How to Send WordPress Emails with Gmail SMTP (and Fix It After a Password Change)

You can send WordPress emails through Gmail or Google Workspace with an SMTP plugin like WP Mail SMTP. The plugin connects to your Google account with OAuth: you create a small app in Google Cloud, paste its Client ID and Client Secret into WordPress, and click Allow. After that, every form notification and WooCommerce email goes out through Gmail.

The setup takes about half an hour the first time. The part most guides skip is what happens later: in my experience, the most common reason a Gmail setup suddenly stops sending is that someone changed the Gmail password. Google then cancels the plugin's access, and you have to authorize the plugin again. This guide covers both the setup and the fixes.

If your site does not use Gmail at all, start with the general guide: WordPress not sending emails.

Quick steps: Gmail SMTP in WordPress

1. Install WP Mail SMTP and choose the Google / Gmail mailer.
2. In Google Cloud Console, create a project and enable the Gmail API.
3. Fill in the OAuth consent screen, and set it to In production.
4. Create an OAuth client ID (Web application) with the plugin's redirect URI.
5. Paste the Client ID and Client Secret into WP Mail SMTP and save.
6. Click Allow plugin to send emails using your Google account.
7. Send a test email.

Which method should you use?

Step 1: Choose the Gmail mailer in WP Mail SMTP

1. Install and activate WP Mail SMTP, then open WP Mail SMTP > Settings.
2. From Email: the Gmail or Workspace address you will connect.
3. Mailer: Google / Gmail. A Google / Gmail section appears with fields for the Client ID and Client Secret, and a redirect URI you will need in a minute.

Before you go to Google, sign out of other Google accounts in that browser, or use a private window. It avoids authorizing the wrong account by accident, which is easy to do when you manage several clients.

Step 2: Create the Google Cloud project and enable the Gmail API

1. Open Google Cloud Console with the account that will send the emails.
2. Click the project dropdown at the top and choose New project. Give it a clear name, such as Website mail - yourdomain.com, and click Create.
3. Go to APIs & Services > Library, search for Gmail API, open it and click Enable.

Step 3: Set up the OAuth consent screen

1. On the Gmail API page, click Create credentials, choose Gmail API and User data, and click Next.
2. Fill in the App name (anything, for example your site name), the User support email, and your email under the developer contact.
3. Save and continue through the Scopes step.

Set the app to "In production", not "Testing"

This step is easy to miss, and it causes a problem that shows up a week later.

• Free Gmail: under OAuth consent screen, the publishing status shows Testing. Click Publish app and confirm, so it shows In production.
• Google Workspace: the app may be set to Internal. On the Audience tab, use Make external and choose In production.

Why it matters: Google gives an app in Testing mode a refresh token that expires after 7 days when it asks for Gmail access. Your emails work for a week and then stop with an invalid_grant error. Publishing the app removes that limit. You do not need Google's verification for this; you just click through the "This app isn't verified" screen when authorizing, because it is your own app.

Step 4: Create the OAuth client ID

1. Go to APIs & Services > Credentials > Create credentials > OAuth client ID.
2. Application type: Web application.
3. Leave Authorized JavaScript origins empty.
4. Under Authorized redirect URIs, click Add URI and paste the redirect URI shown in WP Mail SMTP (for the free plugin it is https://connect.wpmailsmtp.com/google/).
5. Click Create. Copy the Client ID and Client Secret.

A common mistake is pasting the URI under JavaScript origins instead of redirect URIs. Google then shows "URIs must not contain a path", and if the redirect URI is missing or different, you get redirect_uri_mismatch when authorizing.

Step 5: Connect WordPress to Gmail

1. Paste the Client ID and Client Secret into WP Mail SMTP, with no extra spaces, and click Save Settings.
2. Scroll down and click Allow plugin to send emails using your Google account.
3. Sign in with the same account, and click Allow.
4. On free Gmail, you may see "Google hasn't verified this app". Click Advanced, then Go to ... (unsafe), then Allow. It is your own app, so this is expected.

Then go to WP Mail SMTP > Tools > Email Test and send a test email.

Emails stopped after a password change? Re-authorize the plugin

This is the problem I see again and again: the site sent emails through Gmail for months, then someone changed the Gmail password (or turned 2-Step Verification on or off), and from that day no form emails arrive.

It is not a bug. Google automatically revokes OAuth tokens that have Gmail access when the account password changes. That includes the token WP Mail SMTP uses, so the plugin can no longer send. In the email log or the test email, you usually see:

invalid_grant: Token has been expired or revoked.

How to reconnect

1. Open WP Mail SMTP > Settings and scroll to the Google / Gmail section.
2. Click Remove Connection (or Reconnect, depending on the plugin version).
3. Click Allow plugin to send emails using your Google account, sign in with the new password, and click Allow.
4. Save, and send a test email.

