=== Onlinefotka SMTP Mail ===
Contributors: onlinefotka
Donate link: https://www.paypal.com/donate?business=info%40onlinefotka.sk&currency_code=EUR
Tags: smtp, email, gmail, outlook, email log
Requires at least: 6.5
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

SMTP, Gmail, Microsoft 365 and Zoho (OAuth) sending with backup connection, smart routing, email log, tracking, reports, alerts and queue.

== Description ==

**Onlinefotka SMTP Mail** sends every WordPress and WooCommerce email through your own SMTP server instead of the unreliable PHP `mail()` function – so order confirmations, invoices and password resets reach the inbox, not the spam folder.

Everything is included for free – no "Pro" version, no license key.

=== Sending ===

* **Any SMTP server** – your hosting mailbox, Gmail / Google Workspace, Microsoft 365, Zoho, Seznam, Brevo, Mailgun, SendGrid, Postmark, Amazon SES, SMTP2GO…
* **OAuth 2.0 login (no password stored)** – **Google / Gmail / Workspace** (Gmail API), **Microsoft 365 / Outlook.com** (Microsoft Graph – no SMTP AUTH needed) and **Zoho Mail** (Zoho Mail API). You use your own app (client ID + secret), step-by-step setup guide included, tokens are stored encrypted and refreshed automatically
* **Presets** fill in host, port and encryption with one click
* **Multiple connections** (up to 10)
* **Backup connection** – when the primary server fails (outage, wrong password, limit reached) the email is immediately sent through the backup connection
* **Smart routing** – rules send selected emails through another connection, e.g. by subject, recipient, From address, custom header or the plugin that sent the email
* **From email and name** – optionally forced for every email, Return-Path set automatically
* **Background sending** – emails are queued and sent every minute with a limit per minute (respects hosting limits, faster checkout)
* **"Do not send" mode** for staging copies – emails are only logged

=== Email log ===

* Every email with status (sent / failed / blocked), recipient, subject, connection, error message and **the plugin that sent it**
* Safe preview of the HTML content, headers and attachments
* **Resend** to the original recipients or to another address, bulk resend
* Optional **copies of attachments** in a protected folder
* Filters (status, source, connection, date), search, **CSV export**
* Automatic cleanup after a chosen number of days

=== Tracking & reports ===

* **Open and click tracking** for HTML emails (signed redirect links – no open redirect)
* **Reports** – daily chart, totals, open and click rate, statistics by plugin and by connection
* **Weekly summary email**
* Dashboard widget

=== Alerts ===

Get notified when an email cannot be sent: **email, Slack, Discord, Telegram or a custom webhook** (JSON). Alerts are throttled and sent in the background.

=== Email controls ===

Turn off WordPress system emails you do not need – comment notifications, new user emails, password / email change notifications, automatic update emails.

=== Tools ===

* **Test email** with the complete SMTP conversation (passwords hidden) and plain-language advice for common errors
* **Connection check** – connect and log in without sending an email
* **Domain check** – MX, SPF, DKIM and DMARC records with advice
* **Import from WP Mail SMTP** including the password
* **wp-config.php constants** – ideal for agencies managing many sites, passwords never stored in the database
* **WP-CLI**: `wp ofsm test`, `wp ofsm queue`, `wp ofsm log`, `wp ofsm stats`, `wp ofsm resend`, `wp ofsm report`

=== Security ===

* Passwords are encrypted (libsodium) with a key derived from your wp-config.php salts – never stored next to the encrypted value
* Passwords are hidden in the SMTP conversation
* Capability checks and nonces on every action, all output escaped
* Email previews are rendered in a sandboxed iframe
* Stored attachments are protected from direct access and downloaded only by administrators
* CSV export is protected against formula injection

=== Privacy ===

The email log stores recipients and (optionally) the content of emails in your own database. Open and click tracking processes personal data – mention it in your privacy policy or keep it turned off. No data is sent to Onlinefotka or any third party; alerts are sent only to the channels you configure.

== External services ==

The plugin connects to third-party services only when you configure them:

* **Google Gmail API and Google OAuth** (accounts.google.com, oauth2.googleapis.com, gmail.googleapis.com) – used when a connection of the type "Google" is set up: to authorize your mailbox and to send each email (recipients, subject, content and attachments are sent to Google). [Terms](https://policies.google.com/terms), [Privacy](https://policies.google.com/privacy)
* **Microsoft identity platform and Microsoft Graph** (login.microsoftonline.com, graph.microsoft.com) – used for connections of the type "Microsoft 365 / Outlook" to authorize the mailbox and send each email. [Terms](https://www.microsoft.com/servicesagreement), [Privacy](https://privacy.microsoft.com/privacystatement)
* **Zoho Accounts and Zoho Mail API** (accounts.zoho.*, mail.zoho.*) – used for connections of the type "Zoho Mail" to authorize the mailbox and send each email (attachments are uploaded to Zoho). [Terms](https://www.zoho.com/terms.html), [Privacy](https://www.zoho.com/privacy.html)
* **Your SMTP server** – for SMTP connections the emails are delivered to the SMTP server you enter.
* **Slack, Discord, Telegram or your own webhook URL** – only if you enter them as alert channels: when an email fails, the site name, subject, recipient and error message are sent there. Slack: [Terms](https://slack.com/terms-of-service), [Privacy](https://slack.com/trust/privacy/privacy-policy); Discord: [Terms](https://discord.com/terms), [Privacy](https://discord.com/privacy); Telegram: [Terms](https://telegram.org/tos), [Privacy](https://telegram.org/privacy)

