ROBOTSTXT Software

SMTP (by ROBOTSTXT)

Send every site email through a fully configurable SMTP server managed from the WordPress dashboard.

Information

Author:

ROBOTSTXT

Download

Price:

€0.00

Requirements

Version:

2.2.3

WordPress:

5.9

–

7.1

PHP >=

8.0

Changelog

2.2.3

Release date: 2026-06-09

Fixed

  • Fixed the DKIM “Try selector” form not working in Network Admin. The hidden page input was set to robotstxt-smtp-network-tools (non-existent) instead of the correct robotstxt-smtp-tools, which is the same slug used in both site and network contexts.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.x, wp-coding-standards/wpcs 3.x
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.x (PHP 8.0-8.5)
  • WP Compatibility: johnbillion/wp-compat (WP 5.9+)

2.2.2

Release date: 2026-06-09

Fixed

  • Fixed From Email and Reply-To Email fields not clearing when submitted empty. sanitize_options() now explicitly saves '' when the field is blank, instead of silently retaining the previous value.
  • Fixed “Clear password” button having no effect. The registered sanitize_option callback was re-applying the old encrypted password when the submitted value was empty. Fixed by temporarily removing the filter before the direct update_option() call.
  • Fixed “Clear password” button submitting to options.php instead of the intended handler. A nested ` inside the settings form is invalid HTML; replaced with a wp_nonce_url()` link (GET request).
  • Fixed DKIM selector form (“Try selector” button) doing nothing. The form was inside the cached tool HTML rendered via wp_kses_post(), which strips all form elements. Moved the form to render_tools_page() where it is output as direct PHP, never passing through kses.
  • Fixed Spamhaus ZEN reporting a false “Listed” result. Response code 127.255.255.254 means the DNS query arrived via a public resolver (Cloudflare, Google DNS, etc.) — not that the IP is blocked. Spamhaus stopped supporting public-resolver queries in 2022. The plugin now detects this code (and 127.255.255.255 for rate-limit exceeded) and shows an informational error pointing to the Spamhaus web lookup tool instead.

Added

  • DKIM selector auto-detection from MX records. When running the SPF/DKIM/DMARC tool, the plugin detects the email provider from MX host patterns and tries the provider’s known selectors in order before falling back to default. Supported providers: Google Workspace, Microsoft 365, Zoho, ProtonMail, Apple iCloud, Aruba, Mailchimp.
  • “Try a specific selector” input in the Tools → Authentication panel. Allows overriding the auto-detected selector without JavaScript; the selector is preserved in the “Run checks again” URL.
  • Password field placeholder is now context-aware: shows “No password set.” when no password is stored, and “Leave empty to keep the current password.” when one exists.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.x, wp-coding-standards/wpcs 3.x
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.x (PHP 8.0-8.5)
  • WP Compatibility: johnbillion/wp-compat (WP 5.9+)

2.2.1

Release date: 2026-06-09

Fixed

  • Fixed the statistics chart not rendering. Chart.js was enqueued in the footer but the initialization script ran before it loaded. The init code now uses wp_add_inline_script() so WordPress guarantees the correct execution order.
  • Chart.js is now bundled locally in assets/js/chart.umd.min.js. No external CDN requests are made by the plugin.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.x, wp-coding-standards/wpcs 3.x
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.x (PHP 8.0-8.5)
  • WP Compatibility: johnbillion/wp-compat (WP 5.9+)

2.2.0

Release date: 2026-06-09

Highlights

  • Security release fixing silent password corruption on save and credentials being stored in temporary transients.
  • WordPress minimum compatibility lowered to 5.9, PHP minimum to 8.0.
  • DMARC diagnostics now implement RFC 7489 §6.6.3 organizational domain fallback.

Fixed

  • Fixed passwords with special characters (`, newlines) being silently corrupted by sanitize_text_field()` on save in both per-site and network settings handlers.
  • Fixed SMTP credentials (password, Amazon SES keys) being masked with the literal string • instead of the bullet character • in the test email panel.
  • Fixed decrypted credentials being stored in a 10-minute transient after a test email send.
  • Fixed rate-limit enforcement: pre_wp_mail now returns false to short-circuit wp_mail() immediately instead of relying on a PHPMailer exception downstream.
  • Fixed DKIM and DMARC DNS lookups not using the timeout-protected safe_dns_lookup() wrapper, which could cause long admin page load times when DNS was unreachable.
  • Fixed rate-limit transients not being removed on plugin uninstall.

