Keep mail passwords and API keys out of the database by defining CRM-NG SMTP settings in wp-config.php, with the full list of constants per mailer.

You can define CRM-NG SMTP's main settings in your site's wp-config.php file instead of on the settings screens. Secrets then never sit in the database, and nobody can change them from the admin area. This article lists every supported constant, mailer by mailer. It is for developers, agencies and hosts who manage sites through code.

Turn constants on

Constants are ignored until you add this line to wp-config.php, above the line that says "That's all, stop editing!":

define( 'CRMNG_SMTP_ON', true );

It must be exactly true. Then add the constants you need below it. Any setting you do not define keeps working from the screens.

What you see on the screens

Each field fixed by a constant is greyed out and cannot be edited. Underneath it reads: The value of this field was set using a constant followed by the constant's name, most likely inside wp-config.php of your WordPress installation. The real value of secrets is never displayed.

To change a fixed value, edit wp-config.php. To hand it back to the screen, delete the constant.

Sender and mailer

Constant	Setting	Example value
CRMNG_SMTP_MAILER	Mailer	'sendgrid'
CRMNG_SMTP_MAIL_FROM	From Email	'hello@example.com'
CRMNG_SMTP_MAIL_FROM_FORCE	Force From Email	true
CRMNG_SMTP_MAIL_FROM_NAME	From Name	'Example Shop'
CRMNG_SMTP_MAIL_FROM_NAME_FORCE	Force From Name	true
CRMNG_SMTP_SET_RETURN_PATH	Return Path	true

Mailer values: mail, sendlayer, smtpcom, sendinblue (Brevo), elasticemail, gmail, mailgun, mailjet, mailersend, mandrill, pepipostapi, postmark, resend, sendgrid, smtp2go, sparkpost, smtp (Other SMTP), amazonses, outlook (365 / Outlook), zoho.

Constants per mailer

Mailer	Constants
Other SMTP	CRMNG_SMTP_SMTP_HOST, CRMNG_SMTP_SMTP_PORT, CRMNG_SMTP_SSL ('' for none, 'ssl' or 'tls'), CRMNG_SMTP_SMTP_AUTH (true/false), CRMNG_SMTP_SMTP_AUTOTLS (true/false), CRMNG_SMTP_SMTP_USER, CRMNG_SMTP_SMTP_PASS
SendLayer	CRMNG_SMTP_SENDLAYER_API_KEY
SMTP.com	CRMNG_SMTP_SMTPCOM_API_KEY, CRMNG_SMTP_SMTPCOM_CHANNEL (Sender Name)
Brevo	CRMNG_SMTP_SENDINBLUE_API_KEY, CRMNG_SMTP_SENDINBLUE_DOMAIN (Sending Domain)
Elastic Email	CRMNG_SMTP_ELASTICEMAIL_API_KEY
Google / Gmail	CRMNG_SMTP_GMAIL_CLIENT_ID, CRMNG_SMTP_GMAIL_CLIENT_SECRET
Mailgun	CRMNG_SMTP_MAILGUN_API_KEY, CRMNG_SMTP_MAILGUN_DOMAIN, CRMNG_SMTP_MAILGUN_REGION ('US' or 'EU')
Mailjet	CRMNG_SMTP_MAILJET_API_KEY, CRMNG_SMTP_MAILJET_SECRET_KEY
MailerSend	CRMNG_SMTP_MAILERSEND_API_KEY, CRMNG_SMTP_MAILERSEND_HAS_PRO_PLAN (Professional Plan, true/false)
Mandrill	CRMNG_SMTP_MANDRILL_API_KEY
Pepipost	CRMNG_SMTP_PEPIPOST_API_KEY
Postmark	CRMNG_SMTP_POSTMARK_SERVER_API_TOKEN, CRMNG_SMTP_POSTMARK_MESSAGE_STREAM
Resend	CRMNG_SMTP_RESEND_API_KEY
SendGrid	CRMNG_SMTP_SENDGRID_API_KEY, CRMNG_SMTP_SENDGRID_DOMAIN (Sending Domain)
SMTP2GO	CRMNG_SMTP_SMTP2GO_API_KEY
SparkPost	CRMNG_SMTP_SPARKPOST_API_KEY, CRMNG_SMTP_SPARKPOST_REGION ('US' or 'EU')
Amazon SES	CRMNG_SMTP_AMAZONSES_CLIENT_ID (Access Key ID), CRMNG_SMTP_AMAZONSES_CLIENT_SECRET (Secret Access Key), CRMNG_SMTP_AMAZONSES_REGION (for example 'eu-west-1')
365 / Outlook	CRMNG_SMTP_OUTLOOK_TENANT_ID (Tenant ID), CRMNG_SMTP_OUTLOOK_CLIENT_ID (Application (Client) ID), CRMNG_SMTP_OUTLOOK_CLIENT_SECRET (Client Secret)
Zoho Mail	CRMNG_SMTP_ZOHO_DOMAIN (Data Center, for example 'zoho.eu'), CRMNG_SMTP_ZOHO_USER (Mailbox Email Address), CRMNG_SMTP_ZOHO_PASS (Application-Specific Password)

