Noor Alam

<a href="https://wphowto.net/gmail-smtp-plugin-for-wordpress-1341" rel="nofollow ugc">Gmail SMTP</a> plugin allows you to authenticate with your Gmail account to send email via Gmail SMTP server.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/_MCxcvfoGj4?version=3&rel=0&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
Most shared hosting servers have restrictions when it comes to email. Usually email will get blocked or missing for no reason. Sometimes it will get blocked when your website reaches the daily limit of outgoing email. This plugin can bypass this issue by routing the email through Gmail’s SMTP server.
<h3>Gmail SMTP Add-ons</h3>
<ul>
<li><a href="https://wphowto.net/how-to-add-a-reply-to-address-in-the-gmail-smtp-wordpress-plugin-6756" rel="nofollow ugc">Reply-To</a></li>
<li><a href="https://wphowto.net/gmail-smtp-plugin-cc-configuration-6770" rel="nofollow ugc">Cc</a></li>
<li><a href="https://wphowto.net/gmail-smtp-email-logger-7336" rel="nofollow ugc">Email Logger</a></li>
</ul>
<h3>Gmail SMTP Benefits</h3>
<ul>
<li>Gmail SMTP plugin is not like most SMTP plugins. It uses the OAuth 2.0 protocol to authorize access to the Gmail API – which means a more secure login system and users won’t have to enter any username or password.</li>
<li>Gmail SMTP plugin uses PHPMailer – a very popular library used for sending email through PHP’s mail function. This libary is also used in the core WordPress to send email.</li>
<li>Gmail SMTP plugin utilizes “wp_mail” (A function used by WordPress to send email) instead of completely overriding it. This way you still get all the benefits of the default mail function. </li>
<li>You no longer need to enable Allow less secure apps on your gmail account to fix SMTP connection issue. This issue became prominent from December 2014, when Google started imposing XOAUTH2 authentication (based on OAuth2) to access their apps. This issue still affects almost all the SMTP plugins because they authenticate via username and password.</li>
</ul>
<h3>How OAuth 2.0 Authorization Works</h3>
<ul>
<li>You register an application in the Google Developers Console.</li>
<li>The application is launched and it requests that you give it access to data in your Google account.</li>
<li>If you consent, the application receives credentials to access the Gmail API.</li>
</ul>
<h3>Gmail SMTP Features</h3>
<ul>
<li>Configure your website to send email using Gmail SMTP server</li>
<li>Authenticate using OAuth 2.0 protocol</li>
<li>Authenticate with encryption when sending an email (TLS/SSL)</li>
</ul>
<h3>Gmail SMTP Basic Setup</h3>
<ul>
<li>Create a new project in Google Developers Console.</li>
<li>Enable Gmail API in it.</li>
<li>Create credentials (OAuth client ID) to access this API.</li>
<li>Configure the consent screen for the web application.</li>
<li>Enter a Product Name and a Privacy policy URL.</li>
<li>Once the consent screen is configured, create a web application.</li>
<li>Go to the plugin settings (<code>Settings->Gmail SMTP</code>).</li>
<li>Set the Authorized Redirect URL of the application as the one shown in the settings.</li>
<li>Finish creating the web app.</li>
<li>Copy the newly created Client ID and Client secret and paste into the settings area.</li>
<li>Enter your OAuth Email, From Email and From name.</li>
<li>Select an encryption.</li>
<li>Enter a port number.</li>
<li>Save the settings.</li>
<li>Now you can authorize your application to access the Gmail API by clicking on the Grant Permission button.</li>
<li>Once the application has been authorized Gmail SMTP plugin will be able to take control of all outgoing email.</li>
</ul>
<h3>Gmail SMTP Settings</h3>
<ul>
<li>Authorized Redirect URI: Authorized redirect URL for your website. You need to copy this URL into your web application.</li>
<li>Client ID: The client ID of your web application.</li>
<li>Client secret: The client secret of your web application.</li>
<li>OAuth Email Address: The email address that you will use for SMTP authentication. This should be the same email used in the Google Developers Console.</li>
<li>From Email Address: The email address which will be used as the From Address when sending an email.</li>
<li>From Name: The name which will be used as the From Name when sending an email.</li>
<li>Type of Encryption: The encryption which will be used when sending an email (TLS/SSL. TLS is recommended).</li>
<li>SMTP Port: The port which will be used when sending an email. If you choose TLS it should be set to 587. For SSL use port 465 instead.</li>
<li>Disable SSL Certificate Verification: As of PHP 5.6 a warning/error will be displayed if the SSL certificate on the server is not properly configured. You can check this option to disable that default behaviour.</li>
</ul>
<h3>Gmail SMTP Test Email</h3>
Once you have configured the settings you can send a test email to check the functionality of the plugin.
<ul>
<li>To: Email address of the recipient.</li>
<li>Subject: Subject of the email.</li>
<li>Message: Email body.</li>
</ul>
For detailed setup instructions please visit the <a href="https://wphowto.net/gmail-smtp-plugin-for-wordpress-1341" rel="nofollow ugc">Gmail SMTP</a> plugin page.

