About×

Super-Duper SquirrelMail 2.0.0

Based on SquirrelMail 1.4.22 · Version 2.0.0 · Build 415

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation.

Fibernetics hardening

Item	Detail	Status
PHP 7.4 / 8	Core runtime compatibility	Enabled
Login field and label obscuring	Non-static field names; labels not plain HTML text	Enabled
Login JS and cookies	Submit stays off until both work	Enabled
Login error messages	Same Invalid credentials either way	Enabled
Login abuse controls	Captcha and temporary IP lockout	Enabled
Auth page rate limits	index / login / sentry hits and POSTs; lock restarts only on a new flood burst	Enabled
Mailbox lockouts	Failed passwords and multi-IP spray	Enabled
2FA remember step-up	Wrong passwords temporarily ignore trusted browsers	Enabled
Global captcha elevation	Site-wide after distributed fail bursts	Enabled
Sign-in security page	Public notice next to Privacy / Fair Usage	Enabled
Login context / step-up	New device or location re-challenges; recent familiar devices skip	Enabled
Session fixation resistance	New session after mailbox login	Enabled
Session cookie binding	Session id in HttpOnly cookie only; a copied URL with sm_tab cannot reopen mail	Enabled
Session browser bind	Full User-Agent hash plus proof cookie; other browsers cannot reuse a pasted tab URL	Enabled
Session idle timeout	Idle logout; Keep me logged in (core) can re-auth that browser	Enabled
IMAP password storage	Server session only	Enabled
Cookie flags	HttpOnly + SameSite=Strict; Secure on HTTPS	Enabled
HTTPS / HSTS	Redirect and Strict-Transport-Security when on	Enabled
Browser security headers	CSP, framing, nosniff, referrer	Enabled
CSRF tokens	State-changing POSTs	Enabled
HTML mail you read	Scripts, frames, forms, and scripted links stripped	Enabled
Frameset / address book / prefs	Allowlists and path checks	Enabled
unserialize hardening	No object instantiation	Enabled
Compose / attachments	Safer links, seeds, and names	Enabled
HTML signatures	Enhanced: sanitized; no embedded images; plain fallback in Classic	Enabled
Session keys / Message-IDs	Unpredictable random values; mailbox domain, no client fingerprint	Enabled
SVG attachment download	Blocked unless a trusted sender or Show remote images	Enabled
SCRAM when offered	Extra to LOGIN/PLAIN over TLS; toggle on Connection Security	Configurable
IMAP SASL PLAIN / STARTTLS	PLAIN when LOGIN is disabled; STARTTLS or IMAPS	Enabled
Connection Security page	TLS per hop; LOGIN over TLS is encrypted; SASL in use	Enabled
Login fail logs	fail2ban-friendly when enabled	Enabled
IMAP / SMTP TLS	IMAPS, IMAP STARTTLS, SMTP STARTTLS or SMTPS	Configurable
Classic Administrator plugin	No config.php rewrite from webmail Options	Removed
CVE patch set	2.0.0	Patched

