Custom SMTP vs Email Essentials

Make your WordPress email arrive WordPress still hands your email to the PHP mail() function. Most hosts have switched it off or throttled it because spammers loved it, and where it still runs, unauthenticated mail lands in spam. If your contact form says thank you and nothing ever arrives, this is why. Custom SMTP sends your email through the provider you already use instead: your host’s SMTP server, Gmail, Outlook, Brevo, SendGrid, Mailgun, Postmark or the Amazon SES API. It logs every message with its outcome, lets you preview and resend failures, and alerts you when sending spikes or starts failing. Everything is in the free plugin: no account to create, no third-party relay, no pro version. Built for modern WordPress: WordPress 7.0 ready, PHPMailer 7.0.2 compatible, stateless / cloud-ready (Docker, Kubernetes), and fully translated in English and French. Documentation lives at customsmtp.com/docs/, with step-by-step guides for twelve providers and a developer guide covering constants, environment variables and the Amazon SES API. Send through your own SMTP provider Point the plugin at the server you already pay for or the free tier you already use, with a preset that fills the technical values for you: Presets for twelve providers: Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Brevo, Postmark, Mailjet, Zoho, Yahoo, iCloud and Scaleway, plus “Other / Custom” for any SMTP server. From Name and From Email applied to every outgoing email, with optional Reply-To, CC and BCC. SSL/TLS encryption, and optional authentication for relay servers that need none. Password encrypted at rest (AES-256-CBC with your WordPress salts), never displayed back in the form. Test without guessing: test the SMTP connection without sending anything, or send yourself a real test email. A log of every email, with preview and resend Never wonder if your emails were sent again. Logging works out of the box and captures every message going through wp_mail(): WooCommerce order notifications, contact form submissions, password resets, all of it. Delivery status (sent or failed) with the exact SMTP error when a message fails, and the stored headers for advanced troubleshooting. Preview the email body in wp-admin, in an Outlook-style sidebar, without sending anything again; view the HTML source, or download any email as an HTML file for archiving. Resend a failed email straight from the logs once your configuration is fixed. Search by recipient, subject or status; filter by date range; export to CSV for reporting and compliance. Configurable retention with automatic purge (30 days by default), and content storage you can switch off in one click. Unusual Usage Alerts A compromised contact form or a runaway plugin can turn your site into a spam relay, and a revoked password or an exhausted provider quota can stop your emails silently. Custom SMTP watches for both and warns you. Sending spikes — get an email when more messages than expected go out within an hour or a day. Thresholds are absolute, never relative, so a quiet site that sends a handful of emails a week is never woken up by statistical noise. Delivery failures — get warned as soon as several emails fail in a row, or when too many of the last messages sent failed. Counted over the last emails sent rather than over a period of time, so it works just as well on a site that sends twice a week as on a busy store. A channel that survives the outage — alerts go out by email, to an optional HTTPS webhook (Slack, Teams, any JSON endpoint), and to a persistent notice in wp-admin, because the one moment you need the alert is the moment email itself is broken. No noise — a configurable cooldown keeps an ongoing incident from filling your inbox, and the alert email is never logged nor counted against your own thresholds. Off by default — turn it on in Settings and set the thresholds that match your site. Manage WordPress Notifications WordPress sends a handful of emails on its own, and some of them get old fast: a notice to the administrator every single time a user resets their password, a report after every automatic plugin update, a message for every comment awaiting moderation. Switch off the ones you do not want, one checkbox each, no code. Password reset and new user notices to the administrator — the user still gets their reset link and their welcome email, only the copy to the admin stops. Automatic update reports — core, plugins and themes, separately. Comment notifications — awaiting moderation, and new comment to the post author. Nothing is hidden from you — a notification you switch off is never created, so it will not appear in the Email Logs either, and the screen tells you that. Account recovery is never at risk — the emails users need to regain access to their account are deliberately out of reach of this screen. Off means off, on stays on — installing or updating the plugin never silences an email your site was already sending. Deliverability, privacy, security Cooperates with the automatic Envelope-From / Return-Path behavior introduced in WordPress 6.9, which improves SPF, DKIM and DMARC alignment on strict hosts (Amazon SES, Postmark, etc.). UTF-8 and emoji handled end-to-end in subjects, bodies and headers. All data stays in your WordPress database: no third-party calls, no telemetry, and no external processor to declare in your GDPR records. Email preview rendered in a sandboxed iframe, so no JavaScript from a logged email ever runs in wp-admin. All admin actions protected with nonces and capability checks; the SMTP password is encrypted at rest. For developers: containers, config-as-code, Amazon SES API The developer guide covers this surface in depth; the short version: Stateless and cloud-ready: no filesystem writes, no shared storage, safe on read-only filesystems. Works on Docker, Kubernetes, AWS ECS/Fargate, Google Cloud Run, and with Bedrock or Trellis stacks. Every setting from a constant or environment variable: define CUSTOM_SMTP_ and it overrides the saved value everywhere, with the field shown read-only in wp-admin and a badge naming the variable. On Multisite, a network-wide option can configure every site at once. Amazon SES API with IAM roles: send through the SESv2 API authenticated by your ECS task role or EC2 instance role, with no access keys and no stored credentials. Raw MIME preserves HTML, attachments, CC/BCC, Reply-To and custom headers, and it works with or without the AWS SDK for PHP. Details in the FAQ below. Abilities API (WordPress 6.9+): custom-smtp/connection-health and custom-smtp/send-test-email are exposed to MCP-enabled AI assistants and automation tools (n8n, Make), behind the same manage_options capability check as wp-admin.

