Provider guide · Yahoo Mail
Yahoo treats WordPress as a third-party app, and third-party apps do not get your account password: they get a dedicated app password, generated in the account security page. Create it first, and the rest is three fields.
1 · Credentials
Any mail app that does not sign in through Yahoo’s own login page needs its own app password. WordPress is exactly that case.
Sign in to the Yahoo Account Security page at login.yahoo.com/account/security.
Under External connections, choose Create app password.
Name the app, “WordPress” will do, click Generate password, and copy the code straight into the plugin.
One Yahoo particularity worth writing down: app passwords survive an account password change. Changing your Yahoo password does not break WordPress; to cut an app off, you delete its app password explicitly from the same page.
2 · In the plugin
Selecting the Yahoo preset fills the server (smtp.mail.yahoo.com), the port (587) and the encryption (TLS). What remains is yours.
Your full address, you@yahoo.com.
The app password you generated, not your account password.
The same Yahoo address you authenticate with.
Save, then use Send Test Email. Yahoo also documents port 465 with SSL; if 587 is blocked from your hosting, switching the port to 465 and the encryption to SSL is the sanctioned alternative.
3 · Pitfalls
Yahoo’s rules are few, but each one looks like a mystery failure the first time.
Typing your Yahoo sign-in password into the plugin earns an authentication error, however correct it is. Third-party mail apps authenticate with app passwords; that is the design, not a fault. Generate one under External connections on the Account Security page.
A consumer Yahoo mailbox is built for personal correspondence, not for a store’s daily traffic, and Yahoo has been a driving force behind the stricter bulk-sender rules of recent years. A contact form on a small site is fine; anything resembling volume deserves a transactional provider such as Brevo or Postmark, sending from your own domain.
Sending with a From that is not the authenticated mailbox is the classic way to fail modern alignment checks, since your domain’s DNS never authorised Yahoo’s servers. Keep sender and account identical, and if you want mail from your own domain, that is the moment to pick a provider that verifies domains.
The email log keeps the exact error message the server returned, which is the fastest route to the cause. The documentation walks through the common ones.
There is a guide like this one for each of the twelve presets, from Gmail to Amazon SES, and the plugin takes any other SMTP server too.