=== NimblyMail SMTP ===
Contributors: nimblymail
Tags: smtp, email log, gmail smtp, outlook smtp, transactional email
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.0.6
License: GPL-2.0-or-later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

A modern SMTP and email log plugin for WordPress. Improve deliverability via SMTP, Gmail, Resend, Amazon SES, or SendLayer.

== Description ==

NimblyMail is a comprehensive SMTP and email logging plugin designed to fix WordPress email deliverability issues. By default, WordPress uses the unreliable PHP `mail()` function, which often causes emails to land in the spam folder or never deliver. NimblyMail solves this by reconfiguring WordPress to securely route your site's emails through a proper SMTP server or dedicated email provider.

Whether you need to connect via a standard SMTP host, Gmail OAuth, Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, or ZeptoMail, NimblyMail ensures your emails reach the inbox. Plus, with comprehensive email logging, a background queue, a developer sandbox, and an automated deliverability audit, you get full delivery monitoring and one-click troubleshooting.

= At a glance =

* Nine email providers — SMTP, Gmail OAuth, Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, ZeptoMail, and PHP mail.
* **Free Email Logging** — Comprehensive log with search, status filters, and one-click resend of failed emails.
* **Background Queue** — Defer wp_mail() calls to a non-blocking queue powered by Action Scheduler, with three-tier priority, exponential backoff retries, and admin tools to retry or cancel pending mail.
* **Developer Sandbox** — Stop staging and local environments from sending real email. Choose Log Only (capture and short-circuit) or Redirect (rewrite every recipient to a single safe address). Optional allowlist for addresses that should bypass the sandbox.
* **Deliverability Health Audit** — Automated DNS-based audit of SPF, DKIM, DMARC, and PTR for the active sender domain, with scheduled checks and human-readable findings per pillar.
* **Clean, Modern Dashboard** — Delivery stats, connection health, queue health widget, deliverability summary, and recent activity at a glance.
* Selectively disable WordPress notification emails across 8 categories (over 25 individual triggers).
* Failure alerts delivered via PHP's native `mail()` so a broken transport can't silence them.
* AES-256-CBC credential encryption with optional PHP-constant overrides in wp-config.php.
* First-class WordPress Multisite support with network defaults, per-site overrides, and per-field locks.
* Guided setup wizard with auto-detection and one-click import from existing SMTP plugins.

= Supported Email Providers =

* **Other SMTP** — Connect to any SMTP server (Outlook, Office 365, Mailgun, SendGrid, Zoho, etc.)
* **Gmail / Google Workspace** — Authenticate securely via Google OAuth without managing your own Google Cloud credentials.
* **Outlook / Microsoft 365** — Authenticate via Microsoft OAuth and send through `smtp.office365.com` without registering your own Azure application.
* **Amazon SES** — Send via AWS Simple Email Service
* **Resend** — Modern email API for developers
* **SendLayer** — Transactional email delivery service
* **Brevo** — Transactional email API (formerly Sendinblue)
* **ZeptoMail** — Zoho's transactional email service with regional endpoints
* **Default (PHP)** — Fallback to the built-in PHP mail function

= Email Logging =

Every outgoing email is logged with recipient, subject, status, headers, and optional body capture. Search and filter logs by status (sent, failed, pending), resend failed emails with one click, and view full message details in a modal preview.

= Background Queue =

Turn the queue on under NimblyMail > Settings > Mail Queue and every wp_mail() call returns immediately. Messages are persisted to a database queue, dispatched by Action Scheduler in priority order (high / normal / bulk), and retried with exponential backoff on transient failures. Attachments are staged on enqueue so request-scoped tmp files cannot break delayed delivery. The Queue admin screen lists pending and failed items with retry / cancel actions, and the dashboard surfaces a queue-health widget. Test emails and admin alerts continue to send synchronously by default so you always get immediate feedback.

= Developer Sandbox =

Working on a staging copy or local clone? Turn on the sandbox to guarantee no real customer ever receives an accidental email. Pick **Log Only** to capture and short-circuit every wp_mail() call so they show up in the Email Log without leaving the host, or **Redirect** to rewrite every recipient to a single safe address with the originals preserved in `X-NimblyMail-Original-*` headers and a configurable subject prefix. An allowlist (exact email or `*@domain.com`) lets through addresses you do want delivered for testing. Sandboxing is settings-driven, switchable from the Network Admin on multisite, and visible at a glance via an admin-bar badge.

