Gmail SMTP Setup: Create an App Password and Send Email From Your Website (Free)

Most web servers are bad at sending email. PHP’s mail () function often goes straight to spam, and many hosts block it or limit it heavily. A simple fix for a small site is to send through Gmail’s SMTP server using your Google account.

This guide covers:

• the Gmail SMTP settings,
• how to create an App Password (your normal Gmail password no longer works),
• setup for WordPress, OpenCart, PHP, Node.js and Python,
• sending limits, and whether you need to pay.

Do you need to pay for Gmail SMTP?

No. A free @gmail.com account can send email through smtp.gmail.com at no cost. You only need:

1. a Google account,
2. 2-Step Verification turned on,
3. an App Password.

The limits are what differ between free and paid:

	Free Gmail (you@gmail.com)	Google Workspace (paid, you@yourdomain.com)
Cost	Free	Paid per user per month (see Google’s Workspace pricing page)
SMTP server	smtp.gmail.com	smtp.gmail.com or smtp-relay.gmail.com
Daily sending limit	About 500 recipients per day	About 2,000 messages per day per user
“From” address	Your Gmail, or an alias you verified in Gmail	Your own domain
App Passwords	Yes, with 2-Step Verification	Only if your admin allows them

Pay for Google Workspace if you want email to come from your own domain with proper SPF/DKIM alignment, or if you need more than a few hundred emails a day.

Free Gmail is enough for contact forms, order notifications on a small shop, password resets on a small site, and admin alerts.

Use neither for newsletters or marketing email. Gmail SMTP is for transactional email. If you exceed the limits, Google blocks sending for up to 24 hours. Use a dedicated email service (Amazon SES, Brevo, Mailgun, Postmark, SendGrid) for bulk mail. Many of them have free tiers too.

Gmail SMTP settings

Setting	Value
SMTP server	smtp.gmail.com
Port (TLS / STARTTLS)	587 (recommended)
Port (SSL)	465
Authentication	Yes
Username	Your full Gmail address, e.g. yourname@gmail.com
Password	Your 16-character App Password (not your Gmail password)

Use port 587 with TLS or port 465 with SSL. Do not use port 25. Most hosting providers and home ISPs block it.

Why you need an App Password

Google turned off “Less secure app access” for personal accounts in May 2022. Apps that sign in with only a username and your normal password are refused. If you try, you get an error like:

535-5.7.8 Username and Password not accepted.
534-5.7.9 Application-specific password required.

An App Password is a 16-character password that Google generates for one app or device. It lets your website log in to SMTP without your real password, and you can revoke it at any time without changing your Google password.

Step 1: Turn on 2-Step Verification

App Passwords only appear once 2-Step Verification is on.

1. Go to myaccount.google.com/security.
2. Under How you sign in to Google, click 2-Step Verification.
3. Click Turn on and follow the steps (phone prompt, SMS code or authenticator app).

Step 2: Create the App Password

1. Go to myaccount.google.com/apppasswords. You can also search for “App passwords” in the search bar at the top of your Google Account page.
2. Sign in again if Google asks.
3. Enter a name you will recognise later, e.g. webocreation.com/ SMTP or OpenCart store.
4. Click Create.
5. Google shows a 16-character password in a yellow box, like abcd efgh ijkl mnop.
6. Copy it now. Google shows it only once. If you lose it, delete it and create a new one.

Google displays the password in groups of four. Enter it without the spaces: abcdefghijklmnop.

“The setting you are looking for is not available for your account”

If the App Passwords page shows this message, one of these is usually the reason:

• 2-Step Verification is off. Turn it on first (Step 1).
• Your 2-Step Verification uses only security keys. Add another method, such as a phone or authenticator app.
• Advanced Protection is on. App Passwords are not allowed with Advanced Protection.
• It is a work or school account and the administrator has disabled App Passwords. Ask your Workspace admin, or use OAuth (see the end of this post).

Good practice

• Create one App Password per website or app, so you can revoke one without breaking the others.
• When you change your Google password, all App Passwords are revoked. Create new ones and update your sites.
• Treat an App Password like a real password. It gives access to your mailbox. Keep it out of Git, front-end code and screenshots.
• Use a separate Gmail account for your website (e.g. noreply.yoursite@gmail.com) rather than your personal one. If the password leaks, your personal mail is safe.

Step 3: Add the settings to your website

WordPress

WordPress has no SMTP settings by default, so install an SMTP plugin such as WP Mail SMTP, FluentSMTP or Post SMTP. In the plugin:

• Mailer: Other SMTP (do not choose the “Google/Gmail” OAuth option if you are using an App Password)
• SMTP Host: smtp.gmail.com
• Encryption: TLS
• SMTP Port: 587
• Authentication: On
• SMTP Username: yourname@gmail.com
• SMTP Password: your App Password
• From Email: the same Gmail address

Most plugins have a Send a test email tab. Use it before relying on the setup.

If your plugin supports it, keep the password out of the database by defining it in wp-config.php. For WP Mail SMTP:

define( 'WPMS_ON', true );
define( 'WPMS_SMTP_PASS', 'abcdefghijklmnop' );

OpenCart

Go to System → Settings, edit your store and open the Mail tab:

• Mail Engine: SMTP
• SMTP Hostname: ssl://smtp.gmail.com
• SMTP Username: yourname@gmail.com
• SMTP Password: your App Password
• SMTP Port: 465
• SMTP Timeout: 5 (increase to 15 if you see timeouts)

On the General or Store tab, set the store E-Mail to the same Gmail address. If the store email is a different address, Gmail rewrites the “From” header or rejects the message.

