內容簡介
Postkeep 外掛可讓您的 WordPress 郵件透過 Gmail 發送，無需應用程式密碼。只需點擊連接 Google 並登入，即可輕鬆設置並開始發送郵件，確保郵件安全且可靠。
【主要功能】
• 一鍵連接 Gmail，無需應用程式密碼
• 支援多種 SMTP 伺服器，靈活配置
• 郵件日誌記錄，追蹤發送狀態
• 失敗郵件重試隊列，自動重發
• 測試工具顯示失敗原因
外掛標籤
開發者團隊
② 後台搜尋「Postkeep – One Click SMTP Setup and Email Log」→ 直接安裝（推薦）
原文外掛簡介
Postkeep sends your WordPress mail through Gmail without an app password: click Connect with Google, sign in, and mail starts going out through that account, even if the site sent through its own SMTP server before. The Gmail connection is a free service of allinonewpsettings.com (the makers of All-in-One WP Settings): the plugin links your site to a free account there, and that account holds the Google connection on your behalf and hands the plugin a short-lived sending token when it has mail to send. Your mail goes from your site to Google; the service never sees a message. One site per free account. The details of what is sent to the service are under “External services” below.
You do not need the service to use the plugin. Every other provider works without it: Outlook.com and Microsoft 365 (OAuth2 with your own Azure app), Yahoo, Zoho, Yandex, SendGrid, Mailgun, Amazon SES, Brevo, SparkPost, Postmark, your host’s own mail server, or any host and port you type in. Gmail also works with an app password if you prefer not to link the site.
What you get
Gmail through the Gmail API, signed in once with no app password, with the narrow send-only permission (gmail.send), never the full mailbox.
Any SMTP server: presets for the common providers, or your own host, port and encryption.
An email log: every failed message and every test, with the reason when one failed — which stage broke (name lookup, connection, encryption, sign-in, recipient, transfer) — and, when Debug Logging is on, the server’s own reply, with credentials redacted. Successful messages are logged too when “Log successful emails” is on; it is off by default.
A retry queue: when “Enable Queue System” is switched on and saved on the Configuration tab, a failed message (other than a test) is queued and tried again by an hourly scheduled task, up to three times.
A test tool that tells you where a failure happened instead of “could not send”.
Passwords and tokens encrypted at rest with your site’s security keys.
A copy-for-support summary on the Help tab: versions, the sending setup and the last failures, ready to paste into a forum post. Passwords and tokens are never in it and the sender and Google addresses are masked; a linked site’s licence key appears with its first part visible, and the failure lines appear as they were recorded, so read it before you post it.
Every string is ready for translation on translate.wordpress.org.
Postkeep and All-in-One WP Settings
This plugin is the SMTP module of All-in-One WP Settings, offered on its own for free. If you later install the suite, it reads the same settings, log and queue, and this plugin steps aside on its own; you can then deactivate it. Nothing is lost either way.
External services
The free Gmail connection uses a service at https://allinonewpsettings.com, operated by the makers of All-in-One WP Settings. Nothing is sent to it until you click “Connect with Google”; if you never click it, the plugin contacts no external service. Once the site is linked, the calls below follow.
What is sent, and when
Every request goes to https://allinonewpsettings.com over HTTPS with a User-Agent header that names the plugin’s version and the site’s URL. Once the site is linked, every request also carries the activation token, in two request headers: Authorization: Bearer … and a second header that carries the same token. Below, “the site details” are the product code and product name, the site URL and its domain, and the plugin, WordPress and PHP versions; “the licence details” are the licence key, the activation id and the install identifier.
Linking the site, when you click “Connect with Google” on a site that is not yet linked: the product code, the site URL, a random install identifier, the address to return to (a page of your site’s admin area), the site’s language, and the plugin, WordPress and PHP versions, to obtain a sign-in link. Your browser then opens that link and you sign in to, or register with, allinonewpsettings.com. When you are sent back, the plugin exchanges the one-time code it received, together with the site URL and the install identifier, for a licence key, an activation id and an activation token. The licence key and the activation id are stored in the site’s database in plain text. The activation token is stored encrypted with the site’s security keys; on a server without PHP’s openssl extension it is stored as it is.
Starting the Google sign-in, straight after linking or when you click “Connect with Google” on a linked site: the site details, the licence details, the send method the plugin supports (gmail_api), the provider and the address to return to, to obtain Google’s consent page. Google’s own consent screen then asks you for permission to send mail as you.
Reading the connection’s status: the site details without the WordPress and PHP versions, the licence details and the supported send method, as query parameters of the request address, so the licence key is part of the address requested. This happens when you open the Configuration tab, unless the last answer is less than 60 seconds old; when you click “Refresh status”; and once when you come back from Google’s consent page to the Configuration or the Setup tab.
Sending a message through the connection: the site details, the licence details, the supported send method, the provider and the purpose (send), to obtain a short-lived Google access token. Messages sent during the same page request reuse that token. The message itself is sent from your site directly to Google’s Gmail API and never passes through the service.
Once a day, while the site is linked: the site details, the licence details and the activation token (here also in the request body), to confirm the licence is still valid.
