You rotated the Workspace password and your WordPress contact form went dark. Or a Workspace admin disabled App Passwords org-wide and the site stopped sending overnight. Or the account whose App Password you were using belonged to someone who left, and IT closed it. These are the moments the App Password path fails, and once you have hit one, the question stops being how to regenerate the credential and starts being whether Gmail SMTP is the sending path you should still be on.
The credential mechanic itself is covered in Gmail App Passwords; the OAuth-versus-App-Password decision on Gmail SMTP in Gmail OAuth vs. App Passwords; the stay-on-Gmail alternative that swaps the App Password for a Workspace relay in Gmail SMTP without OAuth. This piece is about leaving Gmail SMTP.
The failure modes to know
Password rotation revokes every App Password on the account. The plugin still holds the old sixteen-character code, still tries to authenticate, and the SMTP server rejects the login with an unhelpful error. Contact forms fail. Order confirmations fail. Nobody notices until a customer emails to ask why their receipt never arrived.
Turning off 2-Step Verification breaks the App Passwords tied to it. 2-Step Verification is a prerequisite for generating App Passwords in the first place, and existing App Passwords stop working once it is turned back off. This catches the person who disables 2SV to troubleshoot an unrelated account issue and then wonders why the WordPress site’s SMTP broke on the same day.
A Workspace admin can turn off App Passwords org-wide. The control lives in the Admin console under Security > Authentication > 2-Step Verification, as an “Allow users to generate app passwords” checkbox. When the checkbox is cleared, App Passwords across the organisation stop working on new authentication attempts. Google has been steering Workspace admins toward that setting as part of the Less Secure Apps sunset, so the odds of it landing on a random Tuesday are not zero.
An ex-employee’s account takes the App Password with it. Suspending or deleting a Google account revokes the App Password generated on it. A WordPress site running SMTP through a departed team member’s Gmail loses sending the moment IT closes the account, and the fix requires a live person on a live account to generate a fresh credential. This is the case that most often makes a site owner reconsider Gmail SMTP altogether.
Four questions before you switch
Volume. Gmail’s send limits are 500 messages per day for consumer accounts and 2,000 per day for Workspace. A brochure site with a contact form does not care. A WooCommerce store processing forty orders a day, each triggering an order confirmation, a receipt, a shipping notice, and a review-your-purchase nudge, burns 160 messages on order flow alone; add abandoned-cart mail and admin notifications and the Workspace ceiling is close. Gmail’s response to an over-limit account is an outbound send lockout of up to 24 hours.
Durability. Four failure modes above, five if the ex-employee case counts as its own class. A dedicated SMTP relay’s API key is not tied to a human password, does not care about 2-Step Verification, is not affected by admin policy on another Google service, and is held by a service account rather than a person. A password rotation on a Workspace admin’s account leaves the WordPress site’s sending untouched.
Custom-domain alignment. If mail must leave WordPress as [email protected], Gmail SMTP requires a Workspace account with that domain plus a “send as” configuration, and the message still traces back to Google’s IPs. A dedicated relay signs DKIM with keys that resolve to records under the sending domain and publishes SPF that authorises the provider’s IPs directly, which is the identity receiving servers expect for domain-aligned A transactional email is the automated message a WordPress site sends in response to a single user action – a password reset, an order confirmation, a form receipt – addressed to the user who triggered it. Read full reference →.
Team size. One person managing their own site can keep an App Password up to date without ceremony. Two or more people share a credential that lives inside somebody’s personal Google account, and every rotation, every 2FA change on that account, every eventual departure creates an outage the other people have no way to prevent. A transactional relay’s API key belongs to the site, not to a person; ownership becomes an admin field in the WordPress dashboard rather than a piece of internal-HR risk.
Where to go instead
SMTP2GO is the shortest path off Gmail SMTP for a WordPress site. It speaks plain SMTP, so any WordPress SMTP plugin (WP Mail SMTP, FluentSMTP, Post SMTP, or the mailer built into a form plugin) configures against it without an API integration. The free tier covers 1,000 emails per month with a 200-per-day and 25-per-hour sub-cap, which suits most contact-form-only sites, and the paid tiers scale predictably. If the goal is to change one set of credentials in the plugin and never think about the sending path again, this is the default. Setup: SMTP2GO.
Postmark is the choice when transactional reliability and inbox placement matter more than cost. Its deliverability record is among the strongest in the category, and its bounce and delivery webhooks give WordPress plugins clean signal to log against. Postmark is opinionated: they refuse marketing and newsletter traffic on the transactional stream, so a site running an email newsletter alongside WooCommerce order mail should route the newsletter through a separate stream or provider. Setup: Postmark.
Brevo (formerly Sendinblue) is worth the switch when transactional and marketing mail need to live on the same platform. The free tier is 300 emails per day, which suits sites with peaky send patterns. Setup: Brevo.
Amazon SES is the destination for anyone already inside AWS or comfortable with IAM roles, service quotas, and CloudWatch. At $0.10 per 1,000 emails it is the cheapest option at any real scale, though the initial account moves (out of the sending sandbox, through domain and IP warmup) take longer than any of the others. Setup: Amazon SES.
For picking the SMTP plugin to run against the new provider, the WordPress SMTP plugin comparison covers the choice.
When to stay on Gmail App Passwords
Gmail App Passwords are still the right answer if all four of the following apply:
- Volume is low: dozens of messages a week, not per day.
- Sending is internal-only: admin notifications, staging tests, no customer-facing transactional traffic.
- No DNS access on the sending domain, or the site is sending as
[email protected]on a personal account with no custom domain in play. - Willing to regenerate the App Password after every account password rotation and every 2FA change, and to keep that discipline for the life of the site.
If all four apply, the failure modes above are recoverable in minutes and the alternatives are more infrastructure than the site needs.
The deciding question is straightforward: does mail delivery need to survive a password rotation without you noticing it happened? If it does, SMTP2GO is the default next step for the WordPress operator, and the other three exist for the sites that grow past SMTP2GO’s fit.