Make this part of your routine: whenever the Gmail password of the sending account changes, reconnect the website the same day. If the site belongs to a client who changes passwords themselves, tell them, or they will lose form leads without noticing.

If reconnecting does not work

• invalid_grant with "Bad Request": the Client Secret may no longer be valid. In Google Cloud, open Credentials, edit the OAuth client, click Add secret, paste the new secret into WP Mail SMTP, save and reconnect. Delete the old unused secret.
• 403 access_denied, "the developer hasn't given you access": the app is still in Testing. Publish it (Step 3).
• 403 org_internal: the Workspace app is Internal and you are signing in with an account outside that organisation.
• "Could not json decode the token": another plugin loads its own Google library (backup plugins that connect to Google Drive can do this). Temporarily deactivate it and test again.

Other reasons Google cancels the connection

A password change is the most common, but the token also stops working when:

• the app is in Testing mode (the 7-day expiry above);
• the token is not used for six months, for example on a site whose form gets no submissions;
• someone removes the app's access in the Google account under Security > Third-party apps;
• Google detects unusual activity on the account;
• a Workspace admin restricts Gmail access for third-party apps.

The fix is the same each time: reconnect, and send a test email.

Alternative: Other SMTP with a Gmail App Password

If you do not want to create a Google Cloud app, you can use Other SMTP with an App Password:

1. Turn on 2-Step Verification in the Google account.
2. Open myaccount.google.com/apppasswords, create an app password for the website, and copy the 16-character code.
3. In WP Mail SMTP choose Other SMTP with host smtp.gmail.com, SSL on port 465 (or TLS on 587), authentication on, the full Gmail address as username and the App Password as password.

Two limits to know:

• Google revokes App Passwords when the account password changes, so you have the same problem as with OAuth: create a new App Password and paste it in.
• The App Passwords option is not available on every account, for example some work or school accounts, accounts with Advanced Protection, or accounts using only security keys.

Your normal Gmail password does not work in Other SMTP. If you try it, you get "SMTP Error: Could not authenticate".

Can a service account avoid re-authorizing?

I looked into this because reconnecting after every password change is annoying on client sites. The short answer: yes, but only with Google Workspace, and not with the usual free plugins.

A service account is a Google Cloud "robot" account. With domain-wide delegation, a Workspace admin allows it to send mail as a real user of the domain (for example [email protected]). Because it signs in with its own key, not with the user's password, a password change does not cancel it.

How it is set up, in short:

1. In Google Cloud, create a service account (IAM & Admin > Service Accounts) and a key for it. Some organisations block key creation with a policy that an admin must allow.
2. In the Google Admin console, go to Security > Access and data control > API controls > Manage Domain Wide Delegation, click Add new, and enter the service account's Client ID with the Gmail scope (https://mail.google.com/ for SMTP). It can take up to 24 hours to work.
3. The sending code uses the key to get an access token on behalf of the mailbox and sends with that.

The limits:

• It needs Google Workspace and a super admin. A free @gmail.com account cannot do this.
• The service account can act as any user in the domain for that scope, so the key must be kept very safe. If someone steals it from your server, they can send mail as anyone in the company.
• The popular free WordPress SMTP plugins (WP Mail SMTP, FluentSMTP, Easy WP SMTP) connect with a normal account sign-in, not a service account key. You need a plugin that explicitly supports a service account JSON key, or a developer to add it.

For most small sites, the normal Gmail mailer plus a habit of reconnecting after password changes is simpler and safer. A service account makes sense for a company on Workspace that runs many sites, or where passwords are changed often by policy.

Gmail limits to keep in mind

• Gmail has daily sending limits (lower for free Gmail than for Workspace). A normal contact form is nowhere near them, but a site that sends newsletters or many WooCommerce emails can be. Use a transactional email service for bulk sending.
• The From address must be the connected account or one of its aliases set up in Gmail. If you want to send from several aliases, do not tick Force From Email.
• If you send from your own domain through Google Workspace, set up SPF and DKIM for Google in your DNS, or the mail may land in spam.

Frequently asked questions

Why did WordPress stop sending Gmail emails after I changed my password?

Google automatically revokes OAuth tokens with Gmail access when the password changes. Open WP Mail SMTP, remove or reconnect the Google connection, and allow access again.

What does "invalid_grant: Token has been expired or revoked" mean?

The plugin's permission to use Gmail is no longer valid. The usual causes are a password change, an app left in Testing mode (7-day limit), access removed in the Google account, or the token not being used for six months. Reconnect the plugin.

Can I use my normal Gmail password for SMTP?

No. Use the plugin's Google / Gmail mailer, or an App Password with 2-Step Verification turned on.

Do I need to verify my Google app?

No, not for your own website. Set the app to In production and click through the "unverified app" warning when you authorize it.

Does a service account stop the re-authorization problem?

Yes, on Google Workspace with domain-wide delegation, because it does not depend on the user's password. It needs admin access, careful key storage, and a plugin or code that supports it.