Lean SMTP makes WordPress send its mail through a real mail service instead of the host's default PHP mail, which improves deliverability. It is deliberately small: a handful of transports, a handful of settings, no upsells.<\/p>\n\n
Website: https:\/\/leansmtp.com<\/p>\n\n
Every provider below also offers plain SMTP, so the SMTP transport alone covers all of them. The API transports exist for hosts that block outbound mail ports (25\/465\/587), which is common on shared hosting and some managed platforms.<\/p>\n\n
wp lean-smtp test<\/code> and wp lean-smtp status<\/code>.<\/li>\n- Test email<\/strong> \u2014 a button on the settings page to confirm your configuration works.<\/li>\n
- Send log<\/strong> \u2014 optional; records the most recent sends (recipient, subject, result) with a viewer and a clear button. The message headers, attachment filenames and body can each be recorded too, behind their own settings and off by default.<\/li>\n
- Encrypted secrets<\/strong> \u2014 stored passwords and API keys are AES-256 encrypted, keyed to your site salts.<\/li>\n<\/ul>\n\n
Deliberately not included: Gmail and Microsoft 365 OAuth. Both need an OAuth consent flow, refresh-token storage, and (for Google) app verification \u2014 more machinery than the rest of this plugin combined. Use an app password or a provider above.<\/p>\n\n
Configuring in wp-config.php<\/h3>\n\n
Any setting can be defined as a constant instead of saved in the database. The constant name is the option name in upper case, and it always wins \u2014 the settings page shows the field as read-only and names the constant, so what you see is always what is in force. Removing the constant restores whatever was saved before.<\/p>\n\n
define( 'LEAN_SMTP_MAILER', 'ses' );\ndefine( 'LEAN_SMTP_FROM_EMAIL', 'noreply@example.com' );\ndefine( 'LEAN_SMTP_SES_REGION', 'us-east-1' );\ndefine( 'LEAN_SMTP_SES_ACCESS_KEY', 'AKIA\u2026' );\ndefine( 'LEAN_SMTP_SES_SECRET_KEY', getenv( 'SES_SECRET_KEY' ) );\n<\/code><\/pre>\n\nSecrets defined this way are used as-is and are never written to the database. Run wp lean-smtp status<\/code> to see every setting and where it came from.<\/p>\n\nExternal services<\/h3>\n\n
Lean SMTP sends email through whichever mail service you configure. When \u2014 and only when \u2014 you select an API transport and your site sends mail, the plugin connects to that provider's HTTPS API and transmits the message being sent (recipients, subject, body, headers, and any attachments) along with the credentials you entered, so the provider can authenticate the request and deliver the message. Nothing is sent until you configure and select a transport, and the plugin contacts no other services: there is no telemetry, tracking, or analytics.<\/p>\n\n
The provider you choose is the data controller for the mail you route through it. Review its terms and privacy policy:<\/p>\n\n
\n- Amazon SES \u2014 sends to
email.{region}.amazonaws.com<\/code>. Terms: https:\/\/aws.amazon.com\/service-terms\/ \u00b7 Privacy: https:\/\/aws.amazon.com\/privacy\/<\/li>\n- Mailgun \u2014 sends to
api.mailgun.net<\/code> or api.eu.mailgun.net<\/code>. Terms: https:\/\/www.mailgun.com\/legal\/terms\/ \u00b7 Privacy: https:\/\/www.mailgun.com\/legal\/privacy-policy\/<\/li>\n- Resend \u2014 sends to
api.resend.com<\/code>. Terms: https:\/\/resend.com\/legal\/terms-of-service \u00b7 Privacy: https:\/\/resend.com\/legal\/privacy-policy<\/li>\n<\/ul>\n\nThe SMTP transport connects only to the host you configure and bundles no third-party service. The Offline mailer connects to nothing at all: messages are written to the local send log and never leave your server.<\/p>\n\n\n
\n- Upload the plugin and activate it.<\/li>\n
- Go to Settings \u2192 Lean SMTP.<\/li>\n
- Choose a mailer and fill in the connection details.<\/li>\n
- Set your From Email and From Name.<\/li>\n
- Save, then use \"Send a Test Email\" to confirm it works.<\/li>\n<\/ol>\n\n
For Amazon SES: create an IAM user limited to ses:SendRawEmail<\/code>\/ses:SendEmail<\/code>, verify your From address (or domain) in the SES console, and, if your account is still in the SES sandbox, verify the recipient too.<\/p>\n\nFor Mailgun: use the sending domain exactly as it appears in your Mailgun dashboard, and pick the region matching the account the key was issued in \u2014 a US key is not valid against the EU stack.<\/p>\n\n
