TS SMTP

A free, open-source WordPress email plugin. Version 1.0.0 is implemented and packaged for installation. Every included feature is free; there is no paid edition, licensing service, advertising or telemetry.

Install

Upload dist/ts-smtp-1.0.0.zip through Plugins → Add New → Upload Plugin, activate it, and open Settings → TS SMTP. Configure a connection, save, and send a test to an address you control.

Provider setup: docs/PROVIDER-SETUP.md.

Disable other mail-routing plugins before enabling this connection. Google and Microsoft require your own OAuth application and mailbox consent. Provider fees, quotas, verification and organization policies still apply.

Included features

• Custom SMTP with TLS, certificate verification and sender controls.
• Gmail / Google Workspace OAuth, Microsoft 365 / Outlook OAuth and SendGrid SMTP.
• Named primary and backup SMTP connections.
• Up to two additional synchronous attempts per connection for eligible failures before message submission.
• Administrator test emails and delivery-attempt diagnostics.
• Optional searchable, paginated metadata history with status filters, CSV export and summaries.
• Retention from 1–365 days, with a 30-day default.
• Optional encrypted retention and manual resending of simple text/HTML messages up to 256 KB.
• WordPress privacy export/erasure, local mailbox disconnect and uninstall cleanup.

Security and privacy

Logging and body storage default off. Credentials and retained bodies use authenticated AES-256-GCM encryption with a site-specific key outside the database. Encryption failure never falls back to plaintext. Saved secrets are not rendered into settings HTML; blank fields preserve them and explicit actions remove them.

OAuth uses PKCE, expiring state tied to the initiating user/session, and single-use claims. Token updates merge only provider fields and reject stale responses after a disconnect or app change. State-changing administrator actions require capability and nonce checks; OAuth callbacks use their bound state.

Metadata history includes all recipients, subjects, timestamps, transport, status and redacted errors. Enabling body retention also stores encrypted replay headers and message content. Turning body retention off deletes previously retained bodies. Daily cleanup requires working WordPress cron; expired records are excluded from viewing, export and resend immediately. Privacy erasure includes expired records still awaiting cleanup.

Deliberate limits

• Server acceptance does not prove inbox delivery.
• Uncertain submissions, permanent failures and recipient rejection never retry or switch to backup automatically.
• Retries happen during the original send; there is no background queue.
• Attachments, embedded images, multipart messages and oversized bodies are delivered normally but are not retained for replay.
• Resending can create duplicates. Review provider records before resending an uncertain message.
• Multisite must be activated/configured individually per site. Network activation is blocked; network provisioning is not included.
• Keys must remain stable. Salt/key rotation requires credential re-entry and mailbox reconnection; old encrypted messages need the original key to be readable.
• Deactivation preserves data and removes cron. Uninstall deletes plugin settings, history and credentials; hosting backups follow separate policies.

Requirements and verification

WordPress 6.6+, PHP 8.2+, and OpenSSL with AES-256-GCM support.

The release was tested in isolated WordPress installations with a local SMTP capture server. See docs/VERIFICATION.md for exact environments, commands and outstanding provider-account checks. The original source installation and database were not modified.

Development

bash scripts/setup-tests.sh

That creates a disposable SQLite-backed WordPress installation under .runtime/wordpress, downloads WP-CLI from its official project, and installs the built ZIP. Test credentials are intentionally local fixtures; never use this configuration for a public deployment.

In a separate terminal:

python3 tests/smtp-server.py

Then:

php scripts/lint.php
php tests/run.php
php .tools/wp-cli.phar eval-file tests/integration.php --path=.runtime/wordpress
php scripts/package.php

Install official Plugin Check in that disposable site to run directory and coding checks:

php .tools/wp-cli.phar plugin install plugin-check --activate --path=.runtime/wordpress
php .tools/wp-cli.phar plugin check ts-smtp --path=.runtime/wordpress
php .tools/wp-cli.phar plugin check ts-smtp --path=.runtime/wordpress --require=.runtime/wordpress/wp-content/plugins/plugin-check/cli.php
php .runtime/wordpress/wp-content/plugins/plugin-check/vendor/bin/phpcs --standard=phpcs.xml.dist

The package uses an explicit file allowlist. It excludes test sites, development tools, tests, screenshots, credentials and unrelated source files.

License and submission

GPL-2.0-or-later. Original portions retain their author attribution. Older WordPress versions use a bundled upstream PHPMailer OAuth interface under LGPL-2.1-or-later; the mailer itself comes from WordPress. See CREDITS.txt and the included licenses.

The WordPress directory listing is readme.txt. docs/WORDPRESS-ORG.md tracks the remaining submission steps: actual contributor identity, live provider account tests and directory review. This plugin has not been submitted or approved by WordPress.org.