Skip to content
Rescue 404
Rescue

Website Email Problems

SMTP Authentication Failed

Intermediate Risk: medium

Last reviewed

Hosting access may not be needed Database access usually not needed

Direct answer

SMTP authentication failed means the mail server rejected the username, password, or auth method your WordPress SMTP plugin presented—fix credentials and app passwords, confirm TLS port settings, and disable blocked legacy auth before chasing form or theme bugs.

When an SMTP plugin or mail log reports authentication failed (often SMTP 535), WordPress never successfully hands the message to the provider. Wrong passwords, revoked app passwords, OAuth changes, and hosts that block basic auth are the usual culprits. This guide isolates credential and protocol failures so you do not confuse them with spam-folder delivery or silent PHP mail drops.

Intermediate

Key facts

Verifiable numbers and definitions — each claim links to its source.

  • Microsoft documents SMTP AUTH as authenticated client SMTP submission used to send mail through Exchange Online. (Microsoft SMTP AUTH)
  • WordPress sends mail through wp_mail(), which relies on PHPMailer and the server's mail configuration. (wp_mail() function reference)
  • The phpmailer_init hook lets plugins set SMTP host, port, encryption, and credentials before WordPress sends mail. (phpmailer_init hook)

What the error means

Authenticated SMTP asks the client (WordPress via PHPMailer and your SMTP plugin) to prove identity before the server accepts mail for relay. Failure responses such as 535, “authentication failed,” or “username and password not accepted” mean the TCP/TLS session reached the server but AUTH did not succeed. That differs from connection timeout (firewall or blocked port), certificate mismatch (wrong encryption mode), and from messages that authenticate then land in spam. Google Workspace and Microsoft 365 increasingly require app passwords or OAuth instead of the account’s normal password, and some tenants disable SMTP AUTH entirely. Shared hosts may also intercept outbound 465/587 or force you onto an HTTPS API. Reading the exact status line in the mail log is the shortest path to the right fix.

Common symptoms

  • SMTP or mail-log plugin shows “SMTP Error: Could not authenticate” or similar
  • Status code 535 / 5.7.8 / “username and password not accepted” on test sends
  • Contact forms, password resets, and WooCommerce mail all fail at the same timestamp
  • Test email from the SMTP plugin settings page fails while the rest of the site works
  • Mail worked until a password rotation, security checkup, or provider policy change
  • OAuth connected plugins suddenly report token expired or consent revoked
  • Same mailbox password works in a desktop client but fails from the web server (or the reverse)

Most likely causes

  1. 01 Incorrect SMTP username (must often be the full email address) or mistyped password
  2. 02 Provider requires an app password; the normal account password is rejected
  3. 03 OAuth/app password revoked after a security reset, 2FA change, or idle expiry
  4. 04 SMTP AUTH disabled on the Microsoft 365 mailbox or Google account policy
  5. 05 Wrong host, port, or encryption pair (for example SSL on 587 or TLS on 465)
  6. 06 Copy/paste introduced a trailing space or smart quote into the stored secret
  7. 07 Multiple SMTP plugins fighting over phpmailer_init with stale credentials

What changed before the problem started

  • Mailbox password rotated or app password regenerated without updating WordPress
  • 2FA enabled on Google or Microsoft, invalidating password-only SMTP
  • Admin disabled SMTP AUTH for the tenant or mailbox
  • Site migrated; old SMTP settings still point at the previous host’s mail server
  • SMTP plugin updated and cleared or re-encrypted stored credentials
  • Security suite or password manager changed the mailbox secret

Troubleshooting steps

  1. 01

    Capture the exact SMTP response from a plugin test

    Open your SMTP plugin’s send-test screen (or mail log) and trigger one message. Copy the full error including numeric code. Authentication failures need credential/protocol work; timeouts need host firewall or API migration instead—do not reset DNS yet.

  2. 02

    Verify username, host, port, and encryption against provider docs

    Use the provider’s documented SMTP hostname—not a guess. Common patterns: TLS on port 587, or SSL on 465, never mixed. Username is usually the full mailbox address. Save settings and retest once; avoid rapid-fire retries that trip account lockouts.