Security

  • Removed sanitize_text_field() from password and credential fields — it strips valid characters and would silently corrupt credentials before encryption.
  • Removed map_deep( ..., 'sanitize_text_field' ) pre-sanitization from the network settings handler for the same reason.
  • Amazon SES access key and secret key are now also masked in the test email settings display.

Added

  • DMARC diagnostics tool now implements RFC 7489 §6.6.3 organizational domain fallback. For a From address of info@sub.example.com, the tool queries _dmarc.sub.example.com first and falls back to _dmarc.example.com if no record is found, displaying which level applies.
  • Added get_organizational_domain() helper using a two-label heuristic.

Compatibility

  • WordPress: 5.9 – 7.1
  • PHP: 8.0 – 8.5

Tests

  • PHP Coding Standards: squizlabs/php_codesniffer 3.x, wp-coding-standards/wpcs 3.x
  • WordPress Coding Standards: WordPress-Core, WordPress-Docs, WordPress-Extra
  • PHPStan: level 9, szepeviktor/phpstan-wordpress 2.x
  • PHPCompatibility: phpcompatibility/php-compatibility 10.x (PHP 8.0-8.5)
  • WP Compatibility: johnbillion/wp-compat (WP 5.9+)

2.1.0

Release date: 2026-02-09

Highlights

  • Data preservation on uninstall: plugin data is now kept by default and only deleted when the administrator explicitly enables the option.

Added

  • Added data management option to control whether plugin data is deleted on uninstall (disabled by default for data preservation).
  • Added reset plugin data functionality with site-level and network-level support.
  • Added unified uninstall cleanup system that handles all add-on data (Amazon SES, Newsletter).
  • Added automatic password clearing when both host and username fields are empty to prevent orphaned encrypted credentials.

Changed

  • Uninstall behavior now respects user preference: data is preserved by default unless explicitly enabled.
  • Add-on plugins (Amazon SES, Newsletter) no longer perform their own cleanup on uninstall — all cleanup is centralized in the core plugin.

Compatibility

  • WordPress: 6.5 – 6.9
  • PHP: 8.2 – 8.4

2.0.1

Release date: 2026-01-30

Fixed

  • Fixed automatic password clearing when both host and username fields are empty to prevent orphaned credentials.

Compatibility

  • WordPress: 6.5 – 6.9
  • PHP: 8.2 – 8.4

###= 2.0.0

Release date: 2026-01-29

Highlights

  • Full security audit and hardening. Reply-To configuration. Email statistics with charts. Rate limiting.

Added

  • Reply-To email and name configuration fields for custom reply addresses.
  • Email statistics tracking system with daily counters and visual charts.
  • Statistics page with Chart.js visualization and multisite support.
  • Statistics retention settings (configurable from 1 to 365 days).
  • Rate limiting by emails per second, hour, and day.

Security

  • Comprehensive security audit and hardening.
  • Enhanced nonce validation across all forms and actions.
  • Improved input sanitization and validation throughout.
  • Enhanced password encryption and plaintext migration system.
  • Secure handling of superglobals and transients.
  • Strengthened regex patterns and port number validation.

Fixed

  • Access control and form handling improvements.
  • WordPress Multisite rate limiting enhancements.
  • Empty password field handling.

Compatibility

  • WordPress: 6.5 – 6.9
  • PHP: 8.2 – 8.4

1.1.0

Added

  • Amazon SES credential fields, regional selection, and live validation helpers.
  • robotstxt_smtp_sanitized_options filter so add-ons can adjust sanitized settings before storage.
  • Routing of SMTP test messages and regular emails through Amazon SES when the add-on is active.

Compatibility

  • WordPress: 6.5 – 6.7
  • PHP: 8.2 – 8.4

1.0.0

Added

  • Contextual help guidance in every SMTP configuration field.
  • Automatic port updates when selecting an encryption method with standard values.
  • Advanced tools: MX analysis, SPF/DKIM/DMARC validation, extended SMTP diagnostics, and blacklist monitoring.
  • Enhanced logging with automatic cleanup by limit or age.

Compatibility

  • WordPress: 6.7 – 6.7
  • PHP: 8.2 – 8.4