Save, then place a test order or use the contact form to check that the email arrives.

Email is not working in Opencart – ways to solve

Plain PHP with PHPMailer

Install PHPMailer with Composer:

composer require phpmailer/phpmailer

<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;

require 'vendor/autoload.php';

$mail = new PHPMailer(true);

try {
    $mail->isSMTP();
    $mail->Host       = 'smtp.gmail.com';
    $mail->SMTPAuth   = true;
    $mail->Username   = 'yourname@gmail.com';
    $mail->Password   = getenv('GMAIL_APP_PASSWORD'); // keep it out of the code
    $mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
    $mail->Port       = 587;

    $mail->setFrom('yourname@gmail.com', 'Webocreation');
    $mail->addAddress('customer@example.com');
    $mail->addReplyTo('yourname@gmail.com');

    $mail->Subject = 'Test email from Gmail SMTP';
    $mail->Body    = 'It works!';

    $mail->send();
    echo 'Sent';
} catch (Exception $e) {
    echo 'Mailer error: ' . $mail->ErrorInfo;
}

To see the SMTP conversation while debugging, add $mail->SMTPDebug = 2;. Remove it in production.

Node.js with Nodemailer

npm install nodemailer

import nodemailer from 'nodemailer';

const transporter = nodemailer.createTransport({
  host: 'smtp.gmail.com',
  port: 587,
  secure: false, // true for port 465
  auth: {
    user: 'yourname@gmail.com',
    pass: process.env.GMAIL_APP_PASSWORD,
  },
});

await transporter.sendMail({
  from: '"Webocreation" <yourname@gmail.com>',
  to: 'customer@example.com',
  subject: 'Test email from Gmail SMTP',
  text: 'It works!',
});

Python

import os
import smtplib
from email.message import EmailMessage

msg = EmailMessage()
msg["From"] = "yourname@gmail.com"
msg["To"] = "customer@example.com"
msg["Subject"] = "Test email from Gmail SMTP"
msg.set_content("It works!")

with smtplib.SMTP("smtp.gmail.com", 587) as smtp:
    smtp.starttls()
    smtp.login("yourname@gmail.com", os.environ["GMAIL_APP_PASSWORD"])
    smtp.send_message(msg)

Test the connection from your server

If email fails, first check that your server can reach Gmail at all:

openssl s_client -connect smtp.gmail.com:465 -crlf -quiet

or, for port 587:

openssl s_client -starttls smtp -connect smtp.gmail.com:587 -crlf -quiet

A line starting with 220 smtp.gmail.com ESMTP means the connection works, and the problem is in your settings. If the command hangs or times out, your host is blocking outbound SMTP. Some cloud providers (DigitalOcean, AWS EC2, Google Cloud and others) block SMTP ports on new accounts by default. Ask their support to unblock it, or use an email service that sends over HTTPS.

Troubleshooting

Error / symptom	Cause	Fix
535-5.7.8 Username and Password not accepted	Wrong password, or you used your normal Gmail password	Use the App Password, without spaces
534-5.7.9 Application-specific password required	2-Step Verification is on but you used your normal password	Create and use an App Password
It worked before and suddenly fails with 535	You changed your Google password, which revoked all App Passwords	Create a new App Password
Connection timed out	Host blocks port 587/465, or wrong port/encryption pair	Test with openssl; use 587 + TLS or 465 + SSL
Could not connect to SMTP host in OpenCart	Hostname missing ssl:// for port 465	Use ssl://smtp.gmail.com with port 465
“From” shows your Gmail instead of your domain	Gmail rewrites From addresses you have not verified	Add the address under Gmail Settings → Accounts → Send mail as, or use Google Workspace
550 5.4.5 Daily user sending limit exceeded	Over the daily limit	Wait 24 hours; move bulk mail to a dedicated email service
Emails go to spam	Sending from a @gmail.com address on behalf of another domain	Send from the Gmail address itself, or use your own domain with SPF, DKIM and DMARC

Is there a more secure option than an App Password?

Yes. OAuth 2.0 (“Sign in with Google”) is what Google recommends. Your app never stores a password. It gets a token that can be limited to sending email only. WP Mail SMTP, FluentSMTP and Nodemailer all support Gmail OAuth, but setup takes longer: you create a project in Google Cloud Console, configure the OAuth consent screen and enable the Gmail API.

For a single small site or a test server, an App Password is the quickest option that works. For Google Workspace accounts, or where the admin has disabled App Passwords, use OAuth.

Summary

1. Gmail SMTP is free with a normal Gmail account. You pay only if you want Google Workspace for your own domain and higher limits.
2. Turn on 2-Step Verification, then create an App Password at myaccount.google.com/apppasswords.
3. Use smtp.gmail.com, port 587 (TLS) or 465 (SSL), your full Gmail address and the 16-character App Password.
4. Keep it for transactional email (about 500 recipients a day on free Gmail). Use a dedicated email service for newsletters.

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Comment *

Name *

Email *

Website

Δ