SMTP Plugins Add App Passwords That Do Not Live in wp-config
A round of mail plugins is storing credentials in a secrets API instead of a define() that gets committed to git. About time.
by Riley Cho·May 2, 2026·0 Comments
SMTP plugins have spent years teaching people to put passwords in wp-config. That file is in too many backups and too many tickets.
The newer ones use an app password stored through a proper secrets flow, with rotation that does not require a deploy.
If your mail plugin still asks you to paste a Gmail password, it is not a mail plugin. It is an incident waiting for a repo leak.
