Answers.Body: <p>This is a known issue with all scripts in CiviCRM's <code>extern</code> directory - pointing directly to a PHP script inside <code>wp-content</code> is considered highly likely to be malicious. This will be solved out-of-the-box once the <a href="https://github.com/mecachisenros/civicrm-wp-rest" rel="noreferrer">CiviCRM WP REST API Wrapper</a> is merged into the CiviCRM WordPress plugin, but for now you probably need to install that and <a href="https://github.com/mecachisenros/civicrm-wp-rest#settings" rel="noreferrer">follow the instructions</a> for replacing calls to those CiviCRM scripts with proper WordPress REST API calls.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-03-13T15:56:26.910Z
Answers.Text: Thanks Christian
Answers.UserDisplayName: Heather O.
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-07-03T11:31:41.480Z
Answers.Text: Thanks Christian. This still seems to be an issue on a site using 5.26.0? Any advice?
Answers.UserDisplayName: Heather O.
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-07-03T13:40:02.557Z
Answers.Text: Did you do this? https://github.com/mecachisenros/civicrm-wp-rest#settings
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-07-30T10:00:58.623Z
Answers.Text: Same advice as previously: https://github.com/civicrm/civicrm-wordpress/tree/master/wp-rest#settings
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-08-03T17:16:54.170Z
Answers.Text: Hi Christian,  I have installed a plugin per the instructions above and can confirm that it has not resolved the problem.  In my case, disabling tracking of click through and opens does not resolve the problem.  It is there all the time.  I have run MalCare on my site and it reports that the site is clean.  I have disabled WP Mail SMTP as well.  This is occurring on more than one install of Civi and I have confirmed with Heather O. that her instance is still being flagged.  Any other ideas as to what could be causing this?  Many thanks.
Answers.UserDisplayName: Brendan Spaar
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-05-21T09:29:38.710Z
Answers.Text: FYI The WP REST API is now part of the CiviCRM plugin.
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2020-03-12T19:00:02.313Z
Answers.LastActivityDate: 2020-03-12T19:00:02.313Z
Answers.UserDisplayName: Christian Wach
Answers.Body: <p>Have you tried this link:
  <a href="https://github.com/mecachisenros/civicrm-wp-rest#settings" rel="nofollow noreferrer">https://github.com/mecachisenros/civicrm-wp-rest#settings</a></p>
  <p>I see that tried the plugin, but maybe specifically following this advice will help.</p>
  
Answers.ContentLicense: CC BY-SA 4.0
Answers.CreationDate: 2021-08-23T04:45:03.850Z
Answers.LastActivityDate: 2021-08-23T04:45:03.850Z
Answers.UserDisplayName: Karl Tatgenhorst
Body: <p>I have CiviCRM (5.21.2) installed on WordPress site. When testing our CiviMail messages on <a href="https://www.mail-tester.com/" rel="noreferrer">https://www.mail-tester.com/</a> we are marked down by 1.7 when we use tracked links. If we turn off tracking, we get full marks. Mail Tester marks us down for the following reason:</p>
  
  <p>URI_WP_HACKED_2 URI for compromised WordPress site, possible malware</p>
  
  <p>Has anyone else experienced this issue? </p>
  
  <p>Googling the error, some people report that "SpamAssassin treats any email with a common WP path in a link URL as suspicious. If enough other points are added, it can flag the message as likely-SPAM."</p>
  
  <p>Because URLs are rewritten when tracking, it sounds like this would be a problem for anyone using tracking in WordPress since the URLs are rewritten like /wp-content/plugins/civicrm/civicrm/extern/url.php?u=1&amp;qid=2</p>
  
  <p>Has anyone found a solution for this?</p>
  
Tags: <wordpress><civimail><tracked-links>
Title: CiviMail tracked links in WordPress site are marked down by Mail Tester
ThreadText: # CiviMail tracked links in WordPress site are marked down by Mail Tester
  
  (Asked by: username_0 on 2020-03-12)
  
  I have CiviCRM (5.21.2) installed on WordPress site. When testing our CiviMail messages on <https://www.mail-tester.com/> we are marked down by 1.7 when we use tracked links. If we turn off tracking, we get full marks. Mail Tester marks us down for the following reason:
  
  URI\_WP\_HACKED\_2 URI for compromised WordPress site, possible malware
  
  Has anyone else experienced this issue?
  
  Googling the error, some people report that "SpamAssassin treats any email with a common WP path in a link URL as suspicious. If enough other points are added, it can flag the message as likely-SPAM."
  
  Because URLs are rewritten when tracking, it sounds like this would be a problem for anyone using tracking in WordPress since the URLs are rewritten like /wp-content/plugins/civicrm/civicrm/extern/url.php?u=1&qid=2
  
  Has anyone found a solution for this?
  
  **Tags:** wordpress, civimail, tracked-links
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2020-03-12. Score: 5
  
  This is a known issue with all scripts in CiviCRM's `extern` directory - pointing directly to a PHP script inside `wp-content` is considered highly likely to be malicious. This will be solved out-of-the-box once the [CiviCRM WP REST API Wrapper](https://github.com/mecachisenros/civicrm-wp-rest) is merged into the CiviCRM WordPress plugin, but for now you probably need to install that and [follow the instructions](https://github.com/mecachisenros/civicrm-wp-rest#settings) for replacing calls to those CiviCRM scripts with proper WordPress REST API calls.
  
  > **Comments:**
  > **username_0**: Thanks username_1  
  > **username_1**: FYI The WP REST API is now part of the CiviCRM plugin.  
  > **username_0**: Thanks username_1. This still seems to be an issue on a site using 5.26.0? Any advice?  
  > **username_1**: Did you do this? https://github.com/mecachisenros/civicrm-wp-rest#settings  
  > **username_1**: Same advice as previously: https://github.com/civicrm/civicrm-wordpress/tree/master/wp-rest#settings  
  > **username_2**: Hi username_1,  I have installed a plugin per the instructions above and can confirm that it has not resolved the problem.  In my case, disabling tracking of click through and opens does not resolve the problem.  It is there all the time.  I have run MalCare on my site and it reports that the site is clean.  I have disabled WP Mail SMTP as well.  This is occurring on more than one install of Civi and I have confirmed with username_0 O. that her instance is still being flagged.  Any other ideas as to what could be causing this?  Many thanks.  
  
  ---
  
  ### Answer by username_3 on 2021-08-23. Score: 0
  
  Have you tried this link:
  <https://github.com/mecachisenros/civicrm-wp-rest#settings>
  
  I see that tried the plugin, but maybe specifically following this advice will help.
  
  
  ---
  
  