Spam and unwanted commercial messages are a major headache. While many server-level spam filters exist, sometimes you need a quick, custom way to block messages based on specific keywords in the email body. This is especially useful for filtering out recurring spam topics.
This guide explains how to use the built-in Exim System Filter in cPanel/WHM to immediately reject emails (both inbound and outbound) that contain a word you specify, like "Viagra."
STEP 1: ENABLE THE SYSTEM FILTER
The first step is to tell your server's mail transfer agent (Exim) to check a special system-wide filter file before processing any email.
Log in to WHM (WebHost Manager).
Navigate to the Exim Configuration Manager. (Usually found under "Service Configuration" or by searching for "Exim" in the search bar.)
Find the System Filter setting. (It may be in the "Advanced Editor" or a specific tab.)
Enable
/etc/cpanel_exim_system_filter. You must select the option that tells Exim to use this specific file path for its system-wide filtering rules.Save your changes and allow Exim to restart.
STEP 2: EDIT THE SYSTEM FILTER FILE
Next, you need to add the actual rule to the filter file. This rule checks the email body for your chosen keyword and stops processing the message if a match is found.
Access your server's command line via SSH as the root user.
Open the filter file for editing:
nano /etc/cpanel_exim_system_filter(or use your preferred text editor like vi/vim).Add the following code block to the file:
if $message_body: contains "TEXT" and not error_message
then
seen finish
endif
REPLACE "TEXT" with the word you want to block. This is case-sensitive, so blocking "Viagra" will not block "viagra." For example, to block the word "Viagra":
if $message_body: contains "Viagra" and not error_message
then
seen finish
endif
HOW THE CODE WORKS
This small snippet performs a powerful action:
if $message_body: contains "Viagra": This is the condition. It checks if the entire body of the email contains the exact text "Viagra."and not error_message: This is a safety measure. It ensures the rule doesn't accidentally block automated delivery failure notifications (bounce messages).then seen finish: If the condition is met (the word is found), this action tells Exim to immediately stop processing the message. For incoming email, it will be rejected; for outgoing email, it will be discarded before sending.
CONCLUSION
By completing these two steps—enabling the filter and adding the rule—you have successfully implemented a server-level block. Your server will now automatically reject or discard any email that contains your specified keyword in the body, providing a simple yet highly effective defense against targeted spam.
