Provider guide · Gmail
The settings take a minute. The part that catches everyone is the password: Gmail refuses the one you type to sign in, and wants a dedicated app password instead. Here is where to create it, what to enter, and the limits to know about.
1 · Credentials
Google removed password sign-in for mail apps: your account password will be refused no matter how correctly you type it. An app password is the supported replacement.
An app password is a 16-character code that stands in for your account password in one specific app, your WordPress site here. Two conditions: your Google account needs 2-Step Verification switched on first, and on a Google Workspace account the option exists only if your administrator’s policy allows it.
If it is not already: Google Account, Security, 2-Step Verification.
Open myaccount.google.com/apppasswords, name the app something like “WordPress”, and create it.
Google shows it once; if you lose it, delete it and create a new one.
If the app passwords page says the option is unavailable, you are usually on an account restricted to security keys, under Advanced Protection, or on a Workspace account whose admin has not enabled 2-Step Verification for users.
2 · In the plugin
Selecting the Gmail preset fills the server (smtp.gmail.com), the port (587) and the encryption (TLS). What remains is yours.
Your full address, you@gmail.com or your Workspace address.
The app password you just created, not your account password.
The same address you authenticated with. Gmail sends on behalf of the signed-in account, so a mismatched sender is the fast lane to spam folders, or to a rewritten From.
Save, then use Send Test Email. If the test fails with an authentication error, the app password is the first thing to re-check: create a fresh one and paste it again.
3 · Pitfalls
All four below come from Google’s own documentation, and all four look like a plugin bug until you know them.
Google has switched off password-only sign-in for third-party mail apps; for Google Workspace accounts the shutdown completed in 2025. A correct account password still gets “could not authenticate”. Only an app password, which requires 2-Step Verification, is accepted.
When you change your account password, Google deletes your existing app passwords, and WordPress starts failing with an authentication error out of nowhere. If sending broke right after a password change, create a new app password and paste it in; that is the whole fix.
Google documents roughly 500 messages per day for personal accounts and 2,000 for paid Workspace accounts, with a cap of 100 recipients per message via SMTP. Plenty for a contact form, tight for a shop in the sales, wrong for a newsletter. If your volume is growing, a transactional provider such as Brevo or Amazon SES is the natural next step.
Send from the address you authenticated with. Gmail only lets you use a different From if that address is verified as a “Send mail as” alias in the Gmail settings of the account, and mail from unrelated addresses is liable to be rewritten or distrusted.
The email log keeps the exact error message the server returned, which is the fastest route to the cause. The documentation walks through the common ones.
There is a guide like this one for each of the twelve presets, from Gmail to Amazon SES, and the plugin takes any other SMTP server too.