PHP 7.4 and PHP 8 compatible
Login username and password field names and on-screen labels are obscured so they are not the static names and plain text bots expect
Login requires working JavaScript and cookies before the form can be submitted
Unknown mailbox and wrong password both show the same Invalid credentials message
Login abuse controls: failed-attempt tracking, captcha challenge, and temporary IP lockout
Request-rate limits on index, login, and sentry pages: excess hits or POSTs force captcha, then a short IP lock; a new flood burst during the lock restarts it
Per-mailbox lockouts after repeated bad passwords, including multi-IP password-spray detection
Repeated wrong passwords for a mailbox temporarily ignore remembered 2FA browsers until a clean second step or a quiet period
Distributed login-fail bursts can temporarily elevate captcha for everyone
Public Sign-in security page explains captchas and temporary blocks in plain language (no internal thresholds)
Sudden change in device type or location context requires a captcha re-login; a browser you used recently is not treated as sudden
Session ID is replaced after a successful mailbox login
Mail session id lives in an HttpOnly cookie; a copied webmail URL cannot sign someone else in
Sessions are bound to the browser User-Agent and a proof cookie; a pasted tab URL in another browser is rejected
Idle sessions time out; Keep me logged in (core) re-checks the mailbox and signs you back in on that browser
Mailbox password is kept in the server session, not a browser cookie
Session and UI cookies use HttpOnly, SameSite=Strict, and Secure on HTTPS
HTTPS is preferred and Strict-Transport-Security is sent when enabled
Browser hardening headers: framing controls, Content-Security-Policy, nosniff, referrer policy
CSRF tokens on state-changing actions (preferences, UI toggles, empty-folder, calendar edits)
When you read HTML mail, scripts, frames, forms, scripted links, and similar active content are stripped; encoded headers are escaped
Folder names and UI fragments are escaped before display
Classic frameset navigation limited to known pages
Address book backends loaded from a fixed allowlist
Preference storage and theme selection paths are validated server-side
Saved serialized data is unpacked without instantiating PHP objects
Compose links limited to safe URL schemes; HTML compose seed and paste are sanitized (clipboard style tags cannot hide To/Cc/Send)
HTML signatures (Enhanced Mode): sanitized on save; embedded or base64 images are blocked — only remote http(s) image links; plain signature is used in Classic and plain-text compose
Attachment names and downloads hardened against path tricks
Session keys and outgoing Message-IDs use unpredictable random values; Message-IDs use the mailbox domain and do not fingerprint the client
SVG attachments are blocked for download by default (they can contain script); Message Safety (Unsafe Image Rules) or Show remote images can allow a trusted message
LOGIN or PLAIN over TLS is still encrypted (TLS wraps the password); SCRAM is extra when IMAP/SMTP offers it (Options → Connection Security)
IMAP SASL PLAIN is available when LOGIN is disabled; IMAP can use implicit TLS (993) or STARTTLS on 143
Options → Connection Security shows TLS on each hop and the SASL mechanism in use
Remote images can be kept off the wire when the user blocks them
Failed logins can be written in a form common fail2ban-style tools understand
Mail transport supports IMAP implicit TLS, IMAP STARTTLS, SMTP STARTTLS/SMTPS, SASL PLAIN, and SCRAM
Stock Administrator plugin removed: site config cannot be rewritten from a mailbox session
Known CVE set from the 1.4 era through 2025 is patched (see Security patches below)

Mail, sessions, and attachments

After you sign in, there are three hops: your browser to this webmail site, this site to IMAP (reading mail), and this site to SMTP (sending mail). A lock icon in the browser only covers the first hop. Signed-in users can open Options → Connection Security to see TLS version, cipher, advertised SASL, and the authentication mechanism in use on IMAP and SMTP — including a warning when a hop is still plain text.

Your mailbox password is kept in the webmail server session so IMAP and SMTP can work. It is not stored in a browser cookie. Session cookies only identify the session.

LOGIN or PLAIN over TLS is still secure: TLS encrypts the entire session, including the password even though those methods do not hash it. When the mail server lists SCRAM (a challenge-response login), webmail can use it so the password is not sent even inside that tunnel. That is on by default if the server offers it. You can turn it off on the Connection Security page. It takes effect on the next sign-in for IMAP. For SMTP, send a message or use Recheck on Connection Security (Recheck authenticates without sending mail).

If the IMAP server disables the LOGIN command, webmail can use SASL PLAIN after TLS, or SCRAM / CRAM-MD5 / DIGEST-MD5. IMAP can use implicit TLS on port 993 or STARTTLS on port 143. SMTP already supports STARTTLS (587) and implicit TLS (465).

Outgoing Message-IDs are random values at your mailbox domain. They do not include a client fingerprint.

SVG attachments are blocked for download by default because an SVG file can contain script. HTML mail already strips inline SVG. You can allow a download by showing remote images on that message, or by adding an Unsafe Image Rule (Options → Message Safety) for the sender. Junk, Spam, and Trash still block both remote pictures and SVG downloads; that junk-folder block is on by default under Options → Unsafe Content Alert.

HTML mail you read

When a message is shown as HTML, webmail strips or disables active content before it reaches your browser. This is always on. It is not a mailbox Options toggle.

For your protection, HTML mail cannot run or embed:

Scripts and plugin objects
Embedded frames
Forms and buttons inside the message
Click or load handlers attached to tags
Links that try to run script instead of opening a website
Style tricks that cover the rest of webmail
Inline drawings (SVG) that can carry script

Remote pictures stay off the network until you allow them (Show remote images, or rules you add). Junk, Spam, and Trash still block remote pictures.

This is not antivirus. Dangerous files can still arrive as attachments. Host malware scanning is a separate control.

Sign-in security

To protect mailboxes on this service, sign-in is monitored for abuse. Most people never notice these checks. This page explains what you may see and why — without listing internal thresholds.