Other settings

Constant	Setting
CRMNG_SMTP_DO_NOT_SEND	Do Not Send on the Misc tab (true stops all email except tests)
CRMNG_SMTP_SUMMARY_REPORT_EMAIL_DISABLED	Disable Email Summaries (true or false)
CRMNG_SMTP_OPTIMIZED_EMAIL_SENDING_ENABLED	Optimize Email Sending (true or false)
CRMNG_SMTP_DEBUG_EVENTS_RETENTION_PERIOD	Events Retention Period on Tools → Debug Events, in seconds (for example 2628000 for one month)

The Alerts tab's addresses can be pinned too; a pinned field is greyed out on screen and the tab says which constants are in force.

Constant	Alerts field
CRMNG_SMTP_ALERT_EMAIL_SEND_TO	Alert email addresses (comma-separated)
CRMNG_SMTP_ALERT_CUSTOM_WEBHOOK_URL	Generic webhook URL
CRMNG_SMTP_ALERT_SLACK_WEBHOOK_URL, CRMNG_SMTP_ALERT_DISCORD_WEBHOOK_URL, CRMNG_SMTP_ALERT_TEAMS_WEBHOOK_URL	the chat webhook URLs
CRMNG_SMTP_ALERT_TWILIO_SMS_ACCOUNT_SID, CRMNG_SMTP_ALERT_TWILIO_SMS_AUTH_TOKEN, CRMNG_SMTP_ALERT_TWILIO_SMS_FROM_PHONE_NUMBER, CRMNG_SMTP_ALERT_TWILIO_SMS_TO_PHONE_NUMBER	Twilio SMS
CRMNG_SMTP_ALERT_WHATSAPP_ACCESS_TOKEN, CRMNG_SMTP_ALERT_WHATSAPP_PHONE_NUMBER_ID, CRMNG_SMTP_ALERT_WHATSAPP_TO_PHONE_NUMBER	WhatsApp Cloud API

The other settings on the Email Log, Smart Routing and Email Controls tabs, and the backup SMTP transport, have no constants; their secrets are stored encrypted.

The encryption key

Passwords and keys saved through the screens are encrypted with a key the plugin creates and stores in the database. To keep that key out of the database too, define your own:

define( 'CRMNG_SMTP_CRYPTO_KEY', 'exactly-32-characters-long-key!!' );

It must be exactly 32 characters. Use your own random value, not the example above. Set it before you save any secrets. If you add or change it later, values saved earlier can no longer be read, and you must enter them again.

A complete example

define( 'CRMNG_SMTP_ON', true );
define( 'CRMNG_SMTP_MAILER', 'sendgrid' );
define( 'CRMNG_SMTP_MAIL_FROM', 'hello@example.com' );
define( 'CRMNG_SMTP_MAIL_FROM_FORCE', true );
define( 'CRMNG_SMTP_MAIL_FROM_NAME', 'Example Shop' );
define( 'CRMNG_SMTP_SENDGRID_API_KEY', 'SG.your-key-here' );

Related

• Sharing credentials with support safely
• Miscellaneous settings
• Using Force From Email
• Using CRM-NG SMTP on a WordPress multisite
• Debug events