Gmail App Password and WordPress SMTP Setup

A Gmail app password is a 16-character code that lets WordPress send email through your Gmail account without your real Gmail password, which Google requires once you have two-factor authentication turned on. You generate it once in your Google account settings, then paste it into an SMTP plugin’s connection screen. Here is the full setup from start to finish, including a worked example and how to fix the authentication errors that trip people up.

Before you start

Gmail’s SMTP server has a sending cap of 500 emails per day on a free account and around 2,000 on Google Workspace. That is plenty for a typical small business or blog’s transactional mail, order notifications, contact form replies, and password resets, but keep it in mind if you are also using the same account for newsletters or high volume campaigns.

Step 1: Turn on two-factor authentication

Google will not let you create an app password without 2FA enabled first. Go to myaccount.google.com, open Security, and turn on 2-Step Verification if it is not already active. You will need your phone to confirm this step.

Step 2: Generate the app password

1. Still inside Google Account > Security, search for “App passwords” in the search bar at the top, or find it listed under 2-Step Verification.
2. Give it a name you will recognize later, something like “WordPress SMTP” so you know what it is for if you ever need to revoke it.
3. Click Create. Google shows you a 16-character code in a yellow box.
4. Copy that code immediately. Google will not show it to you again after you close the window.

Step 3: Install an SMTP plugin on WordPress

Gmail’s regular login credentials do not work for SMTP connections from an app like WordPress, which is exactly why the app password exists. You need a plugin to handle the connection.

1. From your WordPress dashboard, go to Plugins > Add New and search for ReadyGo Tools SMTP, or install it directly from the plugin’s page.
2. Activate it, then open its settings page from the WordPress admin menu.
3. Choose Gmail from the list of 14 supported providers.
4. Enter your full Gmail address as the username.
5. Paste the 16-character app password from Step 2 into the password field, with no spaces.
6. Set the From name to whatever you want recipients to see, usually your site or business name.

Step 4: Send a test email

Every SMTP plugin worth using has a test send button on its settings page. Use it before assuming the setup worked. Enter your own email address, click send, and check your inbox within a minute or two. If it does not arrive, check spam first, then double check the app password was pasted without extra characters.

A worked example

Say you run a small bakery site taking online orders through a contact form, and you want confirmation emails to come from [email protected] but actually route through your Gmail account for reliable delivery. After enabling 2-Step Verification and generating an app password named “Bakery Site SMTP,” you install ReadyGo Tools SMTP, select Gmail, and enter your Gmail address as the username with the app password pasted in.

In the From Name and From Email fields, you can still set the From Name to “Sunrise Bakery” even though you are authenticating through a personal Gmail account, though the From Email itself typically needs to match the Gmail address you authenticated with, or Gmail may override it, depending on the plugin’s settings. Run the test send to your own inbox first. Once that arrives correctly, submit a real test order through your contact form and confirm both the customer-facing confirmation and your own admin notification land within a minute. That two-part test, one direct test email and one real form submission, catches the difference between the SMTP connection working and the actual site trigger working, which are two separate things.

Troubleshooting authentication errors

If the test send fails with an authentication error rather than just not arriving, the message usually points to one of a few specific causes:

• “Username and password not accepted.” This almost always means the app password was copied with a typo or an extra space, or 2-Step Verification was turned off after the app password was created, which invalidates it. Generate a fresh one and paste it again carefully.
• “Less secure app blocked.” If you see this exact wording, you are trying to use your normal Gmail password instead of an app password. Google disabled the “less secure apps” option entirely for most accounts, so this route no longer works at all, the app password is the only path now.
• Connection times out with no specific error. This is sometimes a hosting firewall blocking outbound port 587 or 465. Contact your host and ask them to confirm outbound SMTP ports are open, which is a common restriction on cheap shared hosting plans.
• Works in testing but stops after a few weeks. Check your Google Account’s security activity page. If you signed into that Google account from a new device or changed your main password, Google sometimes revokes existing app passwords as a precaution, which means generating a new one and updating the plugin.

Common mistakes with Gmail app passwords

• Using your regular Gmail login instead of the generated app password. This will fail every time once 2FA is active.
• Copying the app password with the spaces Google displays it with. Some plugins strip spaces automatically, others do not, so it is safer to remove them yourself before pasting.
• Forgetting that revoking access from your Google Account also breaks the WordPress connection instantly. If you ever see “app passwords” access removed in your Google security activity, that is why your site emails stopped.
• Assuming Gmail is unlimited. Once you hit the daily cap, everything queued behind it fails until the next day.

What to do about the daily sending limit

If your site occasionally sends more than 500 emails in a day, a busy sale, a bulk password reset after a security event, or an event with a lot of registrations, Gmail alone cannot absorb that. This is where connecting a second provider as a backup is worth the extra five minutes. ReadyGo Tools SMTP supports load balancing and failover across its 14 providers for free, so once you hit Gmail’s cap, or if Gmail has a temporary outage, mail automatically continues through a second connected account instead of silently failing. Most SMTP plugins reserve this feature for a paid tier. It is included here at no cost, along with a delivery log so you can see exactly which provider handled each email.

Is Gmail SMTP good enough for a small site?

For most small business sites, blogs, and portfolios sending order confirmations, contact form notifications, and comment alerts, Gmail’s free sending limit is more than enough and the setup above is all you need. If you run a store with regular high order volume, consider connecting a dedicated transactional provider like Brevo or SendGrid as your primary, with Gmail as the backup, rather than the other way around.

FAQ

Can I use the same Gmail app password on more than one WordPress site? Technically yes, but it is not a good idea. If one site’s plugin is compromised, both sites are exposed. Generate a separate app password per site so you can revoke access to just the affected one if something goes wrong.

Does this cost anything? No, Gmail’s SMTP access is free within its sending limits, and ReadyGo Tools SMTP is a free plugin. There is no cost to set this up on a typical small site.

What happens if I change my Gmail password? App passwords are independent of your main account password in most cases, so changing your regular password usually does not break the app password. Enabling extra security features or removing 2FA temporarily is what tends to revoke them.

Can I use a Google Workspace account instead of a free Gmail account? Yes, the same app password process applies, and you get a higher daily sending limit of around 2,000 emails, which is worth considering if your site is growing past what the free tier comfortably handles.

Wrapping up

The whole setup, from turning on 2FA to a confirmed test email, takes about ten minutes and does not require touching any code. Once it is done, WordPress mail becomes noticeably more reliable, since you have moved off unauthenticated PHP mail() and onto a provider that actually confirms delivery.