Custom SMTP
SMTPCUSTOM · FOR WORDPRESS

Free plugin · v2.7 · No account

Make your WordPress email arrive.
And know when it doesn’t.

Hosts have spent years switching off the PHP mail() function WordPress relies on, because spammers loved it. Custom SMTP replaces it with the provider you already have, from Gmail or Brevo to your host’s own SMTP server, keeps a record of every message, and warns you the day sending breaks.

Install from WordPress.orgHow it works

Free, all of itNo accountAbout five minutesEnglish & French

Works with the provider you already use

Works with Gmail, Outlook, Brevo, SendGrid, Mailgun, Amazon SES, Postmark, Mailjet, Zoho, Yahoo, iCloud, and any SMTP server your host provides.

Sound familiar?

You are probably here
for one of these four.

None of them is a broken theme, a broken form plugin or a broken WordPress. They are all the same problem wearing four different costumes.

Contact formThe form says thank you, and then nothing ever reaches my inbox.
Online shopCustomers keep telling me their order confirmation went to spam. Or nowhere.
AccountsSomeone asked to reset their password and the email simply never came.
Out of nowhereIt worked for two years. I changed nothing. Now half of it disappears.

The cause is the same every time. WordPress asks the server to post the message, the server posts it from an address your domain never authorised, and the receiving side treats it as forged. Nothing bounces, nothing errors, nothing appears anywhere. The message is simply gone, and your site cheerfully reports success.

Setting it up

Three steps.
No code, no FTP.

The order matters here, which is why these are numbered. Nothing else in the plugin needs to be done in sequence.

STEP 01

Install it

Plugins, Add New, search for Custom SMTP, activate. From that moment every email your site sends is being recorded, before you have configured anything at all.

STEP 02

Pick your provider

Settings, then Custom SMTP. Choose your provider from the list and the server address, port and encryption fill themselves in. Enter the username and password it gave you.

STEP 03

Send yourself a test

One button tests the connection, another sends a real email. When something is wrong, the error comes back as a sentence you can act on rather than a numeric code.

No provider yet?

Your hosting company almost certainly gave you one with your plan, at no extra cost. Gmail, Outlook, Brevo and the others work too, and several are free at the volume a small site sends.

See the list

Email log

Now you can answer
“did it actually send?”

This is the part people keep the plugin for. Every message your site sends is listed with its status, and a failure tells you exactly why it failed instead of vanishing.

Settings · Custom SMTP · Email Logs 1 248 records · retention 30 days
Date sentRecipientSubjectStatus
2026-07-27 14:02client@example.comYour order #1481 has shippedSentPreview
2026-07-27 13:58newsletter@example.orgPassword reset requestedSMTP Error: could not authenticate. 535 5.7.8 Bad credentialsFailedResend
2026-07-27 13:41contact@studio.frNouveau message depuis le formulaire de contactSentPreview
2026-07-27 13:12accounts@example.comInvoice 2026-0431 attachedSentPreview

Read what was sent

Open any message and see it as the recipient received it, then download it if you need to keep a copy.

Fix it, then resend

Correct whatever broke and send the failed message again from its own row. Nobody has to fill in the form a second time.

Search and export

Search by recipient or subject, filter by status, export the result to a spreadsheet when someone asks for proof.

It cleans up after itself

Records older than your retention setting are deleted once a day, automatically. Thirty days by default, anything from one to 365.

New in v2.7

Turn off the emails
you never asked for.

WordPress emails the admin about password resets, new users, automatic updates and comments, whether you want that or not. Until now the fix was code in functions.php. Now it is a row of switches.

Settings · Custom SMTP · WordPress notifications
  • Password change notice to admin
  • New user notice to admin
  • Core auto-update result email
  • Plugin and theme auto-update emails
  • Comment moderation notice
  • New comment notice to post author
  • Nothing is off by default. Until you flip a switch, your site behaves exactly as it always has.
  • Account recovery stays safe. The switches only cover notices sent to the admin, never the reset link your users need to get back in.
  • Muted means not sent. A switched-off notification never leaves the site, so it does not clutter the log either.
  • Asked for by a user, shipped free. Elsewhere this screen exists too, behind a paywall.

Agencies & freelancers

If you look after
other people’s sites.

Email is the support ticket that never ends, because the client experiences it as “your site is broken” and you have nothing to show them. That is the problem this plugin was actually shaped around.

“I never got the email”

Search the log by their address. Either you show them the timestamp and the delivery, or you see the exact error and know it is yours to fix. The conversation ends in a minute instead of three rounds of email.

Resend without asking

Fix the credentials, then resend the message that failed straight from the log. Your client never finds out that their customer’s invoice was stuck.

The same setup on every site

Push the configuration in through environment variables or constants and every site in your portfolio is identical, locked, and impossible for a client to break by clicking around the admin.

Nothing sells to your client

No banner, no upgrade nag, no trial countdown in an admin you are responsible for. Your client is never shown a screen inviting them to buy something behind your back.