Email Essentials vastly reduces the chances of your emails being marked as spam or being rejected. Originally a debugging tool, it has grown into a full-fledged email enhancement plugin. Please note that this plugin is not a “we support any type of transport” Email plugin. For other protocols than SMTP, but rather to enhance the email sending capabilities of WordPress. If you need to send emails with other protocols than SMTP, this plugin is not for you. You might want to look at plugins like Post SMTP (not affiliated). And since version 6.0.0, after more than 10 years of development and internal use, this plugin is now a FOSS plugin, meaning it is free to use, modify and distribute under the GPLv2 license. In return, we ask you to support the development of this plugin by contributing to the codebase, reporting bugs, and helping others in the community. Responsible disclosure: If you find a vulnerability, please email us at [email protected]. Features Set a good From name and email address, automatically correcting it if needed. For example, a contact form is sent from the visitors email address, resulting in an invalid Sender address. This plugin will correct it to a valid email address. This plugin automatically corrects it. Correct envelope-from address; often forgotten, but important for deliverability. Reformat as HTML with plain text alternative; will detect the use of HTML ensures that emails are sent as HTML with a plain text alternative. Process shortcodes in your email content. UTF8 recoding, to ensure that special characters are correctly encoded in the email. Email Essentials allows for adding CSS, header, footer, and body template using filters, see below. Convert CSS to inline styles for better support in email clients SMTP configuration Send emails to multiple addressees as separate emails S/MIME signing, using a supplied certificate, to ensure the authenticity of the email. DKIM signing, and providing all information needed to set up DKIM signing for your domain. Allow redirecting emails sent to the administrator to other email addresses based on the email subject. Allow redirecting emails sent to the moderators (e.g., for comments). Keep a history of outgoing emails (debugging, cleared on deactivation) Email receipt tracking (for investigative purposes only, see GDPR note) Re-send button for failed emails Allow sending emails delayed, to prevent sending too many emails at once. (Beta feature) Important Note This tool is for users who understand email delivery. If unsure, ask for help. Under GDPR, storing and tracking emails is prohibited. The history feature is for investigative purposes only! External services Email Essentials uses one external service by default, two if you create and define your own IP services. CloudFlare DNS over HTTPS (DoH). This is used to resolve domain names to IP addresses when (for example) checking SPF or DKIM records. In theory, it is possible to use PHPs own dns_get_record function, but in practice this often fails due to server DNS-resolve misconfiguration. Using CloudFlare’s DoH service ensures reliable DNS resolution. We only send the hostname (the domain part) to CloudFlare, no other data. Explicitly, we do NOT send any other information. The plugin can use an IP-address relay service to accurately determine the sender’s IP address. This is required to accurately check that the sender’s IP address is authorized to send email for the domain (SPF check). To use this, you will need to set up your own service, see documentation on filter acato_email_essentials_ip_services. Without this service, IP detection can be inaccurate because it will use the website itself as a relay. Use of a reverse proxy, load balancer etc. can lead to incorrect IP detection. WordPress Filters acato_email_essentials_settings — Filter plugin settings. acato_email_essentials_defaults — Filter default settings. acato_email_essentials_subject — Filter email subject. acato_email_essentials_body — Filter HTML body of the email. acato_email_essentials_head — Filter HEAD section of HTML email. acato_email_essentials_css — Filter CSS for the email. acato_email_essentials_minify_css — Filter CSS minification. acato_email_essentials_mail_is_throttled — Check if mail should be throttled. acato_email_essentials_mail_throttle_time_window — Set mail throttle time window. acato_email_essentials_mail_throttle_max_count_per_time_window — Set max emails per time window. acato_email_essentials_mail_throttle_batch_size — Set mail batch size. acato_email_essentials_ip_services — Define custom IP services for accurately determining the sender’s IP address. acato_email_essentials_ip_service — Filter individual IP service URLs. acato_email_essentials_website_root_path — Filter to supply the correct website root path in case of non-standard setups. acato_email_essentials_development_tlds — Filter development/local TLDs. WordPress Filters in detail Plugin Settings acato_email_essentials_settings Parameters: – (array) $settings The current settings of the plugin. Expected return: – (array) The new settings of the plugin. acato_email_essentials_defaults Parameters: – (array) $defaults The current default settings of the plugin. Expected return: – (array) The new default settings of the plugin. Email Content acato_email_essentials_subject Parameters: – (string) $the_subject Subject for the email. – (PHPMailer) $mailer The PHPMailer object (by reference). Expected return: – (string) The (altered) Subject. acato_email_essentials_body Parameters: – (string) $should_be_html A text that should be html, but might not yet be, your job to make a nice HTML body. – (PHPMailer) $mailer The PHPMailer object (by reference). Expected return: – (string) A text that should be html. acato_email_essentials_head Parameters: – (string) $the_head_section HTML that is the HEAD section of the HTML email. – (PHPMailer) $mailer The PHPMailer object (by reference). Expected return: – (string) The altered HEAD section of the HTML email. acato_email_essentials_css Parameters: – (string) $the_css CSS for the email (empty by default). – (PHPMailer) $mailer The PHPMailer object (by reference). Expected return: – (string) The (altered) CSS. acato_email_essentials_minify_css Parameters: – (string) $css CSS to be minified. Expected return: – (string) The minified CSS. Mail Throttling acato_email_essentials_mail_is_throttled Parameters: – (bool) $is_throttled Whether the mail is currently throttled. – (string) $ip The sender’s IP address. – (int) $mails_recently_sent Number of mails recently sent from this IP. Expected return: – (bool) Whether the mail should be throttled. acato_email_essentials_mail_throttle_time_window Parameters: – (int) $time_window Time window in seconds for counting sent emails. Expected return: – (int) The (altered) time window in seconds. acato_email_essentials_mail_throttle_max_count_per_time_window Parameters: – (int) $count Maximum number of emails allowed per time window. Expected return: – (int) The (altered) maximum count. acato_email_essentials_mail_throttle_batch_size Parameters: – (int) $size Number of emails to send in a single batch. Expected return: – (int) The (altered) batch size. IP Detection acato_email_essentials_ip_services Parameters: – (array) $services The current list of IP services used to determine the sender’s IP address. Expected return: – (array) The (altered) list of IP services. The services must be keyed with ipv4, ipv6 and dual-stack. The values must be URLs that return the IP address in plain text. The dual-stack service should return an IPv6 address if available, otherwise an IPv4 address, never both. You can set-up your own service like this; You will need a webserver that can run PHP, and you need a DNS service that allows you to manually add records. You will need three webspaces, for example; ipv4.myservice.com, ipv6.myservice.com and dual-stack.myservice.com. You could use the same webspace for all three, but you will still need three subdomains on the service. For the ipv4 subdomain, ONLY register an A record, pointing to the webserver’s IP address. For the ipv6 subdomain, ONLY register an AAAA record, pointing to the webserver’s IPv6 address. For the dual-stack subdomain, register both an A and an AAAA record, pointing to the webserver’s IP addresses. Create a file called index.php in each of the webspaces with the following content: php <?php header('Content-Type: text/plain'); print $_SERVER['REMOTE_ADDR']; That’s it. You can now use these services in the plugin settings like this; `php add_filter(‘acato_email_essentials_ip_services’, ‘my_custom_ip_services’); function my_custom_ip_services($services) { // Add your custom services here $services[‘ipv4’] = ‘https://ipv4.myservice.com’; $services[‘ipv6’] = ‘https://ipv6.myservice.com’; $services[‘dual-stack’] = ‘https://dual-stack.myservice.com’; return $services; } ` acato_email_essentials_ip_service Parameters: – (string) $service The URL of the IP service for the given type. – (string) $type The type of IP service (‘ipv4’, ‘ipv6’, or ‘dual-stack’). Expected return: – (string) The (altered) IP service URL. Filter to modify individual IP service URLs based on type. acato_email_essentials_website_root_path Parameters: – (string) $path The current website root path. Expected return: – (string) The (possibly altered) website root path. Filter to supply the correct website root path in case of non-standard setups. acato_email_essentials_development_tlds Parameters: – (array) $tlds Array of top-level domains considered as development environments. Expected return: – (array) The (altered) array of development TLDs. Filter to modify which TLDs are treated as development/local environments. Default values are ‘local’ and ‘test’. Scripts/styles In the public/scripts and public/styles folder you find the JS and CSS files used in the plugin admin area. These files are processed with Webpack, just so it works in all recent browsers. Script is nearly identical to the source. You can find the source files in the src/scripts and src/styles folders. If you feel the need to modify these files, you can change them there, and run npm install ; npm run build to create the production files. Translation files You can use npm run i18n to generate the POT file for translation, update the PO files in the languages folder, and compile to MO/php files. This is a one-task-does-all; run it, change the translations, run it again. Done. See package.json for more details or individual commands. Tools In the tools folder you will find a script to generate DKIM keys, should you want to use DKIM signing. rename to remove the .txt extension and run it in a shell. Tools are provided as-is, without support. Use at your own risk. Read the scripts before using them. You DO NOT HAVE TO USE these scripts, you can generate DKIM keys with any tool you like. Arbitrary section For advanced configuration and custom IP services, see the plugin documentation or source code.