Host Header Injection Fix vs SMTP2GO for WordPress –

👉 Enables custom headers for WP email notifications 👉 Also provides a “set it and forget it” security fix for WP < 5.5 👉 Uses only 50KB of code, so super lightweight, fast, and effective Important As of WordPress 5.5, this plugin no longer is necessary to fix the host-header security issue reported in Ticket #25239 finally is fixed, and mentioned in this post WordPress 5.5 Beta 4. Thank You WordPress devs! Is this plugin still useful? Yes, it enables you to choose the “From”, “Name”, and “Return-Path” headers for all WP notification emails. And for versions of WordPress less than 5.5, this plugin continues to fix the host-header injection security issue. Features This simple plugin does three things: Sets custom From, Name, and Return-Path for WP notifications Fixes a security vulnerability in WordPress versions < 5.5 Fixes a bug where invalid email addresses may be generated (in WordPress versions < 5.5) Choose from the following options: Use WordPress defaults (insecure for WP < 5.5) Use “Email Address” from WP General Settings Use a custom name and address Plus there is an option to use the specified From address as the Return-Path header. Why? The security issue fixed by this plugin has been known about since way back in WordPress version 2.3. There has been some talk about fixing, but nothing has been implemented. While the issue does not affect all sites, it does affect a good percentage of them, including some of my own projects. So, not wanting to get hacked, I decided to write my own solution. Hopefully this issue gets fixed in a future version of WordPress, and this plugin will become unnecessary. As a bonus, setting an explicit From address resolves a long-standing bug whereby an invalid email address is generated under the following conditions: A “From” address is not set, And the $_SERVER['SERVER_NAME'] is empty So by explicitly setting a “From” address, we prevent this bug from happening. Security Issue What is the security issue addressed by this plugin? Follows is a quick summary. To learn more in-depth, check out the resources linked in the next section. WP uses $_SERVER['SERVER_NAME'] to set the “From” header in email notifications This includes sensitive email notifications like password resets and user registration In some cases, an attacker could modify the “From” header and intercept the email Using the intercepted email, an attacker could gain access to your site and wreak havoc More Infos This security vulnerability is well-known and has been around for a looong time. To learn more, check out these articles: WP Core Trac Ticket Exploit Box Info Exploit Database Privacy This plugin does not collect or store any user data. It does not set any cookies, and it does not connect to any third-party locations. Thus, this plugin does not affect user privacy in any way. Host Header Injection Fix is developed and maintained by Jeff Starr, 15-year WordPress developer and book author. Support development I develop and maintain this free plugin with love for the WordPress community. To show support, you can make a donation or purchase one of my books: The Tao of WordPress Digging into WordPress .htaccess made easy WordPress Themes In Depth Wizard’s SQL Recipes for WordPress And/or purchase one of my premium WordPress plugins: BBQ Pro – Blazing fast WordPress firewall Blackhole Pro – Automatically block bad bots Banhammer Pro – Monitor traffic and ban the bad guys GA Google Analytics Pro – Connect WordPress to Google Analytics Head Meta Pro – Ultimate Meta Tags for WordPress REST Pro Tools – Awesome tools for managing the WP REST API Simple Ajax Chat Pro – Unlimited chat rooms USP Pro – Unlimited front-end forms Links, tweets and likes also appreciated. Thank you! 🙂

SMTP2GO’s WordPress plugin replaces the default built in wp_mail() functionality (phpmailer) and sends your email via SMTP2GO’s API and industry leading email delivery platform. SMTP2GO provides valuable insights into every aspect of your email’s life cycle, enabling you to track delivery rates, opens, clicks, and bounce rates. Whether your email is transactional, marketing, newsletter, contact form, or notification – we have got you covered. The main benefits of using the official SMTP2GO plugin: We have made our plugin as easy and low maintenance as possible – you can set it up in under ten minutes. Take over from the default WordPress email system for more reliable delivery – you can be confident your emails have arrived at their destination inbox successfully. Get access to our intuitive real-time reporting tools. You can uncover what is going on behind the scenes with delivery, open rates, click rates, bounce, and unsubscription reports. We offer secure worldwide servers with intelligent routing for network redundancy and speedy delivery. We handle SPF and DKIM on your behalf. SMTP2GO can even turn your “http” links into “https”. Diagnose and resolve delivery issues with our insightful reporting page, or reach out to our award-winning support team who are available almost 24/7 to help address problems in a timely, friendly fashion. We have a dedicated Review team who constantly monitor the reputations of our IP’s and we proactively alert members to any suspicious changes in their email regimen. Avoid poor reputation and throttling or limitations from over-used shared web hosts and other providers. Sign up here. Support If you have questions or need assistance then feel free to contact the support team by logging into your SMTP2GO dashboard and clicking the support icon on the top right navigation bar. More information on this plugin is available in our knowledgebase. About SMTP2GO Founded in 2006, SMTP2GO is a fast and scalable world class email service provider for sending transactional and marketing emails. It is developed and supported by a team of delivery experts at the forefront of the email industry, providing a reliable SMTP solution for over 35,000 businesses. Complexities such as reputation monitoring, SPF and DKIM are professionally managed for each customer. Native-English speaking support is available worldwide (agents in the USA, EU, UK, Australia, and New Zealand). Our data centers are located around the world, meaning lightning-fast connection speeds, network redundancy, and GDPR compliance.