ROBOTSTXT Software

SMTP

Send every site email through a fully configurable SMTP server managed from the WordPress dashboard.

Plugin icon

Information

Author:

ROBOTSTXT

Download

Price:

€0.00
Log in to download

A free ROBOTSTXT account is required. Log in, then install the Manager (by ROBOTSTXT) plugin on your site and connect it with your API key to install this plugin and receive updates — at no cost.

Requirements

Version:

2.2.5

WordPress:

5.9

–

7.1

PHP >=

8.0

Changelog

2.2.5

Release date: 2026-08-24

Changed

  • Release package cleaned: CHANGELOG.md and .gitignore are no longer included in the distributed ZIP file. No functional changes.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

2.2.4

Release date: 2026-08-17

Added

  • Dismissible admin notice on the site and network Plugins pages when the Manager (by ROBOTSTXT) plugin is not installed and active. The Manager plugin delivers updates for this plugin and can be downloaded from https://www.robotstxt.software/plugins/robotstxt-manager/.
  • Non-dismissible warning on the plugin settings pages (site and network) when the Manager plugin is not active.

Changed

  • Plugin updates are now delivered through the Manager (by ROBOTSTXT) plugin. The built-in Gitea updater (class-robotstxt-updater.php) and its update.json file were removed.
  • Plugin URI and Update URI now point to https://www.robotstxt.software/plugins/robotstxt-smtp/ and the developer is ROBOTSTXT (https://www.robotstxt.software/).
  • Contributor order updated: robotstxt, javiercasares.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.13.6, wp-coding-standards/wpcs 3.4.1
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, phpstan 2.2.8, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.0.0-alpha2 (PHP 5.6-8.5 scanned; real floor 8.0)
  • WP Compatibility: johnbillion/wp-compat (WP 4.0+ scanned; real floor 5.9)

2.2.3

Release date: 2026-06-09

Fixed

  • Fixed the DKIM “Try selector” form not working in Network Admin. The hidden page input was set to robotstxt-smtp-network-tools (non-existent) instead of the correct robotstxt-smtp-tools, which is the same slug used in both site and network contexts.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.x, wp-coding-standards/wpcs 3.x
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.x (PHP 8.0-8.5)
  • WP Compatibility: johnbillion/wp-compat (WP 5.9+)

2.2.2

Release date: 2026-06-09

Fixed

  • Fixed From Email and Reply-To Email fields not clearing when submitted empty. sanitize_options() now explicitly saves '' when the field is blank, instead of silently retaining the previous value.
  • Fixed “Clear password” button having no effect. The registered sanitize_option callback was re-applying the old encrypted password when the submitted value was empty. Fixed by temporarily removing the filter before the direct update_option() call.
  • Fixed “Clear password” button submitting to options.php instead of the intended handler. A nested ` inside the settings form is invalid HTML; replaced with a wp_nonce_url()` link (GET request).
  • Fixed DKIM selector form (“Try selector” button) doing nothing. The form was inside the cached tool HTML rendered via wp_kses_post(), which strips all form elements. Moved the form to render_tools_page() where it is output as direct PHP, never passing through kses.
  • Fixed Spamhaus ZEN reporting a false “Listed” result. Response code 127.255.255.254 means the DNS query arrived via a public resolver (Cloudflare, Google DNS, etc.) — not that the IP is blocked. Spamhaus stopped supporting public-resolver queries in 2022. The plugin now detects this code (and 127.255.255.255 for rate-limit exceeded) and shows an informational error pointing to the Spamhaus web lookup tool instead.

Added

  • DKIM selector auto-detection from MX records. When running the SPF/DKIM/DMARC tool, the plugin detects the email provider from MX host patterns and tries the provider’s known selectors in order before falling back to default. Supported providers: Google Workspace, Microsoft 365, Zoho, ProtonMail, Apple iCloud, Aruba, Mailchimp.
  • “Try a specific selector” input in the Tools → Authentication panel. Allows overriding the auto-detected selector without JavaScript; the selector is preserved in the “Run checks again” URL.
  • Password field placeholder is now context-aware: shows “No password set.” when no password is stored, and “Leave empty to keep the current password.” when one exists.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.x, wp-coding-standards/wpcs 3.x
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.x (PHP 8.0-8.5)
  • WP Compatibility: johnbillion/wp-compat (WP 5.9+)

2.2.1

Release date: 2026-06-09

Fixed

  • Fixed the statistics chart not rendering. Chart.js was enqueued in the footer but the initialization script ran before it loaded. The init code now uses wp_add_inline_script() so WordPress guarantees the correct execution order.
  • Chart.js is now bundled locally in assets/js/chart.umd.min.js. No external CDN requests are made by the plugin.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.x, wp-coding-standards/wpcs 3.x
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.x (PHP 8.0-8.5)
  • WP Compatibility: johnbillion/wp-compat (WP 5.9+)

2.2.0

Release date: 2026-06-09

Highlights

  • Security release fixing silent password corruption on save and credentials being stored in temporary transients.
  • WordPress minimum compatibility lowered to 5.9, PHP minimum to 8.0.
  • DMARC diagnostics now implement RFC 7489 §6.6.3 organizational domain fallback.