Gmail SMTP


Only the necessary settings, simple and clean, good description. Thanks!


All is good!


The plugin is great when it works.



The plugin suddenly stopped working. I contacted support, they checked the site, and stopped answering. They did not say yes, no, we can or cannot fix it. They stopped answering.My finding are that the plugin only works on small wordpress website installs, on the root directory.



The plugin is not capable to handle large sites or sites installed on directories other than the root.That means, if you grow, you will start encountering problems with this plugin. Same as I did.



I am now using Fluent SMTP, it works out of the box with no sweat.



Thanks 


Good when it works, only for small sites installed at root

Connect to Gmail SMTP server to automatically send email from your WordPress site. Configure wp_mail() to use SMTP with OAuth 2.0 authentication.

Pinny Fried

Pinny’s Simple SMTP is a ultra lightweight SMTP plugin weighing in at just 4KB. It’s simple to use, highly secure, and includes all the basic features you need to send emails reliably.
<h3>🚀 Super Easy 30-Second Configuration</h3>
Tired of bloated setup wizards, “Connect Account” popups, and endless menus?
Pinny’s Simple SMTP is designed to be invisible. We removed the fluff so you can get back to work. 
1. Enter your Host & Port. 
2. Enter your Login. 
3. Click Save.
That’s it. You are done. 
There is no complex UI to learn. No dashboards to manage. It is a true “Set and Forget” solution that just works.
Unlike most SMTP plugins (which are typically 2MB+ in size), Pinny’s Simple SMTP is ultra-lightweight, easy to set up, and never compromises on security. We ensure your sensitive credentials are always protected with automatic encryption—no more storing passwords in plain text.
This plugin is different. It’s smaller than a favicon, works with any mail provider, and takes just seconds to set up.
Features:
<ul>
<li>Ultra Lightweight (4KB): This is the a ultra lightweight SMTP plugin. It has zero impact on your site speed.</li>
<li>Encrypted Security: We take security seriously. Your SMTP password is encrypted in the database using native WordPress salts. We never store credentials in plain text.</li>
<li>Dead Easy Setup: No confusing wizards or tutorials needed. Just enter your Host, Port, and Login, then click Save.</li>
<li>All Basic Features: Supports TLS/SSL, custom ports, “From” email/name overrides, and includes a 1-Click Test Email tool.</li>
<li>Zero Bloat: No ads, no dashboard widgets, no usage tracking, and no upsells.</li>
<li>wp-config Configuration Mode: For added security, define SMTP settings in <code>wp-config.php</code> and lock the admin UI.</li>
</ul>
<h3>⚙️ Advanced: Configure SMTP via wp-config.php</h3>
Pinny’s Simple SMTP supports configuration directly from <code>wp-config.php</code>, allowing administrators and developers to lock SMTP settings and prevent changes from the WordPress dashboard.
When enabled, the plugin automatically switches the admin interface to read-only mode.
To enable this mode, add the following constants to your <code>wp-config.php</code> file
<pre><code>define('PINNYS_SMTP_FORCE', true);

define('PINNYS_SMTP_ENABLED', true);
define('PINNYS_SMTP_HOST', 'smtp.gmail.com');
define('PINNYS_SMTP_PORT', 587);
define('PINNYS_SMTP_ENCRYPTION', 'tls');

define('PINNYS_SMTP_AUTH', true);
define('PINNYS_SMTP_USERNAME', 'your@email.com');
define('PINNYS_SMTP_PASSWORD', 'your_app_password');