Disconnect, when you click it: the site details, the licence details and the supported send method, so the service revokes the Google connection.
Deleting the plugin: the site details, the licence details and the activation token (here also in the request body), so your site leaves the free licence.
The service stores, for your free account: your e-mail address and name and your Google sign-in identifier (from signing in with Google), your language, the time of each sign-in, and a record of the terms you accepted with the date, your IP address and your browser’s user agent. For your site: its URL and domain, the install identifier, the plugin, WordPress and PHP versions and the time of the last daily check, and the IP address and browser user agent from which you linked it. For your licence: the licence key, the activation id, a one-way hash of the activation token and a history of its activations. For the Google connection: the connected Gmail address and Google account identifier, the permissions granted, a refresh token and an access token (both encrypted), when it was connected and last used, and the day’s count of sending tokens. It also keeps a record of the e-mails it sends you. The Google tokens are deleted when you click Disconnect, 30 days after the plugin is deleted, or after 180 days without sending; the Gmail address and Google account identifier are deleted 90 days after the tokens. The rest is kept with no set end date. The service never receives a message, a recipient or your Gmail password.
Terms of service: https://allinonewpsettings.com/terms-of-service
Privacy policy: https://allinonewpsettings.com/privacy-policy
The mail providers themselves
Sending mail means talking to the provider you chose, with your own account. Those requests go from your site straight to the provider; nothing here passes through allinonewpsettings.com. They happen only for the provider you have configured, and only when your site sends mail or when you connect an account.
Google — sending. When Gmail is your provider and the account is connected (through the free Gmail connection above, or through your own Google app), each message is posted to the Gmail API at https://gmail.googleapis.com — /gmail/v1/users/me/messages/send, or /upload/gmail/v1/users/me/messages/send when the message with its attachments, encoded for the API, is larger than 4 MiB (about 3 MiB before encoding). What is sent is the message itself: your sender name and address, the recipients, the subject, the body and any attachments, with the access token for your account. Google’s terms: https://policies.google.com/terms — Google’s privacy policy: https://policies.google.com/privacy
Google — signing in with your own app. If you enter your own Google Client ID and Secret instead of using the free Gmail connection, your browser is sent to https://accounts.google.com to approve it, and the plugin then exchanges the result for tokens at https://oauth2.googleapis.com/token, and refreshes them there. What is sent: your Client ID, your Client Secret and the code or refresh token. Same terms and privacy policy as above.
Microsoft — sending and signing in. With Outlook.com or Microsoft 365 and your own Azure app, your browser is sent to https://login.microsoftonline.com to approve it; the plugin exchanges and refreshes tokens at the same host, reads the mailbox address once from https://graph.microsoft.com/v1.0/me, and posts each message to https://graph.microsoft.com/v1.0/me/sendMail — what is sent: your Client ID and Secret at sign-in, and afterwards the message — sender, recipients, subject, body and attachments. Microsoft Services Agreement: https://www.microsoft.com/en-us/servicesagreement — Microsoft privacy statement: https://www.microsoft.com/en-us/privacy/privacystatement
Yahoo — signing in. With Yahoo Mail and OAuth2, your browser is sent to https://api.login.yahoo.com to approve your own app, and tokens are exchanged and refreshed at the same host; the mail itself then goes over SMTP to Yahoo’s mail server. What is sent: your Client ID, your Client Secret and the code or refresh token. Yahoo’s terms: https://legal.yahoo.com/us/en/yahoo/terms/otos/index.html — Yahoo’s privacy policy: https://legal.yahoo.com/us/en/yahoo/privacy/index.html
Every other provider — SendGrid, Mailgun, Amazon SES, Brevo, SparkPost, Postmark, Zoho, Yandex, your host’s own mail server, or any host you type in — is reached over plain SMTP at the address you enter, with the credentials you enter, and nowhere else.
The provider list on the settings screen
The settings screen offers thirteen providers to pick from, and each one is a saved set of starting values for the form: a port and an encryption setting, and, for the eleven named services, their mail server — such as email-smtp.us-east-1.amazonaws.com for Amazon SES or smtp.sendgrid.net for SendGrid — and a link to that provider’s own setup documentation, for example https://developers.sparkpost.com/api/smtp/ for SparkPost. (“Shared Hosting” fills in mail. and your own domain, with port 465 and SSL; “Custom SMTP Server” leaves the server empty and starts with port 587 and TLS. Neither has a documentation link.) Picking a provider fills the form in for you; nothing is contacted when you pick one, and the documentation link only opens in your browser if you click it. The plugin sends mail to the server in the form after you have saved it, with the credentials you entered, and it contacts no other address. So the provider names and hostnames in the plugin’s code are a list of choices available to you, not services this plugin talks to: a site that never picks Amazon SES never reaches Amazon, and the same for every other name on the list.
One more address appears in the plugin’s code and is not a service it contacts: https://api.wordpress.org/secret-key/1.1/salt/ is named in an admin message that tells you where to generate WordPress’s security keys when your wp-config.php has none. It is text in a warning on your own screen; the plugin makes no request to it.