= Deliverability Health Audit =

NimblyMail runs an automated DNS audit of the active sender domain on a schedule (and on demand) and surfaces the result on the Deliverability page and the dashboard. The audit covers four pillars — SPF, DKIM, DMARC, and PTR — and is mailer-aware: required SPF includes and DKIM selectors are sourced from whichever provider you have configured (Gmail, Outlook 365, SES, etc.), with skip explanations for cases where a check does not apply. Findings are human-readable: each pillar shows pass/warn/fail with a one-line reason and a link to the relevant provider documentation.

= Email Controls =

Selectively disable WordPress notification emails you don't need — comment notifications, password reset emails, new user registrations, automatic update notices, and more. Over 25 individual email types across 8 categories can be toggled on or off.

= Failure Alerts =

Receive instant alerts when emails fail to deliver. Configure alert recipients with optional CC and BCC addresses. Alerts are sent via PHP's native mail function to bypass the broken transport.

= Security =

Credentials (SMTP passwords, API keys) are encrypted at rest using AES-256-CBC with HMAC-SHA256 verification. Settings can be locked via PHP constants in wp-config.php, making sensitive fields read-only in the admin UI.

= Settings Import =

Migrating from another SMTP plugin? NimblyMail automatically detects existing SMTP-plugin configurations and offers one-click import through the setup wizard.

= WordPress Multisite =

First-class multisite support. Network-activate the plugin once and every sub-site inherits the network defaults until a site admin explicitly overrides a field. Super admins get a Network Admin → NimblyMail surface with an aggregated dashboard, a sites table, per-field locks, and a per-site override editor.

= Clean Dashboard =

Built with Vue 3 and Ant Design, the dashboard is fast, responsive, and designed to feel native to WordPress. A guided setup wizard helps you configure everything in minutes, while the main dashboard provides a clear overview of your email delivery health.

== Installation ==

1. Upload the `nimblymail-smtp` folder to `/wp-content/plugins/`.
2. Activate the plugin through the 'Plugins' menu in WordPress.
3. Follow the setup wizard to configure your email provider, or go to NimblyMail > Settings to configure manually.

== Frequently Asked Questions ==

= How do I configure SMTP? =

Go to NimblyMail > Settings > Connection, select "Other SMTP" as your mailer, then enter your SMTP host, port, encryption type, and credentials. Click "Save Changes" and use the Email Tester under NimblyMail > Tools to verify delivery.

= Can I use Gmail to send emails? =

Yes. Select "Gmail / Google Workspace" as your mailer and click "Connect to Google" to authorize. NimblyMail uses a centralized OAuth proxy so you don't need to register your own Google Cloud project — just click, approve, and you're connected. NimblyMail handles token refresh automatically.

= Can I use Outlook or Microsoft 365 to send emails? =

Yes. Select "Outlook / Microsoft 365" as your mailer and click "Connect to Microsoft" to authorize. As with Gmail, NimblyMail uses a centralized OAuth proxy so you don't need to register your own Azure app — sign in with the mailbox you want to send from and you're connected. Mail is delivered through `smtp.office365.com:587` using XOAUTH2.

= How does the Developer Sandbox work? =

Turn it on under NimblyMail > Settings > Sandbox. Choose Log Only to capture every email locally without sending, or Redirect to rewrite every recipient to a single safe address. You can also configure an allowlist (exact email or `*@domain.com`) for addresses that should still be delivered for testing. The sandbox status is visible on the WordPress admin bar so you never forget it's on.

= How do I secure my credentials? =

NimblyMail encrypts all stored credentials (passwords, API keys) using AES-256-CBC. For additional security, you can define credentials as PHP constants in wp-config.php instead of storing them in the database. For example: `define( 'NIMBLYMAIL_SMTP_PASS', 'your-password' );`

= What happens to my email logs when I uninstall? =

By default, all data is preserved when you deactivate. To remove all data on uninstall, enable "Remove Data on Uninstall" under NimblyMail > Settings > Misc before deactivating.

= Can I import settings from another SMTP plugin? =

Yes. NimblyMail can import settings from several existing SMTP plugins. The setup wizard detects supported plugins automatically, or you can import manually from NimblyMail > Tools > Import.

