X-PHP-Originating-Script header — sent via PHP mail() from a shared-hosting bulk mailer
x-php-originating-script
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
The email carries an `X-PHP-Originating-Script` header, which PHP's built-in `mail()` function stamps automatically when `mail.add_x_header` is enabled in php.ini (default on many shared-hosting providers). The header reveals the UID and script path of the process that called mail() — e.g. `1001:send-bulk.php`. No legitimate commercial sender uses PHP's mail() function for outgoing mail: they use Postfix / Exim / Sendmail / transactional APIs (SendGrid, Mailgun, Postmark, SES). The presence of this header is a near-perfect fingerprint of (1) a compromised shared-hosting account running a spam script, (2) a direct PHP bulk mailer operated by a spammer, or (3) an exploited contact form passing user-controlled headers into mail(). Weighted at +4 — strong but not decisive alone because a tiny number of legitimate low-budget newsletters on shared hosting still exist, so it combines with other trash signals rather than solo-triggering deletion.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started