Codo Mailer

Yes. Codo Mailer connects your site to a provider; it doesn't send email itself. Amazon SES, Postmark, Mailgun, Brevo and SendGrid all have free or low-cost tiers, or you can use your existing mailbox's SMTP server.

Yes. Anything that sends through wp_mail() goes through Codo Mailer.

Some plugins change outgoing email by hooking WordPress's phpmailer_init action, which hands them the PHPMailer object just before sending: to add a DKIM signature, Bcc archive copies, embedded images or extra headers. Codo Mailer fires it for SMTP, Amazon SES and Mailgun, which send a full MIME message built with PHPMailer. Postmark, Brevo and SendGrid take the email as JSON through their APIs, so there is no PHPMailer object and phpmailer_init does not run for them; those plugins' changes are skipped. The settings screen points this out when you pick one of these providers, and warns if a plugin on your site uses the hook. What to do instead:

• DKIM: these providers sign email themselves once you verify your domain with them, so a DKIM plugin isn't needed.
• Bcc copies, extra headers and other changes: developers can use the codo_mailer_message filter (see "For developers"), which runs for every provider.
• Otherwise, choose SMTP, Amazon SES or Mailgun, where phpmailer_init keeps working.

The reset link was redacted before logging, so the logged copy no longer contains it. Ask the user to request a new reset, which is also safer.

The failure is logged with each provider's error, WordPress's wp_mail_failed action fires, and an alert goes to your alert email and/or webhook.

No. It talks only to the email provider (and alert webhook) you configure.

Yes. Codo Mailer adds an exporter and an eraser to Tools > Export Personal Data and Tools > Erase Personal Data. Both find log entries where the person's address is a To, Cc, Bcc or Reply-To address (exact matches only, ignoring case).

• Export includes the date, status, sender, subject, message and attachment names of each email, and how the person's address appeared on it. Other recipients' addresses are left out. Password-reset links, one-time codes and passwords are redacted from the export even if redaction was turned off when the email was logged.
• Erasure deletes each email that was sent only to that person. An email that was also sent to other people is kept, because it is part of their record too: the person's address is removed from it, and the erasure report says how many such emails were kept. Its subject and body are not changed. If they mention the person, you can empty the whole log with "Delete all log entries" on the Email log tab.

For the number of days set in "Keep logs for (days)", 30 by default. Old entries are deleted by a daily WP-Cron task, which WordPress runs when the site gets visits. If your site sets DISABLE_WP_CRON, make sure a system cron job calls wp-cron.php (or runs wp cron event run --due-now), otherwise entries are kept until it does. You can also empty the log at any time with "Delete all log entries" on the Email log tab.

Yes. Each site has its own settings and log, managed by super admins only. Constants in wp-config.php apply to every site in the network.

Yes. Temporary credentials come with a session token, which Codo Mailer sends as X-Amz-Security-Token and includes in the request signature. You can supply them in three ways:

• Leave the access key ID blank on the settings screen (and don't define it in wp-config.php). Codo Mailer then reads the standard AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_SESSION_TOKEN environment variables, as set on AWS Lambda and by many container platforms.
• Define CODO_MAILER_PRIMARY_SESSION_TOKEN (or CODO_MAILER_BACKUP_SESSION_TOKEN) in wp-config.php alongside the access key and secret, for example from values your deployment refreshes.
• Enter the session token on the settings screen. Temporary credentials expire, typically within hours, so this is only practical for testing. Saving a different access key ID removes a saved session token, and the "Remove" box next to it clears it.

Over SMTP, Amazon SES and Mailgun, yes. Postmark, Brevo and SendGrid require at least one To address and will report an error.

Each provider call times out after 15 seconds. Failure alerts are sent at the end of the request, after the page has been delivered where the server supports it, so visitors don't wait for them.

With Encryption set to None and Authenticate on, your SMTP username and password are sent to the server in plain text, where anyone on the network path can read them. Codo Mailer also turns off automatic STARTTLS in this mode, so this happens even if the server supports encryption. Choose TLS or SSL unless the server is a trusted relay on your own network. Connections to localhost are not warned about. Hosts can refuse plaintext logins outright with the codo_mailer_smtp_allow_plaintext_auth filter.

Saved API keys and passwords are encrypted with a key derived from WordPress's AUTH_KEY, AUTH_SALT, SECURE_AUTH_KEY and SECURE_AUTH_SALT. If any of those is missing from wp-config.php, or still says "put your unique phrase here", WordPress stores it in the database, and a database backup alone is then enough to decrypt your secrets. The settings screen warns you when this is the case. To fix it, add a dedicated key of at least 32 random bytes to wp-config.php. Generate one with php -r 'echo base64_encode( random_bytes( 32 ) ), PHP_EOL;' (or wp eval 'echo base64_encode( random_bytes( 32 ) );') and add: define( 'CODO_MAILER_ENCRYPTION_KEY', 'paste-the-value-here' ); Use a random value, not a memorable passphrase: the key is hashed without key stretching, so a short phrase is a weak key. Keys shorter than 32 characters are warned about. Setting or changing the key makes existing saved secrets unreadable. To rotate it: set the new key, then re-enter each API key and password on the settings screen (secrets defined as constants in wp-config.php are unaffected). Keep the key out of version control and out of database backups, which is the point of keeping it in wp-config.php.

Yes, with the codo_mailer_capability filter, for example add_filter( 'codo_mailer_capability', fn() => 'edit_pages' );. The default is manage_options, or manage_network_options on multisite. Only give it to people you would trust with every account on the site. Anyone who can manage Codo Mailer can change the connection, so they can route all of the site's email, including password resets, through a server they control. Even with the capability lowered, two things stay with administrators: reading message bodies in the email log, and turning Redact secrets off. Bodies can contain working password-reset links, and redaction is what keeps them out of the log. Other users see the log's recipients, subjects and errors, and can still resend emails.