# Securing settings with wp-config constants

Source: https://catalystgroup.gg/docs/email-delivery/secure-settings-constants/
Updated: 2026-10-20 · By Duane Garner

Keep mail passwords and API keys out of the database by defining CRM-NG SMTP settings in wp-config.php, with the full list of constants per mailer.

You can define CRM-NG SMTP's main settings in your site's `wp-config.php` file instead of on the settings screens. Secrets then never sit in the database, and nobody can change them from the admin area. This article lists every supported constant, mailer by mailer. It is for developers, agencies and hosts who manage sites through code.

 

## Turn constants on

 

Constants are ignored until you add this line to `wp-config.php`, above the line that says "That's all, stop editing!":

 

```
define( 'CRMNG_SMTP_ON', true );
```

 

It must be exactly `true`. Then add the constants you need below it. Any setting you do not define keeps working from the screens.

 

## What you see on the screens

 

Each field fixed by a constant is greyed out and cannot be edited. Underneath it reads: **The value of this field was set using a constant** followed by the constant's name, **most likely inside wp-config.php of your WordPress installation.** The real value of secrets is never displayed.

 

To change a fixed value, edit `wp-config.php`. To hand it back to the screen, delete the constant.

 

## Sender and mailer

 

| Constant | Setting | Example value |
| --- | --- | --- |
| CRMNG_SMTP_MAILER | Mailer | 'sendgrid' |
| CRMNG_SMTP_MAIL_FROM | From Email | 'hello@example.com' |
| CRMNG_SMTP_MAIL_FROM_FORCE | Force From Email | true |
| CRMNG_SMTP_MAIL_FROM_NAME | From Name | 'Example Shop' |
| CRMNG_SMTP_MAIL_FROM_NAME_FORCE | Force From Name | true |
| CRMNG_SMTP_SET_RETURN_PATH | Return Path | true |

 

Mailer values: `mail`, `sendlayer`, `smtpcom`, `sendinblue` (Brevo), `elasticemail`, `gmail`, `mailgun`, `mailjet`, `mailersend`, `mandrill`, `pepipostapi`, `postmark`, `resend`, `sendgrid`, `smtp2go`, `sparkpost`, `smtp` (Other SMTP), `amazonses`, `outlook` (365 / Outlook), `zoho`.

 

## Constants per mailer

 

| Mailer | Constants |
| --- | --- |
| Other SMTP | CRMNG_SMTP_SMTP_HOST, CRMNG_SMTP_SMTP_PORT, CRMNG_SMTP_SSL ('' for none, 'ssl' or 'tls'), CRMNG_SMTP_SMTP_AUTH (true/false), CRMNG_SMTP_SMTP_AUTOTLS (true/false), CRMNG_SMTP_SMTP_USER, CRMNG_SMTP_SMTP_PASS |
| SendLayer | CRMNG_SMTP_SENDLAYER_API_KEY |
| SMTP.com | CRMNG_SMTP_SMTPCOM_API_KEY, CRMNG_SMTP_SMTPCOM_CHANNEL (Sender Name) |
| Brevo | CRMNG_SMTP_SENDINBLUE_API_KEY, CRMNG_SMTP_SENDINBLUE_DOMAIN (Sending Domain) |
| Elastic Email | CRMNG_SMTP_ELASTICEMAIL_API_KEY |
| Google / Gmail | CRMNG_SMTP_GMAIL_CLIENT_ID, CRMNG_SMTP_GMAIL_CLIENT_SECRET |
| Mailgun | CRMNG_SMTP_MAILGUN_API_KEY, CRMNG_SMTP_MAILGUN_DOMAIN, CRMNG_SMTP_MAILGUN_REGION ('US' or 'EU') |
| Mailjet | CRMNG_SMTP_MAILJET_API_KEY, CRMNG_SMTP_MAILJET_SECRET_KEY |
| MailerSend | CRMNG_SMTP_MAILERSEND_API_KEY, CRMNG_SMTP_MAILERSEND_HAS_PRO_PLAN (Professional Plan, true/false) |
| Mandrill | CRMNG_SMTP_MANDRILL_API_KEY |
| Pepipost | CRMNG_SMTP_PEPIPOST_API_KEY |
| Postmark | CRMNG_SMTP_POSTMARK_SERVER_API_TOKEN, CRMNG_SMTP_POSTMARK_MESSAGE_STREAM |
| Resend | CRMNG_SMTP_RESEND_API_KEY |
| SendGrid | CRMNG_SMTP_SENDGRID_API_KEY, CRMNG_SMTP_SENDGRID_DOMAIN (Sending Domain) |
| SMTP2GO | CRMNG_SMTP_SMTP2GO_API_KEY |
| SparkPost | CRMNG_SMTP_SPARKPOST_API_KEY, CRMNG_SMTP_SPARKPOST_REGION ('US' or 'EU') |
| Amazon SES | CRMNG_SMTP_AMAZONSES_CLIENT_ID (Access Key ID), CRMNG_SMTP_AMAZONSES_CLIENT_SECRET (Secret Access Key), CRMNG_SMTP_AMAZONSES_REGION (for example 'eu-west-1') |
| 365 / Outlook | CRMNG_SMTP_OUTLOOK_TENANT_ID (Tenant ID), CRMNG_SMTP_OUTLOOK_CLIENT_ID (Application (Client) ID), CRMNG_SMTP_OUTLOOK_CLIENT_SECRET (Client Secret) |
| Zoho Mail | CRMNG_SMTP_ZOHO_DOMAIN (Data Center, for example 'zoho.eu'), CRMNG_SMTP_ZOHO_USER (Mailbox Email Address), CRMNG_SMTP_ZOHO_PASS (Application-Specific Password) |

