Gmcfuerte SMTP Transport

WordPress sends password resets, order confirmations and form notifications with
whatever the server hands it. On most hosting that means unauthenticated mail
from an address the domain never authorised, which spam filters quietly discard.

Gmcfuerte SMTP Transport points the standard wp_mail() pipeline at an SMTP
account you control, so messages leave authenticated and signed by the provider
you already pay for.

It is deliberately small: one settings screen, one test button, no dashboard
widgets, no onboarding wizard.

What makes this one different

Most SMTP plugins stop at configuring PHPMailer. This one also protects the
failure path: if a migration, salt rotation or removed environment secret makes
the saved credential unusable, it stops rewriting the From address instead of
letting fallback mail impersonate the SMTP domain and fail SPF or DKIM. Its test
send reports the mail server’s real refusal and whether SMTP was actually used;
the password is write-only and may stay entirely outside the database. There is
no telemetry, provider account or remote dashboard.

What it does

• Routes wp_mail() through your SMTP host, with STARTTLS, SSL/TLS, or no
  encryption when a local relay needs it (and “none” really means none: the
  automatic STARTTLS upgrade is switched off, instead of silently overriding
  the choice you made).
• Rewrites the From address and From name to match the authenticated account
  — and only while that account is really carrying the message. If SMTP stops
  working, the rewrite stops with it, because a rewritten From on mail sent by
  something else is what makes SPF and DKIM fail.
• Stores the SMTP password encrypted (AES-256-GCM) with a key derived from your
  own site salts, so the value is useless in a database copied elsewhere. The
  field is write-only: it never renders the stored password back to the browser.
• Accepts a GMCFUERTE_SMTP_PASSWORD constant in wp-config.php instead, for
  sites that keep credentials out of the database entirely. When it is defined,
  the settings field says so and is ignored.
• Sends a test email and tells you what really happened, including the reason
  the mail server gave when it refused. If the message went out through the
  server default transport rather than your SMTP account, it says that too,
  instead of reporting a pass.
• Refuses a half-finished configuration rather than saving one that silently
  falls back to unauthenticated mail.
• Refuses SMTP hosts that are IP literals, loopback names or internal-only
  suffixes, so the mailer cannot be aimed at an internal service.
• Caps admin-triggered test sends at five per minute per user.

External services

None. This plugin contacts no service of its own: not on activation, not on a
schedule, not ever. The only outbound connection it makes is to the SMTP host
you type into the settings screen, when WordPress sends a message.

Separate GMC catalogue edition

GMC SMTP Mailer, available free from fuerteventuratv.net, includes a mail log (per-recipient delivery
outcome, the real SMTP error, retention, resend, CSV export, a persistent
failure alert), the matching GDPR export/erase handlers and an admin REST API.
It has its own slug and GMC-hosted update channel. This plugin is complete without it, and nothing
here is disabled or time-limited.