= How do I set up failure alerts? =

Go to NimblyMail > Settings > Alerts, enable "Enable Alerts", and enter one or more recipient email addresses. You can also add CC and BCC recipients. Alerts are sent whenever an email fails to deliver.

== Screenshots ==

1. Dashboard — Delivery stats, connection status, queue health, deliverability summary, and recent email activity at a glance.
2. Email Log — Searchable log table with status filters, bulk actions, and per-email detail view.
3. Settings: Connection — Choose from nine supported mailers including Gmail OAuth, Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, and ZeptoMail.
4. Settings: Connection (Outlook / Microsoft 365) — Connect your Microsoft account in one click via NimblyMail's secure OAuth proxy — no Azure app registration required.
5. Setup Wizard — Guided first-run configuration with auto-detection of existing SMTP plugins.
6. Settings: Mail Queue — Turn on the background queue to defer wp_mail() calls; configure max attempts, batch size, exponential backoff, default priority, and a pause toggle.
7. Mail Queue admin — Live view of pending, processing, and failed deliveries with per-row retry / cancel actions, last-error preview, and counts grouped by status.
8. Settings: Developer Sandbox — Stop staging environments from sending real email. Log Only or Redirect mode, with an allowlist for addresses that should still be delivered.
9. Deliverability Health Audit — Automated SPF / DKIM / DMARC / PTR audit of the active sender domain with mailer-aware requirements.
10. Tools: Email Tester — Send a test email to verify your configuration works.
11. Settings: Email Controls — Toggle individual WordPress notification emails on or off (over 25 triggers across 8 categories).
12. Network Dashboard — Aggregated delivery stats, top failing sites, and per-site totals across the whole multisite network.
13. Network Sites — Per-site summary table showing the active mailer, override count, and recent sent/failed counts, with a one-click editor for each site's overrides.

== Development and source code ==

The complete, human-readable source code for NimblyMail is maintained in the public WordPress.org SVN repository for this plugin. Browse it directly in your web browser via the Trac UI:

* **Browse source:** https://plugins.trac.wordpress.org/browser/nimblymail-smtp/trunk/
* **SVN checkout:** `svn checkout https://plugins.svn.wordpress.org/nimblymail-smtp/trunk/ nimblymail-smtp`

The repository `trunk/` directory contains:

* `src/` — the PHP backend (PSR-4 autoloaded, plain readable PHP).
* `apps/` — the Vue 3 + TypeScript single-page apps (Dashboard, Settings, Email Logs, Tools, Setup Wizard, Network Admin) that get compiled into the minified bundles under `dist/`.
* `package.json`, `package-lock.json`, `tsconfig.json`, `tsconfig.node.json`, `vite.config.ts` — the build configuration needed to reproduce the exact `dist/` bundles.
* The current `dist/` build output plus per-bundle source-map files (`*.js.map`, `*.css.map`).

The minified JavaScript and CSS files under `dist/` are produced from the Vue/TypeScript sources under `apps/` using Vite. To rebuild them yourself from a `trunk/` checkout:

1. From the plugin directory, run `composer install` to install PHP dependencies (PSR-4 autoloader + Action Scheduler).
2. Run `npm install` to install the JavaScript build dependencies declared in `package.json`.
3. Run `npm run build` to regenerate the `dist/` bundle from the `apps/` sources. For local development with hot-module replacement, run `npm run dev` (Vite dev server) after adding `define( 'HMR_DEV', 'nimblymail-smtp' );` to your `wp-config.php`.

= How files under `dist/` map to readable source =

Inside the SVN `trunk/`, every minified JavaScript and CSS file under `dist/` is accompanied by a `.map` source-map file (e.g. `dist/dashboard.<hash>.js` ships with `dist/dashboard.<hash>.js.map`). The source map fully describes how each minified file was produced from the readable Vue / TypeScript files under `apps/`, and any modern browser DevTools panel or build tool can use it to inspect the original source line-by-line. The high-level mapping is:

