If your WordPress site is hosted at DreamHost and its contact form, order emails or password-reset messages went quiet some time after 23 October, the likely cause is a password DreamHost changed without the site knowing. Since that evening DreamHost has been resetting the passwords of some email and FTP/SFTP users as a precaution, and an old password stops working once the reset lands. A site set up the way DreamHost’s own instructions describe sends its mail by logging in to a DreamHost mailbox, so it lost the ability to send at the same moment. The site rarely says so: some forms report an error to the visitor, but many show their success message anyway.
What DreamHost has said
DreamHost’s 
status page reported File Manager trouble on the afternoon of 23 October (Pacific time). By that evening it said several services were affected and “As a precaution, we are resetting the passwords of some email accounts”, which stopped old passwords working in webmail and email apps; FTP and SFTP users were added later that night. On 25 October it said every affected account owner had been emailed instructions. On 26 October it reported File Manager back online and said resets were “still required for a subset of email and FTP/SFTP user accounts”, which suggests some owners have yet to set them. DreamHost marked the incident resolved on the afternoon of 27 October (Pacific time), with the same reminder: some email and FTP/SFTP users still need a new password before they can log in again.
BleepingComputer’s report adds what the notices to account owners ask for: check every mailbox for forwarding rules and remove destinations you don’t recognise, change any reset password you also use elsewhere, and tell your mailbox and FTP users yourself, because DreamHost can’t contact them directly.
DreamHost has not said what happened, how many accounts are affected, whether any mail or files were read, or whether control-panel logins were part of it. It has not called the incident a breach, and nothing here does either.
Why a mailbox reset stops WordPress mail
DreamHost’s 
WP Mail SMTP setup guide has the site send through smtp.dreamhost.com on port 587 with TLS (encryption for the connection), logging in with “your DreamHost email address” and that address’s password. The DreamHost host page explains why DreamHost recommends that setup: without a mailer plugin, WordPress there sends unsigned mail that inboxes trust less.
That makes the mailbox password the site’s sending password. When DreamHost reset it, the copy saved in WP Mail SMTP, FluentSMTP or Post SMTP went stale, and every send since has been refused at login. DreamHost’s notices don’t mention SMTP by name; this follows from the setup, because the mailbox login and the SMTP login are the same login.
In WP Mail SMTP’s or FluentSMTP’s test email, the failure reads SMTP Error: Could not authenticate., the wording of PHPMailer, the mail library WordPress ships. Post SMTP sends through its own library by default and shows the mail server’s refusal instead. The full reply, starting with 535 (the SMTP code for a rejected login), is in the email log’s Session Transcript.
A site with no mailer plugin isn’t affected: it sends through PHP’s mail() without logging in to anything. If its mail stopped, the cause is elsewhere, and debugging with the wp_mail_failed hook is the place to start. Nor are sites that send through a provider’s API key or the provider’s own SMTP login (Postmark, SMTP2GO, Mailgun and the like), because they don’t log in to DreamHost to send. That is inference from the setup: DreamHost hasn’t listed which logins it reset beyond “email and FTP/SFTP users”.
FTP logins break the same way. If wp-config.php sets FTP_PASS for updates, or a deploy script pushes over SFTP, put the new password there.
Getting mail working again
- Set the mailbox’s new password in the DreamHost panel. During this incident the account owner sets it; mailbox users can’t log in until they do. Use the mailbox your mailer plugin logs in with: it is the username in the plugin’s SMTP settings. DreamHost says a new password can take up to 15 minutes to apply, and warned that changes made before its reset finished on 24 October “will be overwritten”, so a password changed early may not be the one in force now.
- Paste the new password into the mailer plugin and save. If the password field is greyed out or says it is set by a constant, it lives in
wp-config.phpinstead (WPMS_SMTP_PASSfor WP Mail SMTP); change it there. - Send a test email from the plugin’s test screen to an address outside DreamHost.
- Find what didn’t go out. Post SMTP emails the site’s admin address about failed sends by default (subject “Post SMTP email error”), so check that inbox and its spam folder. FluentSMTP and Post SMTP keep an email log and can resend a failed message from it; WP Mail SMTP’s log is a Pro feature, but the free version records failed sends under Tools → Debug Events and shows a failure notice in the dashboard. Resend orders and form notifications; on a WooCommerce order, the Order actions box has “Send order details to customer” and “Resend new order notification”. Don’t resend password-reset emails: their links expire after a day by default, so the user has to ask again. Without a log, check whether your form plugin stores entries.
Check the forwarding rules on the right mailbox
DreamHost asks owners to check every mailbox for forwarding rules they didn’t set up. For a WordPress site, the mailboxes that matter most are the one WordPress sends admin mail to (Settings → General → Administration Email Address) and the one on your own WordPress user account, if either is at DreamHost. Often neither is the mailbox the plugin logs in with. A WordPress password-reset email carries a working reset link, so a forwarding rule on either of those mailboxes hands the link to whoever added the rule.
Whether to change anything else
A precautionary password reset doesn’t say what else, if anything, someone could reach. If DreamHost later says files, databases or the control panel were involved, the other credentials your site sends with (API keys, OAuth connections) may need replacing too. Host breached: are my WordPress email credentials exposed? maps what each kind of access exposes, and rotating SMTP credentials after a compromise has the steps per provider.
Fake reset emails
An incident like this is cover for phishing: a message that looks like a DreamHost reset notice and links to a login page that isn’t DreamHost’s. Type panel.dreamhost.com yourself to set passwords, and check anything a notice claims against the status page.
Leave a Reply