 

> **Fields that stay on the screen:** For Google / Gmail, the constants hold the app details, but you still press the authorisation button on screen once.

 

## Other settings

 

| Constant | Setting |
| --- | --- |
| CRMNG_SMTP_DO_NOT_SEND | Do Not Send on the Misc tab (true stops all email except tests) |
| CRMNG_SMTP_SUMMARY_REPORT_EMAIL_DISABLED | Disable Email Summaries (true or false) |
| CRMNG_SMTP_OPTIMIZED_EMAIL_SENDING_ENABLED | Optimize Email Sending (true or false) |
| CRMNG_SMTP_DEBUG_EVENTS_RETENTION_PERIOD | Events Retention Period on Tools → Debug Events, in seconds (for example 2628000 for one month) |

 

The **Alerts** tab's addresses can be pinned too; a pinned field is greyed out on screen and the tab says which constants are in force.

 

| Constant | Alerts field |
| --- | --- |
| CRMNG_SMTP_ALERT_EMAIL_SEND_TO | Alert email addresses (comma-separated) |
| CRMNG_SMTP_ALERT_CUSTOM_WEBHOOK_URL | Generic webhook URL |
| CRMNG_SMTP_ALERT_SLACK_WEBHOOK_URL, CRMNG_SMTP_ALERT_DISCORD_WEBHOOK_URL, CRMNG_SMTP_ALERT_TEAMS_WEBHOOK_URL | the chat webhook URLs |
| CRMNG_SMTP_ALERT_TWILIO_SMS_ACCOUNT_SID, CRMNG_SMTP_ALERT_TWILIO_SMS_AUTH_TOKEN, CRMNG_SMTP_ALERT_TWILIO_SMS_FROM_PHONE_NUMBER, CRMNG_SMTP_ALERT_TWILIO_SMS_TO_PHONE_NUMBER | Twilio SMS |
| CRMNG_SMTP_ALERT_WHATSAPP_ACCESS_TOKEN, CRMNG_SMTP_ALERT_WHATSAPP_PHONE_NUMBER_ID, CRMNG_SMTP_ALERT_WHATSAPP_TO_PHONE_NUMBER | WhatsApp Cloud API |

 

The other settings on the **Email Log**, **Smart Routing** and **Email Controls** tabs, and the backup SMTP transport, have no constants; their secrets are stored encrypted.

 

## The encryption key

 

Passwords and keys saved through the screens are encrypted with a key the plugin creates and stores in the database. To keep that key out of the database too, define your own:

 

```
define( 'CRMNG_SMTP_CRYPTO_KEY', 'exactly-32-characters-long-key!!' );
```

 

It must be exactly 32 characters. Use your own random value, not the example above. Set it **before** you save any secrets. If you add or change it later, values saved earlier can no longer be read, and you must enter them again.

 

## A complete example

 

```
define( 'CRMNG_SMTP_ON', true );
define( 'CRMNG_SMTP_MAILER', 'sendgrid' );
define( 'CRMNG_SMTP_MAIL_FROM', 'hello@example.com' );
define( 'CRMNG_SMTP_MAIL_FROM_FORCE', true );
define( 'CRMNG_SMTP_MAIL_FROM_NAME', 'Example Shop' );
define( 'CRMNG_SMTP_SENDGRID_API_KEY', 'SG.your-key-here' );
```

 

> **Protect wp-config.php:** `wp-config.php` now holds live credentials. Keep it out of version control and public backups, and make sure your server never serves it as a file.

 

## Related

 
- [Sharing credentials with support safely](https://catalystgroup.gg/docs/email-delivery/sharing-credentials-safely/)
- [Miscellaneous settings](https://catalystgroup.gg/docs/email-delivery/misc-settings/)
- [Using Force From Email](https://catalystgroup.gg/docs/email-delivery/force-from-email/)
- [Using CRM-NG SMTP on a WordPress multisite](https://catalystgroup.gg/docs/email-delivery/multisite/)
- [Debug events](https://catalystgroup.gg/docs/email-delivery/debug-events/)