=== POP SMTP ===
Tags: smtp, email, woocommerce
Requires at least: 6.2
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.1
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html

Simple SMTP delivery for WordPress and WooCommerce, with secure settings and a test email.

== Description ==

POP SMTP provides a small, English-language settings page for SMTP delivery.

* STARTTLS and implicit TLS (SMTPS).
* Optional SMTP authentication.
* Sender email address and optional sender name override.
* Test email using saved settings.
* Encrypted password storage, or a password constant in wp-config.php.
* No advertising, paid tiers, analytics, email logs or developer telemetry.

Uses the PHPMailer library included with WordPress. WooCommerce is optional.
Applies to messages sent through wp_mail(), including WooCommerce order emails.
Does not alter email bodies, attachments or Reply-To addresses.
Does not read or modify order storage. Does not send or receive POP3 email.
POP SMTP is an independent plugin and is not an official WooCommerce product.

== Installation ==

1. In WordPress, open Plugins > Add New Plugin > Upload Plugin.
2. Upload pop-smtp-1.0.1-update.zip, install it, and activate POP SMTP.
3. Open Settings > POP SMTP.
4. Enter the SMTP host, port, encryption and credentials supplied by your mail provider.
5. Enter an authorized sender email address. Enable SMTP and save settings.
6. Send a test email and check the recipient inbox and spam folder.
7. For WooCommerce, place a test order and verify customer and administrator emails.

See INSTALLATION.txt for the full English setup guide.

== Frequently Asked Questions ==

= Is it free to redistribute? =

Yes. POP SMTP is licensed under GPL-2.0-or-later. Source code and license terms are included.

= Does it require WooCommerce? =

No. It configures WordPress mail delivery and also works with WooCommerce.
Plugins that send directly through their own external APIs may bypass POP SMTP.

= Where is the password stored? =

Passwords entered in the settings page are encrypted using AES-256-GCM and a key
derived from the WordPress authentication salt. PHP OpenSSL is required for this.
The encrypted value is stored in the site options table, with autoload disabled.
Changing the WordPress authentication salt requires re-entering the password.
This does not protect against an attacker who controls the entire server.

Alternatively, define POP_SMTP_PASSWORD in wp-config.php before WordPress loads.
The constant takes precedence. Saving settings while the constant is defined
removes any previously stored database password. Remove the constant manually when needed.

= What data leaves the site? =

When enabled, outgoing emails and SMTP credentials are transmitted over TLS to
the SMTP server configured by the administrator. Use a provider you trust and
follow that provider's terms. The plugin sends no telemetry to its developer
and stores no email bodies, recipients or SMTP response logs.

= Which connections are supported? =

STARTTLS (usually port 587) and implicit TLS / SMTPS (usually port 465).
Use a single hostname or IPv4 address. TLS certificates must be valid.
OAuth 2.0, plaintext SMTP, IPv6 literals, queues and automatic retries are not included.
Use a provider that supports SMTP password or application-password authentication.

= What happens on deactivation or deletion? =

Deactivation retains settings. Deletion removes saved plugin settings on all sites
in a multisite network. Settings are per site. A wp-config.php constant is never edited.

== Changelog ==

= 1.0.1 =
* Make nonce verification explicit at form input boundaries.
* Sanitize text settings while preserving and validating opaque SMTP passwords.
* Remove direct SQL from uninstall cleanup and clear transients through WordPress APIs.
* Normalize line endings and move the setup guide to INSTALLATION.txt.
* Document the WordPress core mail failure hook and add the tested version header.


= 1.0.0 =
* Initial release.
