If your website uses a plugin to send emails — for example, through a contact form or an order confirmation — that plugin may store your Titan SMTP username and password. Some of these plugins have known security vulnerabilities that let attackers steal those credentials. This article is for anyone who sends email from their website using their Titan mailbox, and it walks you through finding and removing the risk, then locking down your Titan mailbox.
What you can do:
- Scan your website for vulnerable plugins and remove or deactivate them
- Reset your Titan password with a stronger one
- Set up a DKIM record to make your outgoing email harder to spoof
- Turn on Two-Factor Authentication for extra login protection
Scan and secure your website
- Run a full scan of your website's codebase using a website security scanner.
- If your website runs on a Content Management System (CMS) such as WordPress, open each installed plugin and check its settings.
- Look specifically for any plugin that has your SMTP (a protocol used to send email) username and password entered in its settings.
- If you find a plugin with a known vulnerability, remove it from your website.
- If none of your plugins show a confirmed vulnerability, deactivate the plugin that uses your SMTP credentials anyway, as a precaution.
Recommended website scanners for WordPress:
| alert-warning | Secure or remove the vulnerable plugin before you reset your Titan password in the next section. If you reset your password first, an attacker with access through the plugin could capture your new password too. |
|---|
Secure your Titan mailbox
Once your website is secure, tighten security on your Titan mailbox with these three steps.
- Reset your Titan password. See How to change your password and Best practices for creating a strong password.
- Set up a DKIM record (a DNS setting that verifies your emails weren't altered in transit). See Set up DKIM record.
- Turn on Two-Factor Authentication so a password alone isn't enough to log in. See Setting up and editing Two-Factor Authentication settings.
What success looks like: Your website no longer has an active plugin storing your SMTP credentials, and your Titan mailbox has a new password, a DKIM record, and Two-Factor Authentication turned on. This closes off the most common way attackers steal Titan credentials through a website.
Troubleshooting
Problem: Your Titan password gets compromised again shortly after you reset it.
Cause: The vulnerable plugin on your website is still active, so the attacker captures the new password the same way they got the old one.
Fix: Go back to the "Scan and secure your website" section above, remove or deactivate the plugin, then reset your password again.
Problem: You're not sure which plugin is using your SMTP credentials.
Cause: Many plugins can send email on your website's behalf without clearly labeling this feature.
Fix: Check each plugin's settings for fields labeled "SMTP," "Outgoing Mail," or "Email Settings." Running a website scanner will also flag plugins with known risks.
Problem: A scanner flags several plugins as risky, and you don't know where to start.
Cause: Scanners flag any outdated or high-risk plugin on your site, not only the ones connected to your email. Fix: Start with the plugin configured with your SMTP credentials first, since that's the one that can expose your Titan password.