You hear about it first

Alerts fire on a burst of sending or on a run of failures, by email and by webhook into Slack or Teams. You find out when the shop stops confirming orders, not when the client notices a week later.

Nothing to justify

No third-party service in the path, so no processor to declare, no subscription to expense per site, and no account to hand over the day the client leaves you.

The short version

What this plugin
will never do.

Most of the reasons people move to Custom SMTP are on this list rather than on the feature list, so it is worth being explicit about them.

Open source, GPLv2, and free forever. The full plugin is the free plugin. The code is public on WordPress.org, anyone can read it, audit it or fork it, and there is no paid edition waiting behind a banner. There never will be. Everything above follows from that.

Your data

The log stays
on your server.

An email log holds personal data, so it is fair to ask exactly where it goes and how long it stays. Here is the whole answer.

Records are written to one table in your own WordPress database, next to everything your site already stores. Nothing is copied anywhere else, and the plugin makes no outbound request other than to the mail provider you configured, plus your own webhook if you chose to set one up.

  • Message bodies are not stored unless you switch that on deliberately. By default a record holds the recipient, the subject, the status and the error.
  • Retention is yours to set, from one day to a year, thirty days by default, enforced automatically once a day.
  • Passwords are encrypted at rest, with keys derived from your own WordPress salts rather than anything shipped inside the plugin.
  • Export and deletion are one click each, which is what makes a data request answerable rather than theoretical.

Honest advice

If it still
lands in spam.

This plugin fixes how your site sends. It cannot make the receiving side trust your domain, and no plugin can. Three things decide that, and all three live in your DNS.

SPF: who is allowed to send for you

A short line in your DNS naming the servers permitted to send email using your domain. Your provider publishes the exact value to add. Without it, a correctly sent message can still be treated as suspicious.

DKIM: proof the message was not altered

A signature added to each message and checked against a key in your DNS. Most providers generate the record for you and ask you to paste it in once. It is the single most effective item on this list.

DMARC: what to do when the first two fail

A policy telling receiving servers how to treat mail that fails the checks above, and where to send reports about it. Start in the permissive mode your provider recommends, read the reports for a fortnight, then tighten.

None of this needs the plugin, and we would rather say so plainly. What the plugin gives you is the log that tells you whether the problem is on your side at all, which is usually the first hour of the investigation.

Providers

Pick yours.
The fields fill themselves.

Eleven presets ship with the plugin, and the last tile takes any server you like, including the one your hosting company gave you. Every preset stays editable field by field.

587

Gmail

smtp.gmail.com
TLS

587

Outlook

smtp.office365.com
TLS

API

Amazon SES

SESv2 or SMTP
IAM role

587

SendGrid

smtp.sendgrid.net
TLS

587

Mailgun

smtp.mailgun.org
TLS

587

Brevo

smtp-relay.brevo.com
TLS

587

Postmark

smtp.postmarkapp.com
TLS

587

Mailjet

in-v3.mailjet.com
TLS

587

Zoho

smtp.zoho.com
TLS

587

Yahoo

smtp.mail.yahoo.com
TLS

587

iCloud

smtp.mail.me.com
TLS

ANY

Your host

server, port, login
your call

And on the WordPress side, everything. WooCommerce, Contact Form 7, WPForms, Gravity Forms, membership plugins, booking plugins, password resets, new user notifications. If it sends email through WordPress, it goes through Custom SMTP and it appears in the log.

Questions

The ones people
actually ask.

Everything here is in the free plugin. No pro version, no account, no call home.

Do I need to understand what SMTP means?

No. You need the server address, username and password that your email provider or hosting company gave you. Pick your provider from the list, paste those two values, send a test. If the test fails, the plugin tells you which of the two is wrong.

Will it work on my shared hosting?

Yes. Shared hosting is where it is used most, and it is exactly the case where the default WordPress behaviour fails most often. It needs WordPress 6.0 or newer and PHP 7.4 or newer, which any current hosting plan provides.

Does it work with WooCommerce and my contact form?

Yes, and with everything else. The plugin takes over the single function that all of WordPress uses to send email, so WooCommerce, Contact Form 7, WPForms, Gravity Forms and any other plugin are covered without configuring them one by one.

Where does my email password end up?

Encrypted in your own database, with a key derived from your WordPress salts. It is never displayed again after you save it, and it never leaves your server. If you would rather store no password at all, the Amazon SES option can authenticate without one.

Will the log slow my site down or fill my database?

One small row is written per email, on a site that sends a few dozen a day. Records past your retention setting are deleted daily, and message bodies are not stored unless you ask for them. On a busy site you can lower the retention or turn logging off entirely.

Is it really free?

Yes, GPLv2, on the WordPress.org repository. There is no paid version to upgrade to, which also means there is no feature deliberately held back to make you want one.

Find out where
your email actually goes.

Install it, pick your provider, send yourself a test. It takes about as long as reading this page.

Install from WordPress.orgRead the technical detail

v2.7GPLv2No accountNo upsell