared server its on your hosting service to monitor all the sites on a single IP that you share. Ever wonder why some hosting services cost $5 month for a shared package and others cost $30? In most cases you pay a little more for higher quality. If your host does not allow shell access that is a good sign they take security seriously. The extra cost you pay the host is because they will have to run any higher level commands for you. For anyone who isn’t a server admin its worth it not to deal with this.

If you have a dedicated server or VP package be sure its set up properly. This is exactly why there are such things as server admins. Making sure your not at risk takes daily monitoring and allot of knowledge for the setup.

Other Resources