Fixed

  • Fixed passwords with special characters (`, newlines) being silently corrupted by sanitize_text_field()` on save in both per-site and network settings handlers.
  • Fixed SMTP credentials (password, Amazon SES keys) being masked with the literal string • instead of the bullet character • in the test email panel.
  • Fixed decrypted credentials being stored in a 10-minute transient after a test email send.
  • Fixed rate-limit enforcement: pre_wp_mail now returns false to short-circuit wp_mail() immediately instead of relying on a PHPMailer exception downstream.
  • Fixed DKIM and DMARC DNS lookups not using the timeout-protected safe_dns_lookup() wrapper, which could cause long admin page load times when DNS was unreachable.
  • Fixed rate-limit transients not being removed on plugin uninstall.

Security

  • Removed sanitize_text_field() from password and credential fields — it strips valid characters and would silently corrupt credentials before encryption.
  • Removed map_deep( ..., 'sanitize_text_field' ) pre-sanitization from the network settings handler for the same reason.
  • Amazon SES access key and secret key are now also masked in the test email settings display.

Added

  • DMARC diagnostics tool now implements RFC 7489 §6.6.3 organizational domain fallback. For a From address of info@sub.example.com, the tool queries _dmarc.sub.example.com first and falls back to _dmarc.example.com if no record is found, displaying which level applies.
  • Added get_organizational_domain() helper using a two-label heuristic.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.x, wp-coding-standards/wpcs 3.x
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.x (PHP 8.0-8.5)
  • WP Compatibility: johnbillion/wp-compat (WP 5.9+)

2.1.0

Release date: 2026-02-09

Highlights

  • Data preservation on uninstall: plugin data is now kept by default and only deleted when the administrator explicitly enables the option.

Added

  • Added data management option to control whether plugin data is deleted on uninstall (disabled by default for data preservation).
  • Added reset plugin data functionality with site-level and network-level support.
  • Added unified uninstall cleanup system that handles all add-on data (Amazon SES, Newsletter).
  • Added automatic password clearing when both host and username fields are empty to prevent orphaned encrypted credentials.

Changed

  • Uninstall behavior now respects user preference: data is preserved by default unless explicitly enabled.
  • Add-on plugins (Amazon SES, Newsletter) no longer perform their own cleanup on uninstall — all cleanup is centralized in the core plugin.

Compatibility

  • WordPress: 6.5 – 6.9
  • PHP: 8.2 – 8.4

2.0.1

Release date: 2026-01-30

Fixed

  • Fixed automatic password clearing when both host and username fields are empty to prevent orphaned credentials.

Compatibility

  • WordPress: 6.5 – 6.9
  • PHP: 8.2 – 8.4

###= 2.0.0

Release date: 2026-01-29

Highlights

  • Full security audit and hardening. Reply-To configuration. Email statistics with charts. Rate limiting.

Added

  • Reply-To email and name configuration fields for custom reply addresses.
  • Email statistics tracking system with daily counters and visual charts.
  • Statistics page with Chart.js visualization and multisite support.
  • Statistics retention settings (configurable from 1 to 365 days).
  • Rate limiting by emails per second, hour, and day.

Security

  • Comprehensive security audit and hardening.
  • Enhanced nonce validation across all forms and actions.
  • Improved input sanitization and validation throughout.
  • Enhanced password encryption and plaintext migration system.
  • Secure handling of superglobals and transients.
  • Strengthened regex patterns and port number validation.

Fixed

  • Access control and form handling improvements.
  • WordPress Multisite rate limiting enhancements.
  • Empty password field handling.

Compatibility

  • WordPress: 6.5 – 6.9
  • PHP: 8.2 – 8.4

1.1.0

Added

  • Amazon SES credential fields, regional selection, and live validation helpers.
  • robotstxt_smtp_sanitized_options filter so add-ons can adjust sanitized settings before storage.
  • Routing of SMTP test messages and regular emails through Amazon SES when the add-on is active.

Compatibility

  • WordPress: 6.5 – 6.7
  • PHP: 8.2 – 8.4

1.0.0

Added

  • Contextual help guidance in every SMTP configuration field.
  • Automatic port updates when selecting an encryption method with standard values.
  • Advanced tools: MX analysis, SPF/DKIM/DMARC validation, extended SMTP diagnostics, and blacklist monitoring.
  • Enhanced logging with automatic cleanup by limit or age.

Compatibility

  • WordPress: 6.7 – 6.7
  • PHP: 8.2 – 8.4