* `dist/<entry>.<hash>.js` — the entry-point bundle for one of the admin apps. Direct source: `apps/<entry>/index.ts` (e.g. `dist/dashboard.<hash>.js` comes from `apps/dashboard/index.ts`). Entry names are: `dashboard`, `settings`, `email-logs`, `queue`, `tools`, `wizard`, `deliverability`, `network-sites`, `network-dashboard`.
* `dist/chunks/<name>.<hash>.js` — shared chunks auto-emitted by Vite/Rollup whenever a module is imported by two or more entry points. They contain no plugin-specific code that is not also visible in the readable sources under `apps/` (and in `node_modules/` for upstream dependencies like Vue, Ant Design Vue, Vue Router, and Pinia). The `dist/chunks/AppHeader.<hash>.js` chunk in particular bundles the shared admin shell (`apps/shared/AppHeader.vue`, `apps/shared/theme.ts`, `apps/shared/i18n.ts`, the Axios HTTP client in `apps/shared/api.ts`) together with the Vue runtime and Ant Design Vue components, because every admin page imports them.
* `dist/assets/<name>.<hash>.css` — compiled CSS extracted from the corresponding Vue Single-File Components under `apps/`. Source-maps are emitted for these too (`*.css.map`).

The full version history of the plugin is also browsable on its WordPress.org page at https://wordpress.org/plugins/nimblymail-smtp/.

== External services ==

NimblyMail does not contact any third-party service on its own. Outbound network requests only happen when **you actively configure and select a mailer** that uses an external provider, and only at the time of sending an email (or, for OAuth providers, when authorizing the connection).

The plugin connects to the following services depending on which mailer you choose. None of these are contacted unless you select that mailer and enter credentials.

* **NimblyMail OAuth Proxy** (`https://oauth.nimblymail.com`) — Used **only when you choose Gmail or Outlook / Microsoft 365 as your mailer**. The proxy is operated by the plugin author (NimblyMail Team) and exists so you don't have to register your own Google Cloud project or Azure application. Endpoints contacted: `https://oauth.nimblymail.com/authorize/{google|microsoft}`, `https://oauth.nimblymail.com/token/{google|microsoft}`, `https://oauth.nimblymail.com/refresh/{google|microsoft}`, `https://oauth.nimblymail.com/revoke/{google|microsoft}`. **Data sent**: your site URL (`get_home_url()`), an OAuth state value and PKCE challenge generated by the plugin, the authorization code returned by Google/Microsoft after consent, the refresh token (signed with a per-install HMAC secret) on every token refresh. **No email content, recipient lists, or message metadata is ever sent to the proxy** — actual mail delivery goes directly from your site to Gmail's / Microsoft's SMTP servers. NimblyMail Terms of Service: https://nimblymail.com/terms-of-service/ — NimblyMail Privacy Policy: https://nimblymail.com/privacy-policy/

* **Other SMTP** — When configured, every email is sent over SMTP to the server you specify (host, port, encryption, credentials). The data sent is the email itself: From / To / CC / BCC / Subject / Body / attachments. The remote SMTP server is operated by you or your provider; NimblyMail does not select it.

* **Gmail / Google Workspace** — Uses Google's OAuth 2.0 service (via the NimblyMail OAuth Proxy described above) to authorize sending, and `smtp.gmail.com:587` (XOAUTH2) to deliver mail. Direct endpoints contacted: `https://accounts.google.com/o/oauth2/v2/auth` (consent screen), `https://www.googleapis.com/oauth2/v2/userinfo` (read the authorized email address for the SASL `user=` field), `smtp.gmail.com` (SMTP delivery). Data sent directly to Google: the email envelope and message content at send time. Google Terms of Service: https://policies.google.com/terms — Google Privacy Policy: https://policies.google.com/privacy

* **Outlook / Microsoft 365** — Uses Microsoft's OAuth 2.0 service (via the NimblyMail OAuth Proxy described above) to authorize sending, and `smtp.office365.com:587` (XOAUTH2) to deliver mail. Direct endpoints contacted: `https://login.microsoftonline.com/common/oauth2/v2.0/authorize` (consent screen), `https://graph.microsoft.com/v1.0/me` (read the authorized email address), `smtp.office365.com` (SMTP delivery). Data sent directly to Microsoft: the email envelope and message content at send time. Microsoft Services Agreement: https://www.microsoft.com/en/servicesagreement/ — Microsoft Privacy Statement: https://privacy.microsoft.com/privacystatement

