WP Manifestindependent plugin directory
manifest / email / robotstxt-smtp

SMTP (by ROBOTSTXT) WP Registry grade C-. High-severity findings · 1 findingWP RegistryHigh-severity findings · 1 findingOpen the reportC- git.robotstxt.es #8 in Email & Notifications

Send every site email through a fully configurable SMTP server managed from the WordPress dashboard.

★ 0stars
553release downloads
≈30active sites
2.2.5latest · 2mo ago

Install

Download robotstxt-smtp-2.2.5.zip From the 2.2.5 release on git.robotstxt.es, Aug 24, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from git.robotstxt.es with WP-CLI:

wp plugin install https://git.robotstxt.es/robotstxt/robotstxt-smtp/releases/download/2.2.5/robotstxt-smtp-2.2.5.zip
Updates itself. It ships its own updater (Update URI header), so new versions appear under Dashboard → Updates.

Send every site email through a fully configurable SMTP server managed from the WordPress dashboard.

Description

SMTP (by ROBOTSTXT) replaces WordPress' native mail delivery with a secure SMTP connection and detailed guidance. The plugin is built for marketing teams, agencies, and technical departments that need a clear, complete solution ready for multisite installations.

Guided PHPMailer configuration

  • Routes wp_mail() through PHPMailer in SMTP mode with support for credentials, custom ports, and the None, SSL, or TLS encryption methods.
  • Adds inline help text with practical examples in every field: host, port, username, password, sender email, and sender name.
  • Automatically changes the port when it matches the default value for the selected encryption type (25, 465, or 587).
  • Lets you set default sender information for the site to keep a consistent identity across outgoing messages.

Tools for support and marketing teams

  • Settings → SMTP → Test screen for sending manual test emails and confirming the connection to the server.
  • Tools panel packed with diagnostics: automatic MX lookup, SPF/DKIM/DMARC checks, extended SMTP server diagnostics, and DNS reputation monitoring.
  • Caches results from each tool for 24 hours (with a manual refresh option) to streamline recurring tasks for your team.

Comprehensive delivery logs

  • Saves the subject, recipients, headers, content, and attachments for every email sent.
  • Browse logs from Settings → SMTP → Logs with pagination and access to the details of each delivery.
  • Configure automatic cleanup by maximum entries or age in days, plus an instant "Clear all" button to wipe the history.

Multisite-ready configuration

  • Choose whether the configuration applies to the entire network or individually per site.
  • Dedicated forms in both the network dashboard and each site to edit, test, and share credentials securely.

Installation

  1. Upload the plugin folder to wp-content/plugins/.
  2. Activate SMTP (by ROBOTSTXT) from the Plugins menu in the WordPress dashboard.
  3. Open Settings → SMTP (or Network Settings → SMTP in multisite) to enter your connection details.

Frequently Asked Questions

Do I need credentials to send email?

Enter a username and password only if your provider requires them. If the server accepts unauthenticated delivery, leave the fields blank and the plugin will send without credentials.

Which encryption should I use?

Select None, SSL, or TLS according to your provider's documentation. When you switch encryption, the plugin will automatically suggest the recommended port if you are using one of the standard values.

How can I review the emails that were sent?

Enable logging on the settings page and visit Settings → SMTP → Logs to open the paginated table of saved emails. From there you can inspect each entry, download attachments, and delete records.

Does it work on a multisite network?

Yes. From the network dashboard you can decide whether the configuration is global or site-specific. You can also run the tools and send test emails from the network or from each individual site.

Compatibility

  • WordPress: 5.9 - 7.1
  • PHP: 8.0 - 8.5

Changelog

2.2.5

Release date: 2026-08-24

Changed

  • Release package cleaned: CHANGELOG.md and .gitignore are no longer included in the distributed ZIP file. No functional changes.

Compatibility

  • WordPress: 5.9 - 7.1
  • PHP: 8.0 - 8.5

2.2.4

Release date: 2026-08-17

Added

  • Dismissible notice on the Plugins pages when the Manager (by ROBOTSTXT) plugin is not installed and active. The Manager plugin is required to receive updates for this plugin.
  • Warning on the plugin settings pages (not dismissible) when the Manager plugin is not active.

Changed

Compatibility

  • WordPress: 5.9 - 7.1
  • PHP: 8.0 - 8.5

2.2.3

Release date: 2026-06-09

Fixed

  • Fixed the DKIM "Try selector" form submitting to a non-existent page in Network Admin. The form was building the page slug as robotstxt-smtp-network-tools instead of the correct robotstxt-smtp-tools (which is shared between site and network contexts).

Compatibility

  • WordPress: 5.9 - 7.1
  • PHP: 8.0 - 8.5

Previous versions

For the full changelog visit the plugin page.

Compliance

This plugin adheres to the following security measures and review protocols for each version:

Releases

10 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
2.2.5 latest
Aug 24, 2026 2mo ago
robotstxt-smtp-2.2.5.zip
80
Aug 17, 2026 2mo ago
robotstxt-smtp-2.2.4.zip
25
Jun 9, 2026 4mo ago
robotstxt-smtp-2.2.3.zip
73
Jun 9, 2026 4mo ago
robotstxt-smtp-2.2.2.zip
26
Jun 9, 2026 4mo ago
robotstxt-smtp-2.2.1.zip
24
Jun 9, 2026 4mo ago
robotstxt-smtp-2.2.0.zip
27
Feb 9, 2026 8mo ago
robotstxt-smtp-2.1.0.zip
165
Feb 7, 2026 8mo ago
robotstxt-smtp-2.0.1.zip
40
Jan 29, 2026 8mo ago
robotstxt-smtp-2.0.0.zip
44
Nov 26, 2025 11mo ago
robotstxt-smtp-1.2.0.zip
49

Active-site estimate ≈30 comes from the median of recent superseded releases. Method.

C- grade

Security

SMTP (by ROBOTSTXT) 2.2.5 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.2.5
Findings
1
Worst severity
high
Content hash
969b5e3832d522ac18c23d2b…

Findings

  • high SMTP email logs CPT uses post capabilities, exposing password-reset mail to Editors via XML-RPC

    missing_capability

    When logging is enabled, handle_wp_mail_succeeded/handle_wp_mail_failed insert each outbound message as a published robotstxt_smtp_log post (full body in post_content; recipients/headers/attachments in post meta). The CPT is correctly hidden from the front end and from edit.php/post.php (public/show_ui/publicly_queryable all false), and the plugin's own Logs screen requires manage_options. However register_post_type() sets capability_type to 'post' with map_meta_cap, so cap->edit_posts is the primitive 'edit_posts'. WordPress XML-RPC wp.getPosts only checks that cap (it does not honor show_ui). An Editor therefore lists every log, including mail sent while logged-out (lost-password, guest checkout) whose post_author is 0 and thus requires only edit_others_posts. Those bodies include retrieve_password URLs, so the Editor can take over Administrator or any other user after triggering wp-login.php?action=lostpassword. wp.editPost/wp.deletePost are similarly allowed, so logs can be tampered with or wiped. Fix by mapping all CPT capabilities to manage_options (or a dedicated cap) instead of 'post'.

    includes/class-plugin.php:214-233

    Recommendation

    Do not reuse capability_type 'post' for mail logs. Register the CPT with capabilities mapped to manage_options (edit_post, read_post, delete_post, edit_posts, edit_others_posts, publish_posts, read_private_posts, create_posts, delete_posts, delete_others_posts). Keep show_in_rest false. Prefer a custom table if logs should never appear in generic post queries or XML-RPC.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.