The domain check in Tools only performs DNS lookups of the domain you enter. No data is ever sent to Onlinefotka.

== Installation ==

1. Upload the `onlinefotka-smtp-mail` folder to `/wp-content/plugins/` or install the ZIP via **Plugins → Add New → Upload Plugin**
2. Activate the plugin
3. Go to **SMTP Mail → Settings → Connections** and fill in your SMTP server (or pick a preset), or choose Google / Microsoft 365 / Zoho and click **Connect**
4. Go to **SMTP Mail → Tools** and send a test email

== Frequently Asked Questions ==

= Can I use it together with another SMTP plugin? =

No – only one plugin can send emails. Import the settings (Tools → Import from WP Mail SMTP), send a test email and deactivate the other plugin.

= How does the backup connection work? =

If sending through the primary connection fails, the same email is sent right away through the backup connection. The log shows which connection was used and why the primary failed.

= Which value do I use for "Sent by plugin" in smart routing? =

The plugin folder name shown in the Source column of the email log, for example `woocommerce` or `contact-form-7`.

= How do I define the settings in wp-config.php? =

See **SMTP Mail → Tools → Settings in wp-config.php** for a ready-made example. Supported constants: `OFSM_SMTP_HOST`, `OFSM_SMTP_PORT`, `OFSM_SMTP_SECURE`, `OFSM_SMTP_AUTOTLS`, `OFSM_SMTP_AUTH`, `OFSM_SMTP_USER`, `OFSM_SMTP_PASS`, the same with `OFSM_BACKUP_SMTP_` for the backup connection, `OFSM_FROM_EMAIL`, `OFSM_FROM_NAME`, `OFSM_FROM_EMAIL_FORCE`, `OFSM_FROM_NAME_FORCE`, `OFSM_RETURN_PATH`, `OFSM_DO_NOT_SEND`, `OFSM_QUEUE`, `OFSM_ALERT_EMAIL` and `OFSM_CRYPTO_KEY`.

= I changed the security keys in wp-config.php and the password stopped working =

Passwords are encrypted with a key derived from the salts in wp-config.php. After changing them, enter the SMTP password again (the plugin shows a notice). Define `OFSM_CRYPTO_KEY` to use your own fixed key.

= Background sending does not send anything =

It relies on WP-Cron, which runs only when someone visits the site. On low-traffic sites add a real cron job on the server that calls `wp-cron.php` every minute, or run `wp ofsm queue`.

= Does it support Gmail / Microsoft 365 / Zoho login with OAuth? =

Yes. Choose the connection type Google, Microsoft 365 / Outlook or Zoho Mail, follow the setup guide shown in the connection (create your own app, copy the Client ID and secret, add the redirect URI), save and click **Connect**. Emails are then sent through the provider API – for Microsoft 365 SMTP AUTH does not have to be enabled. OAuth connections can be used as the primary connection, the backup connection or in smart routing.

= My Google connection stops working after a week =

The Google app is in "Testing" mode. Set the publishing status of the OAuth consent screen to "In production" (or use the "Internal" user type in Google Workspace) and connect again.

= Microsoft 365 stopped sending after many months =

The client secret of your Entra app expired. Create a new secret, paste it into the connection, save and click **Reconnect**.

= What happens on uninstall? =

Settings, the email log, the queue, stored attachment copies and scheduled events are deleted.

== Screenshots ==

1. Connections – SMTP with presets or OAuth login for Google, Microsoft 365 and Zoho
2. Smart routing rules
3. Email log with status, source, connection and tracking
4. Email detail with safe preview, error advice and resend
5. Reports – daily chart and statistics by plugin
6. Tools – test email with SMTP conversation and domain check

== Changelog ==

= 1.0.1 =
* OAuth login for Google (Gmail API), Microsoft 365 / Outlook (Microsoft Graph) and Zoho Mail
* Hardening: all output escaped, the tracking pixel is served from a static file
* Email controls keys renamed (settings are migrated automatically)
* Bundled translations: Slovak, Czech, Hungarian, Polish and German

= 1.0.0 =
* Initial release

== Upgrade Notice ==

= 1.0.1 =
Adds OAuth login for Google, Microsoft 365 and Zoho.

= 1.0.0 =
Initial release.