define('PINNYS_SMTP_FROM_EMAIL', 'your@email.com');
define('PINNYS_SMTP_FROM_NAME', 'Your Website');
</code></pre>
Once <code>PINNYS_SMTP_FORCE</code> is enabled:
<ul>
<li>SMTP settings are loaded from <code>wp-config.php</code></li>
<li>The WordPress settings page becomes read-only</li>
<li>Dashboard changes cannot override your configuration</li>
</ul>
Note: If <code>PINNYS_SMTP_FORCE</code> is not defined, the plugin behaves normally and settings can be configured from the WordPress dashboard.
<h3>🛡️ The “Zero-Retention” Security Promise</h3>
Pinny’s Simple SMTP is built on a strict security philosophy: WordPress is a CMS, not an Email Archive.
Most SMTP plugins log every email sent from your site into your WordPress database. While this seems convenient, it introduces massive security risks, database bloat, and privacy violations.
We feature a Zero-Retention Architecture. We connect, deliver, and vanish. Here is why this is safer for you:
<h4>1. The Security Risk (Why we don’t log)</h4>
Storing email logs in your database creates a high-value target for hackers.
<ul>
<li>The “Big Hack” Reality: In 2024 and 2025, major SMTP plugins (such as Post SMTP) suffered critical vulnerabilities (<a href="https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af" rel="nofollow ugc">CVE-2023-6875</a> and <a href="https://zeropath.com/blog/cve-2025-11833-post-smtp-unauthorized-email-log-access" rel="nofollow ugc">CVE-2025-11833</a>). Hackers were able to bypass authentication, trigger password reset emails, read the plugin’s email logs to capture the reset link, and take over the entire website.</li>
<li>Our Fix: You cannot steal what isn’t there. By not logging emails, Pinny’s Simple SMTP renders this entire class of “Account Takeover” attacks impossible.</li>
</ul>
<h4>2. The Database & Privacy Problem</h4>
<ul>
<li>Bloat: Transactional logs grow indefinitely. A busy store sends thousands of emails a month. Storing these in <code>wp_options</code> or custom tables slows down your site and bloats your backups.</li>
<li>GDPR & Privacy: Your database should not permanently store customer PII (Personally Identifiable Information) like password reset links, purchase receipts, or private contact form messages. If your site is compromised, those logs are a leak waiting to happen.</li>
</ul>
<h4>3. The Right Way to Log</h4>
If you need to track email delivery, do it where it belongs: At your Email Provider.
<ul>
<li>Gmail / Google Workspace: Has a “Sent” folder and comprehensive audit logs.</li>
<li>SendGrid / Mailgun / SES: These services are built to archive millions of emails securely, with proper rotation policies and access controls.</li>
<li>Microsoft / Outlook: Native “Sent Items” retention. 
Pinny’s Simple SMTP keeps your WordPress database clean, fast, and secure by letting your email provider do its job.</li>
</ul>
<h3>🚫 The “Anti-Bloat” Architecture: Why We Rejected OAuth</h3>
Pinny’s Simple SMTP is built on a strict performance philosophy: Do not load code you do not use.
The industry standard is to force users into OAuth (Log in with Google/Microsoft). While this looks fancy, for a WordPress plugin, it is technically inferior to standard SMTP. Here is why we deliberately stripped OAuth out of Pinny’s:
1. The “Universal Adapter” Trap (Bloat) 
Most users connect to one provider (e.g., just Gmail). However, to support OAuth, other plugins must bundle massive SDK libraries for 10–15 different services (Google, Microsoft, Amazon, Yahoo, Zoho, etc.).
<ul>
<li>The Result: You install megabytes of vendor code just to send a simple email.</li>
<li>Our Fix: Pinny’s uses standard SMTP. We don’t force you to host 14 unused API libraries on your server just to use the 15th. This keeps our codebase at ~4KB.</li>
</ul>
2. The Complexity Risk (Security) 
In security, Complexity is the Enemy. OAuth flows require redirects, token storage, refresh tokens, and constant API updates. Every external library added to a plugin increases the “Attack Surface”—more code means more places for bugs to hide.
<ul>
<li>The Reality: If a plugin’s bundled “Google API Client” has a vulnerability, your site is at risk—even if you are using Outlook.</li>
<li>Our Fix: We use native WordPress functions. No external dependencies. No third-party SDKs. No supply-chain vulnerabilities.</li>
</ul>
3. The Reality of “Shared OAuth Infrastructure” 
Many plugins advertise “one-click OAuth login” for Gmail or Microsoft 365. To provide this convenience without requiring users to create their own developer credentials, these plugins typically authenticate through a shared OAuth application (Client ID and Secret) owned by the plugin developer.
This creates several potential risks including:
<ul>
<li>Shared API rate limits OAuth quotas apply to the shared application, not your individual site.</li>
<li>Abuse impact If other sites using the same OAuth application send spam or violate provider policies, the provider may restrict or flag the application, potentially affecting all connected users.</li>
<li>Application suspension When the shared OAuth application is disabled or restricted by the provider, authentication will fail for every site using it.</li>
<li>Developer infrastructure dependency Some plugins route OAuth authentication through servers operated by the plugin developer. If that infrastructure experiences downtime, users may be unable to connect accounts or refresh authentication tokens.</li>
<li>Maintenance risk OAuth integrations require ongoing API updates. If a plugin is abandoned and the OAuth application is not maintained, authentication may eventually stop working.</li>
</ul>
Pinny’s Simple SMTP avoids these dependencies entirely by using direct SMTP authentication, allowing your site to communicate directly with your mail server without shared OAuth infrastructure.
4. App Passwords: The Superior Choice 
We use App Passwords (Standard SMTP Authentication). This is the secure, recommended method for server-side mailing (Gmail/Workspace & Microsoft 365).
<ul>
<li>Strictly Scoped: An App Password usually only has permission to send mail. Unlike an OAuth token (which can sometimes be scoped too broadly), an App Password cannot be used to change your account settings or read your Drive files.</li>
<li>Instantly Revocable: If you suspect a breach, you can revoke that specific App Password instantly from your Google/Microsoft dashboard without changing your main login credentials.</li>
<li>Zero Downtime: OAuth tokens expire or disconnect if the API changes. App Passwords work until you say stop.</li>
</ul>
Pinny’s Simple SMTP chooses stability over shiny buttons. Enter your Host, Port, and App Password → Save. Done.

Pinny’s Simple SMTP – Lightweight SMTP Mailer

Ultra lightweight SMTP plugin (~4KB). Encrypted passwords, zero bloat, and simple setup for Gmail, Outlook, and any mail server.

Gmail SMTP vs Pinny’s Simple SMTP – Lightweight SMTP Mailer