Gmcfuerte SMTP Transport

WordPress sends password resets, order confirmations and form notifications with whatever the server hands it. On most hosting that means unauthenticated mail from an address the domain never authorised, which spam filters quietly discard.

Gmcfuerte SMTP Transport points the standard wp_mail() pipeline at an SMTP account you control, so messages leave authenticated and signed by the provider you already pay for.

It is deliberately small: one settings screen, one test button, no dashboard widgets, no onboarding wizard.

What makes this one different

Most SMTP plugins stop at configuring PHPMailer. This one also protects the failure path: if a migration, salt rotation or removed environment secret makes the saved credential unusable, it stops rewriting the From address instead of letting fallback mail impersonate the SMTP domain and fail SPF or DKIM. Its test send reports the mail server’s real refusal and whether SMTP was actually used; the password is write-only and may stay entirely outside the database. There is no telemetry, provider account or remote dashboard.

What it does

• Routes wp_mail() through your SMTP host, with STARTTLS, SSL/TLS, or no encryption when a local relay needs it (and “none” really means none: the automatic STARTTLS upgrade is switched off, instead of silently overriding the choice you made).
• Rewrites the From address and From name to match the authenticated account — and only while that account is really carrying the message. If SMTP stops working, the rewrite stops with it, because a rewritten From on mail sent by something else is what makes SPF and DKIM fail.
• Stores the SMTP password encrypted (AES-256-GCM) with a key derived from your own site salts, so the value is useless in a database copied elsewhere. The field is write-only: it never renders the stored password back to the browser.
• Accepts a GMCFUERTE_SMTP_PASSWORD constant in wp-config.php instead, for sites that keep credentials out of the database entirely. When it is defined, the settings field says so and is ignored.
• Sends a test email and tells you what really happened, including the reason the mail server gave when it refused. If the message went out through the server default transport rather than your SMTP account, it says that too, instead of reporting a pass.
• Refuses a half-finished configuration rather than saving one that silently falls back to unauthenticated mail.