1

A few of my constituents have told me that my emails are going to their Spam folder in Gmail. I did some digging with mail-tester.com and found that SpamAssassin is dinging my mailings -1.629 points for the code URI_WP_HACKED_2.

I did some more digging and found this is likely caused by the WP REST API that was integrated into Civi in 5.25. I'm currently running 5.27.0. See this link for more information: https://docs.civicrm.org/dev/en/latest/api/v3/wp-rest/

My question is: how do I resolve this SpamAssassin false positive? I don't understand how to set the CIVICRM_WP_REST_REPLACE_MAILING_TRACKING constant to true. I've tried both in wp-config.php and civicrm.settings.php. SpamAssassin is still marking the mailings as URI_WP_HACKED_2.

Any ideas as to why this is happening and how I can fix it?

Many thanks!

enter image description here

Improve this question
0

Can you detail out some more information. Without the filter added there is no change at all to mailings pre and post civicrm 5.25. The urls are the same until you add the filter. I am unsure how to evaluate without a list of the URLs they are dinging you for and I understand you would not want to post them here. As far as the REST API for mailing, you can try this https://develop.tadpole.cc/plugins/cv-rest-mailing it's a small plugin that implements the filter needed.

Improve this answer
5
  • SpamAssassin is scoring the email. I'm not sure why it is saying WP_HACKED but I've read that "This is a known issue with all scripts in CiviCRM's extern directory - pointing directly to a PHP script inside wp-content is considered highly likely to be malicious. " I added the cv-rest-mailing plugin to my Wordpress instance and SpamAssassin still thinks it is malicious. Thoughts?
    – Brendan Spaar
    Jul 29 '20 at 0:32
  • Also, the URLs that are being flagged are the tracked links that Civi generates for tracking. When I turn off link tracking SpamAssassin does not flag the email as malicious. See the image in my original question.
    – Brendan Spaar
    Jul 29 '20 at 1:41
  • In that case, try the filter to route emails via /wp-json as oppose to /extern.
    – Kevin Cristiano
    Jul 29 '20 at 15:23
  • Hi Kevin. I installed the filter as a plugin and the issue remains. What additional info would you need to troubleshoot this further? Thanks for your assistance.
    – Brendan Spaar
    Jul 30 '20 at 2:38
  • I just ran a MalCare scan on my site and it came back clean. I have also disabled Tracking of Click-Throughs and Opens and the issue still remains. I have also disabled the WP Mail SMTP plugin. Any other ideas as so what could be causing this?
    – Brendan Spaar
    Aug 3 '20 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.