  3. 03

    Create a fresh app password or reconnect OAuth

    For Google Workspace/Gmail and many Microsoft setups, generate a new app password (or complete the plugin’s OAuth flow) after 2FA is on. Paste carefully with no trailing spaces. Revoke the old app password after the WordPress test succeeds.

  4. 04

    Confirm SMTP AUTH is allowed for that mailbox

    In Microsoft 365, check that SMTP AUTH is enabled for the licensed mailbox if you must use basic auth. In Google, confirm the account is allowed to use less-secure/app-password paths per current admin policy. If the tenant forbids SMTP AUTH, switch the site to the provider’s API or an approved transactional service.

  5. 05

    Eliminate duplicate mailer plugins

    Deactivate every extra SMTP plugin so only one configures PHPMailer. Competing plugins often leave one set of bad credentials winning. Retest with a single active mailer and a domain-aligned From address.

  6. 06

    Fall back to a transactional API if the host blocks outbound SMTP

    If AUTH errors alternate with timeouts, or the host forbids outbound 25/465/587, configure an HTTPS API integration (SendGrid, Mailgun, SES, Postmark, and similar) instead of raw SMTP. Update SPF/DKIM for that provider after auth succeeds.

When to stop troubleshooting

Escalate when fresh app passwords and correct host/port still return 535, the tenant disables SMTP AUTH with no API alternative, or the host blocks all outbound mail ports. Provide the mail-log transcript, provider name, and whether OAuth or app passwords are in use—do not keep rotating production mailbox passwords blindly.

Information to collect before requesting help

  • 01 Exact SMTP error text and status code from the mail log
  • 02 SMTP hostname, port, and encryption mode configured (password redacted)
  • 03 Mailbox / transactional provider (Google, Microsoft 365, SendGrid, host mail, etc.)
  • 04 Whether 2FA, app passwords, or OAuth are required
  • 05 Recent password rotations or plugin changes
  • 06 Hosting company and whether outbound 587/465 is allowed
  • 07 List of active SMTP or mailer plugins

How a professional repairs the problem

We read the SMTP status line, rebuild a single authenticated mailer path (app password, OAuth, or HTTPS API), confirm a domain-aligned From address, and retest form and core mail end-to-end. DNS authentication is verified after transport works so spam-folder issues are not confused with AUTH failures.

Frequently asked questions

What does SMTP 535 mean? +
The server understood your connection but rejected authentication. Fix username, password, app password, or AUTH policy—not SPF records and not form notification templates.
Why did this start right after I turned on 2FA? +
Many providers stop accepting the normal account password for SMTP once 2FA is on. Create an app password or use OAuth in the SMTP plugin.
Can the password be right in Outlook but wrong in WordPress? +
Yes. Desktop apps may use OAuth while the plugin still stores an old basic password. Align both to the same modern auth method, or give WordPress a dedicated app password.
Is authentication failed the same as mail going to spam? +
No. Auth failure means the message never left via that SMTP path. Spam placement happens after a successful send. Use the spam guide only when logs show success.
Should I keep trying the test button every few seconds? +
No. Rapid failures can lock the mailbox. Correct settings once, wait for provider lockouts to clear if needed, then test again.
Do I need to change my contact form plugin? +
Almost never for an SMTP AUTH error. Forms call the same wp_mail pipeline. Fix the mailer credentials site-wide.

Repair dispatch

Still Need Help Fixing Your Website?

If you are not comfortable editing website files, changing server settings, repairing a database, or troubleshooting a live website, professional help may prevent additional damage or downtime. We will review the problem before accepting the repair.

  • You will receive a clear explanation of the likely cause.
  • We will tell you if the issue falls outside our repair scope.
  • No additional work will be performed without approval.
  • A backup should be created whenever access and website condition allow it.
Emergency repair Request diagnosis

Do not share passwords through an unencrypted contact form — use Password Pusher (self-destructing link). Prefer a dedicated Rescue 404 admin account, not your personal owner login; if you cannot create one yet, we will add ours after repair.

Written by Josh

Last reviewed

Platform note: Full rescue available for WordPress and self-hosted sites. Wix, Squarespace, Webflow, Weebly, and similar closed builders have very limited backend access — fixes may not be possible. I will tell you honestly before we start.