What we do at sign-in

Failed sign-in attempts are tracked. After repeated failures you may be asked to complete a captcha.
Continued failures from the same network address can temporarily block webmail sign-in from that address.
A mailbox that receives many wrong passwords in a short time — including attempts from several places — can be temporarily locked to slow password guessing.
Unusual device or location changes may require an extra captcha before you continue. Signing in from a computer or phone you already use is not treated as unusual.
Very heavy traffic against the sign-in pages can trigger short protective limits for that visitor.
When many failures happen across the service at once, captcha may be required more often for everyone until things calm down.

Why you might be blocked

Common causes include mistyped passwords, password managers retrying old credentials, shared Wi‑Fi or VPN addresses used by others, automated scanners probing the login page, or someone else trying to guess a password for your mailbox.

A temporary block is protective. It does not always mean your password was changed or that your account was deleted.

What to do

Wait a short while and try again carefully with the correct password.
If you see a captcha, complete it before submitting the form.
Avoid rapid repeated tries; each failure can lengthen the delay.
If you remain locked out and need access urgently, contact your administrator or support channel for this service.

What this page does not list

Exact attempt limits, timers, and technical controls are not published here. Sharing those details would help attackers tune automated guessing. The protections above are real; only the fine print stays internal.

After you sign in

A lock icon in the browser only covers the path from your device to this webmail site. Mail still travels again from webmail to IMAP (reading) and SMTP (sending). Signed-in users can open Options → Connection Security to see whether those hops are encrypted, which login method the mail server advertised, and which method this session used.

The mailbox password stays in the webmail server session. It is not stored in a browser cookie.
LOGIN or PLAIN over TLS is still secure: TLS encrypts the entire session, including the password. If the mail server offers SCRAM, webmail can use it so the password is not sent even inside that tunnel. You can turn that on or off on Connection Security.
IMAP can use implicit TLS (port 993) or STARTTLS (port 143). SMTP can use STARTTLS (587) or implicit TLS (465). SASL PLAIN is available when the LOGIN command is disabled. LOGIN or PLAIN without TLS is the insecure case.
Remote pictures in HTML mail stay off the network unless you allow them. SVG attachments are blocked for download unless you trust that message (Show remote images or an Unsafe Image Rule). Junk folders stay blocked.

Removed outdated features

Stock SquirrelMail pieces removed because they no longer fit modern webmail (or dial-up Classic bandwidth).

Feature	Why removed
Classic Administrator plugin	Stock Options → Administration could rewrite config.php from a mailbox session using a static email list that is easy to leave stale after offboarding. Site config is file-based or the smadmin console instead.
SquirrelSpell plugin	Server-side spell check round-trips; modern browsers spell-check locally.
New Mail sound plugin	Folder-scan audio alerts from the dial-up/IE era; unread counts cover the need.
HTML Mail plugin	Folded into core. HTML compose (editor, multipart send, inline images) is always part of webmail; it is not an optional plugin.
Compatibility, Delete/Move/Next, Message Details, Quota Alert, Address Book Selector	Folded into core. Leftover plugin names are ignored; SM Admin does not list them.
File Integrity, Message Flags Icons, Restrict Senders Light, User Config Backup	Folded into core and gated by site config. Leftover plugin names are ignored.
HTMLArea and FCKeditor	Abandoned WYSIWYG engines and leftover htmlarea_cvs/patches; replaced by the modern compose editor in Classic and Enhanced.
HTMLArea emoticon toolbar	GIF flood plus javascript:insertHTML handlers; unsafe and wasteful on dial-up.
Fortune / Demo / Test / Bug Report plugins	Novelty and developer leftovers, not product features.
Translate / SpamCop / Mail Fetch plugins	Better handled by external services or the mail server, not the webmail UI.
Stock Filters plugin	Old DNS-blacklist style filtering removed; replaced by in-app mail sorting and server spam tags.
Quote Who XML and user-defined reply citations	Exotic citation formats unused by modern clients; kept simple Author/Date styles.
Compose-in-popup window	Popup composers and width/height options are obsolete; compose stays in the mail pane/frame.
IE6 scrollbar CSS workaround	Conditional IE6 expression() CSS; no longer relevant.
Sub-minute folder list auto-refresh	30–59 second refresh options forced full left-pane + IMAP reloads; too costly for dial-up.
Show X-Mailer by default	Clutter in the message view; not useful for day-to-day mail.
Printer-friendly frameset	Replaced with a single modern print view and browser print dialog.
Use Javascript Off / Autodetect preference	Javascript is required in 2026; the toggle only complicated options.
Javascript address book popup	HTML address book only — simpler and more reliable.
Wrap / editor size / messages-per-page preferences	Hardcoded sensible defaults; layout belongs to CSS, not per-user character grids.
Deep Options sprawl on the main Preferences page	Less-used stock preferences moved to Advanced Options so everyday preferences stay simple.