* **Amazon SES** — When configured, emails are sent over SMTP to the AWS SES endpoint you select (e.g. `email-smtp.us-east-1.amazonaws.com`). Data sent: email envelope and content, plus AWS access key ID and secret. AWS Service Terms: https://aws.amazon.com/service-terms/ — AWS Privacy Notice: https://aws.amazon.com/privacy/

* **Resend** — When configured, emails are sent via HTTPS POST to `https://api.resend.com/emails`. Data sent: API key, email envelope and content. Resend Terms of Service: https://resend.com/legal/terms-of-service — Resend Privacy Policy: https://resend.com/legal/privacy-policy

* **SendLayer** — When configured, emails are sent via HTTPS POST to `https://console.sendlayer.com/api/v1/email`. Data sent: API key, email envelope and content. SendLayer Terms: https://sendlayer.com/terms-of-service/ — SendLayer Privacy Policy: https://sendlayer.com/privacy-policy/

* **Brevo** — When configured, emails are sent via HTTPS POST to `https://api.brevo.com/v3/smtp/email`. Data sent: API key, email envelope and content. Brevo Terms of Service: https://www.brevo.com/legal/termsofuse/ — Brevo Privacy Policy: https://www.brevo.com/legal/privacypolicy/

* **ZeptoMail** — When configured, emails are sent via HTTPS POST to the regional endpoint you select (e.g. `https://api.zeptomail.com/v1.1/email`, with `eu`, `in`, `com.cn`, or `com.au` available). Data sent: Send Mail Token, email envelope and content. Zoho Terms of Service: https://www.zoho.com/zeptomail/terms.html — Zoho Privacy Policy: https://www.zoho.com/privacy.html

* **Default (PHP)** — No external service. Emails are handed to the PHP `mail()` function and routed by your server.

In addition, NimblyMail logs each outgoing email **locally** to a database table on your own WordPress site. No log data is ever transmitted off-site.

The Deliverability Health Audit performs DNS-only lookups for the configured sender domain. When the host's PHP `dns_get_record()` is unavailable or restricted, NimblyMail falls back to public DNS-over-HTTPS resolvers (`https://cloudflare-dns.com/dns-query` and `https://dns.google/resolve`) to retrieve SPF, DKIM, DMARC, and PTR records. Only the sender domain (and DKIM selector when applicable) is sent in the query — no mail content. Cloudflare DoH Privacy: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/ — Google Public DNS Privacy: https://developers.google.com/speed/public-dns/privacy

== Changelog ==

= 1.0.6 =
* Fixed: a provider outage during a batch send (e.g. a WooCommerce order run) being able to trigger one failure-alert email per recipient instead of a small bounded number
* Fixed: settings imported from WP Mail SMTP and Easy WP SMTP storing debug-event retention in the wrong unit, effectively disabling debug-log cleanup
* Fixed: importing a source plugin with no mailer configured silently switching a working NimblyMail setup to PHP mail()
* Fixed: the setup wizard's OAuth Connect step failing to save entered credentials before starting authorization, which could also discard wizard progress
* Fixed: dashboard extension widgets never loading their data when they appear after the dashboard's initial page load
* Fixed: network activation being able to time out and lose network-wide default settings on large multisite networks
* Improved: Outlook / Microsoft 365 settings import support — Outlook credentials can now be imported from WP Mail SMTP, Easy WP SMTP, and Fluent SMTP
* Improved: network activation on large multisite networks now provisions sites in the background instead of one request

= 1.0.5 =
* Security: Fixed the delivery-error admin notice exposing another user's email address and raw transport error to any logged-in user, not just administrators
* Security: Fixed the settings-import preview returning credentials in cleartext
* Security: Fixed a sub-site admin being able to read the main site's stored credentials via settings import on a multisite network
* Security: Fixed a network-wide settings save being able to leave every site's Developer Sandbox in an unsafe, incoherent state
* Security: Fixed network REST requests being able to stay pinned to the wrong site's data for the rest of a request if an error occurred mid-operation
* Fixed: 8 Email Controls toggles that pointed at the wrong WordPress hook and silently did nothing when disabled — some also produced PHP warnings and a false delivery-failure alert
* Fixed: Email Log and Network Dashboard timestamps being shifted by the server's UTC offset
* Fixed: the setup wizard letting an abandoned earlier edit override freshly-imported settings when backtracking to the Welcome step
* Improved: Network Dashboard stats aggregation so per-chunk work no longer grows with network size, preventing a possible stall on very large networks
* Improved: the Network Sites list to reflect a site's edited settings immediately instead of waiting up to 5 minutes
* Changed: documented the extension contract for Ant Design Vue components used by externally-registered Pro add-on components

