The Quick Answer
WordPress password reset emails fail to arrive because most hosting providers block the default PHP mail() function that WordPress relies on. This function sends mail without authentication, triggering spam filters and rejection by email providers. The fix is to switch WordPress to an authenticated SMTP server that proves your site’s identity and ensures deliverability. With proper SMTP configuration, password reset emails will reach users’ inboxes reliably.
Why Password Reset Emails Fail
When a user clicks “Lost your password?” in WordPress, the system generates a reset link and attempts to email it using the server’s built-in mail function. Here is why this almost always fails:
- No authentication: PHP mail() sends messages without verifying who you are, making them look like spam or spoofed messages.
- Host-level blocking: Many hosting providers disable or throttle mail() to prevent abuse, especially on shared servers where one spammer can ruin reputation for all sites.
- Email provider filters: Gmail, Outlook, Yahoo, and corporate email systems automatically reject unauthenticated messages from unfamiliar servers.
- Missing sender verification: Without SPF, DKIM, and DMARC records, email systems have no way to confirm your site is legitimate.
- Reverse DNS failures: The server’s reverse DNS pointer may not match your domain, signaling to email providers that something is wrong.
The result: users never receive reset emails, cannot log back into their accounts, and quickly lose trust in your site. This is especially damaging for membership sites, ecommerce stores, and any business relying on user access.
Understanding SMTP and How It Solves This
SMTP (Simple Mail Transfer Protocol) is the industry-standard protocol for sending authenticated email. Instead of relying on your server’s mail function, WordPress sends email through a trusted service like Gmail, SendGrid, or Mailgun that already has a reputation for deliverability. These providers maintain their sender reputation aggressively, so their servers are trusted by email providers worldwide.
When you use SMTP, your WordPress site tells Gmail or SendGrid, “I have permission to send on behalf of this domain,” and those services verify your credentials before sending. This authentication proves to receiving email servers that your message is legitimate and not forged.
To set up SMTP for WordPress password reset emails, you will need:
- An SMTP provider account (free options include Gmail or services that offer free tiers like MailerSend)
- Your SMTP credentials: server address, port, username, and password
- A WordPress SMTP plugin to route all email through that server
A reliable free option is ReadyGo Tools SMTP, which supports Gmail, SendGrid, Mailgun, and other major providers with a simple setup process. No coding required.
Step-by-Step Fix for Password Resets
Step 1: Choose an SMTP Provider
Gmail is the easiest starting point. You can create a free Gmail account or use your existing one. Log into your Google Account security settings and generate an app password (not your regular password) for security. This keeps your Gmail password away from WordPress while allowing access for email sending. Other free alternatives include MailerSend, which offers up to 300 emails per day free, or SendGrid with a free tier.
Step 2: Install an SMTP Plugin
In your WordPress dashboard, go to Plugins and Add New. Search for “SMTP” or “mail.” ReadyGo Tools SMTP is free and handles multiple providers. Install and activate it. The plugin adds a new settings page where you will enter your SMTP details.
Step 3: Enter Your SMTP Details
Navigate to the plugin’s settings page. You will see fields for SMTP host (e.g., smtp.gmail.com), port (usually 587 for TLS), username, password, and the “from” email address. Copy each detail carefully from your SMTP provider to avoid typos. Most plugins have a built-in test connection button that verifies everything before saving.
Step 4: Send a Test Email
Use the plugin’s built-in test feature to send yourself a message. If it arrives within a minute, your password reset emails will now work. If not, check your spam folder or review the plugin’s error logs for error messages.
Troubleshooting Password Reset Delivery
Even with SMTP enabled, password emails may still miss the inbox. Here are additional checks:
- Verify the “from” address: Your plugin should be sending from an authenticated email address. If it sends from a generic address like “[email protected],” email providers may still block it unless SPF and DKIM are properly configured.
- Check your SMTP credentials: A typo in your server address, port, or password is the most common setup mistake. Use copy-paste instead of typing manually.
- Monitor your SMTP provider’s logs: Most services log delivery attempts. Log into your SendGrid or Gmail account to see if your messages were rejected by their servers or accepted but then rejected by the recipient’s inbox.
- Test with a Gmail account first: Gmail has some of the most permissive filters. If password emails reach Gmail but not other providers, your sender reputation needs improvement.
- Add DNS authentication records: Set up SPF and DKIM records in your domain’s DNS settings. These records cryptographically verify that your emails are legitimate. Your SMTP provider’s documentation should explain how to do this.
Frequently Asked Questions
Will setting up SMTP stop spam emails from being marked as spam?
SMTP is necessary but not sufficient. You should also configure SPF, DKIM, and DMARC records in your domain’s DNS settings. These records cryptographically verify that your emails are legitimate. Most email providers check these before deciding if a message is spam. Without these records, even authenticated SMTP may hit spam folders.
Can I use any email address as the “from” sender?
For best results, use an email address from your own domain, or use the email address associated with your SMTP account. Sending from an external address like a Gmail account without proper authentication may trigger spam filters. Most email providers specifically check that the “from” domain matches the authenticated sender.
Do I lose emails if my SMTP provider is down?
WordPress typically does not queue emails. If SMTP fails, the email is usually not sent or is lost. Some SMTP plugins offer a failover option to switch to a backup provider if the primary server is unreachable. If delivery is critical for your business, choose a provider with a strong uptime guarantee and consider setting up failover.