Security patches (CVE)

Patched+Hardened by Fibernetics

CVE	Published	Issue	Status
CVE-2025-30090	2025-04-02	XSS via e-mail headers in mime.php (encoded header leftover mishandled)	Patched
CVE-2019-12970	2019-07-01	XSS via RCDATA/RAWTEXT HTML elements (noscript/noembed/textarea/etc.)	Patched
CVE-2018-14955	2019-02-26	XSS (part of multiple message-display filter issues)	Patched
CVE-2018-14954	2019-02-26	XSS (part of multiple message-display filter issues)	Patched
CVE-2018-14953	2019-02-26	XSS (part of multiple message-display filter issues)	Patched
CVE-2018-14952	2019-02-26	XSS (part of multiple message-display filter issues)	Patched
CVE-2018-14951	2019-02-26	XSS (part of multiple message-display filter issues)	Patched
CVE-2018-14950	2019-02-26	XSS (part of multiple message-display filter issues)	Patched
CVE-2018-8741	2018-04-04	Attachment directory traversal / local file disclosure	Patched
CVE-2017-7692	2017-04-24	Remote code execution via sendmail envelope-from injection	Patched
CVE-2011-2753	2011-07-11	CSRF / preference manipulation vectors	Patched
CVE-2011-2752	2011-07-11	XSS in message / preference related pages	Patched
CVE-2010-4555	2011-07-11	Multiple XSS vulnerabilities	Patched
CVE-2011-2023	2011-07-10	XSS via crafted STYLE elements in messages	Patched
CVE-2010-4554	2011-07-12	Clickjacking (framing the webmail UI)	Patched
CVE-2012-0323	2012-03-09	Autocomplete plugin XSS	N/A - plugin not installed
CVE-2020-14933	2021-10-15	Reported object-injection issue — marked INVALID by upstream; still hardened in this fork	Not applicable

Installed plugins

Versions and credits come from each installed plugin’s setup headers.

Plugin	Version	Requires SM	License	Hardened by	Upstream/developed by credit
Super-Duper SquirrelMail Administrator Independent admin console at /squirrelmail/admin. Edit userprefs, enable/disable plugin settings discovered by scanning installed plugins.	1.0.32	2.0	GPL-2.0-or-later	Fibernetics Corp. \| John A. Shiells	Copyright (c) 2026 John A Shiells

Credit where credit is due

Sources and ideas used to update this platform. Listing here does not mean every line of their code is included.

Source	How we used it	Notes
SquirrelMail Project Team	Base webmail: IMAP UI, preferences, plugins API, and Classic frameset	GPL-2.0+ · squirrelmail.org
Andrew Sachen (RealityRipple)	PHP 8 work on the 1.5.2 devel tree; ideas we cherry-picked (CSPRNG, Message-IDs, SCRAM, SVG downloads) — not a rebase of that tree	https://github.com/RealityRipple/squirrelmail
Paul Lesniewski (HTML compose and related plugins)	HTML compose foundation (now core) and several plugin lines still in this tree	GPL
HTMLArea / FCKeditor	Earlier HTML compose editors that shaped the feature set we replaced	Historical
Roundcube Webmail	Enhanced Mode layout and UX inspiration	GPL-3.0+ · roundcube.net
Modern webmail UX patterns	Additional cues for a compact, phone-friendly Enhanced shell	Design inspiration
W3C / WHATWG and browser vendors	Native browser editing APIs used for HTML compose	Web platform
PHP and common extensions	Runtime and storage layers used by this fork	php.net
OWASP, SASL / SCRAM practice, and web security guidance	Guidance reflected in the hardening of this fork (sessions, mail-server authentication, attachment handling)	Industry best practices
CVE reporters and upstream SM security work	Public advisories and patches reflected in the Security patches section	NVD / upstream changelogs
John A Shiells	Core hardening, Enhanced Mode, and Fibernetics-built plugins in this fork	Copyright (c) 2026 John A Shiells
Fibernetics / 295.ca	Product direction, hosting, and ongoing maintenance of Super-Duper SquirrelMail	Super-Duper SquirrelMail
Steve Douglas, Adam Corby	Beta testers and feature guides — provided input on new features	Beta testing

super-duper /ˌso͞opərˈdo͞opər/ — "Super-duper" is an informal, playful reduplicative adjective meaning extremely good, excellent, or very great.

× Back to login