= 1.0.4 =
* Security: Fixed the deliverability audit's connectivity check being usable to probe internal network addresses, including cloud metadata endpoints, from an admin account
* Security: Fixed OAuth access tokens leaking into debug logs for some accounts
* Fixed: the Developer Sandbox delivering mail live instead of failing safe when misconfigured, and its allowlist not protecting Cc/Bcc recipients
* Fixed: Fluent SMTP import storing encrypted credentials as unusable ciphertext, and importing an unsupported mailer silently falling back to PHP mail with no warning
* Fixed: the setup wizard discarding typed settings when choosing the Default PHP Mail option
* Fixed: 5 Email Controls toggles pointing at WordPress hooks that don't exist
* Fixed: network activation crashing with a fatal error
* Changed: Email Logs now default to a 90-day retention floor until you touch either cleanup method under Log Retention settings, so a site nobody has configured can no longer grow the log table without bound. Toggling a cleanup method and saving disables the default floor and respects your explicit choice from then on, until that section is reset to defaults. On upgrade, sites that already saved a cleanup preference keep it untouched; sites that never did will have log entries older than 90 days removed by the next scheduled cleanup, so save a preference first if you need to keep a longer history.
* Improved: Network Sites list and Network Dashboard performance on sites with many subsites
* Improved: reduced the admin JavaScript bundle size by loading Ant Design components on demand

= 1.0.3 =
* Fixed: the post-activation conflict notice no longer expires unseen if you spend more than 5 minutes in the setup wizard
* Fixed: queued emails that were interrupted by a server crash are now automatically resent instead of getting stuck
* Fixed: retrying a queued email that is already sending can no longer cause a duplicate send
* Fixed: a third-party plugin hook that throws an error after a successful send can no longer cause a duplicate send
* Fixed: a rare race during upgrade that could permanently disable the faster log search is now closed
* Improved: Email Logs search now uses the database's full-text index instead of scanning every stored email body
* Improved: admin pages preload their shared JavaScript libraries, reducing load time
* Security: hardened settings validation, closed an OAuth token-refresh race condition, and the Gmail/Outlook Client ID is now masked in the settings API like other credentials

= 1.0.2 =
* Fixed: the setup wizard now opens reliably after activation, and the mail-conflict notice is no longer lost when the wizard redirect runs
* Fixed: PHP deprecation warning when opening the setup wizard on PHP 8.1+
* Fixed: log rotation no longer causes a fatal error when Action Scheduler is unavailable
* Fixed: Resend and SendLayer transports no longer send blank recipients to the provider API
* Fixed: uninstall now removes all plugin options, user meta, and scheduled actions
* Improved: admin pages load faster thanks to shared vendor libraries being split into cacheable chunks
* Security: patched frontend dependency advisories and hardened the release process so development dependencies can never ship

= 1.0.1 =
* Maintenance release with compatibility tested up to WordPress 7.0.

= 1.0.0 =
* Initial release.
* Nine email providers: PHP mail, SMTP, Gmail OAuth, Outlook / Microsoft 365 OAuth, Amazon SES, Resend, SendLayer, Brevo, ZeptoMail.
* Comprehensive email logging with search, filters, and resend.
* Background queue with three-tier priority, exponential backoff retries, attachment staging, and admin retry/cancel tools.
* Developer Sandbox with Log Only and Redirect modes plus an allowlist for bypass addresses.
* Automated deliverability health audit covering SPF / DKIM / DMARC / PTR with mailer-aware requirements.
* Email controls to toggle 25+ WordPress notification emails.
* Failure alerts with CC/BCC support.
* AES-256-CBC credential encryption with HMAC-SHA256 verification.
* Per-install signed-refresh OAuth proxy protocol — leaked refresh tokens cannot be replayed against the proxy from arbitrary hosts.
* PHP constants support for wp-config.php overrides.
* Settings import from supported existing SMTP plugins.
* Guided setup wizard with auto-detection.
* Modern Vue 3 admin interface.

== Upgrade Notice ==

= 1.0.0 =
Initial release of NimblyMail.