For Resend: create an API key with send permission and verify your From domain.<\/p>\n\n\n
0.3.1<\/h4>\n\n\n- Stored passwords and API keys are no longer passed through sanitize_text_field(), which strips characters that are perfectly legal in a credential (angle brackets, percent-encoded sequences) and could leave a saved secret that no longer authenticates. Only control characters are removed now. If your password or API key contains such characters, re-enter it.<\/li>\n<\/ul>\n\n
0.3.0<\/h4>\n\n\n- Added an Offline mailer: every message is recorded and nothing is sent, for staging sites that must not mail real customers. wp_mail() still reports success, so other plugins behave as they would in production.<\/li>\n
- The send log can now record the message headers, attachment filenames and body. Each is a separate setting and both are off by default \u2014 a stored body contains password-reset links and anything else your site mails. Recorded content is shown in an expandable row in the log viewer, alongside the full error text for a failed send.<\/li>\n
- Added a Reply-To setting, applied to both the SMTP and API paths. A Reply-To the message set for itself is always kept.<\/li>\n
- The log table is now upgraded in place when the plugin is updated. Previously the table was only ever created on activation, which does not run on update.<\/li>\n<\/ul>\n\n
0.2.1<\/h4>\n\n\n- The settings screen's CSS and JavaScript are now enqueued as files on that screen only, instead of being printed inline.<\/li>\n
- Each setting is now registered with its own named sanitize callback, with the wp-config.php constant guard applied as a separate filter on top.<\/li>\n<\/ul>\n\n
0.2.0<\/h4>\n\n\n- Added a Mailgun transport (US and EU regions), sending the assembled message as MIME.<\/li>\n
- Added a Resend transport.<\/li>\n
- Bcc recipients on API sends are now carried as an explicit envelope and the Bcc header is stripped from the delivered message, so hidden recipients are never disclosed to other recipients.<\/li>\n
- Any setting can now be pinned in wp-config.php as an upper-case constant; a pinned setting renders read-only on the settings page and is left untouched when the form is saved.<\/li>\n
- Added an admin notice when a send fails, so a silently broken mailer is noticed. It clears itself after the next successful send.<\/li>\n
- Added WP-CLI commands:
wp lean-smtp test [<recipient>]<\/code> and wp lean-smtp status<\/code>.<\/li>\n- The API transports now share one message assembly behind a Lean_SMTP_Api_Transport interface, so all of them reproduce core's wp_mail() semantics identically.<\/li>\n<\/ul>\n\n
0.1.1<\/h4>\n\n\n- Fixed Amazon SES sends failing with an HTTP 403 \"signature does not match\" error caused by the secret key being encrypted twice on its first save (WordPress runs a setting's sanitize callback twice when the option is first created). Re-enter your SES secret key (and SMTP password) after updating.<\/li>\n
- SES requests now sign only the required host and date headers, avoiding signature mismatches when the HTTP transport rewrites the Content-Type header.<\/li>\n
- Fixed failed SES sends being written to the send log twice; every send is now recorded exactly once.<\/li>\n<\/ul>\n\n
0.1.0<\/h4>\n\n\n- Initial release. SMTP and Amazon SES (API) transports for wp_mail(), From name\/email with optional forcing, a test-email button, optional send logging, and AES-256 at-rest encryption of stored credentials.<\/li>\n<\/ul>","raw_excerpt":"Route wp_mail() through SMTP or the Amazon SES, Mailgun, or Resend API \u2014 with From control, wp-config overrides, and mail-failure alerts.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/345583","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=345583"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/pjaudiomv"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=345583"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=345583"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=345583"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=345583"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=345583"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=345583"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}