Master SMTP Developer Guide

Developer guide for Master SMTP covering plugin architecture, mailer providers, wp_mail handling, routing, logs, notifications, security, APIs, cron jobs, and extension workflows.

Plugin Structure

Master SMTP is organized into separate modules under `src/`.

Important folders:

master-smtp.php
src/
views/
assets/
languages/

Main responsibilities:

				
					src/Core/              Plugin boot, activation, capabilities, requirements
src/Admin/             Admin pages, actions, UI assets
src/Connections/       Connection storage, sanitization, validation
src/Mail/              wp_mail handling and PHPMailer integration
src/Mailers/           Mailer provider classes
src/Log/               Email log storage, cleanup, viewing
src/Stats/             Dashboard and email statistics
src/Notifications/     Error notification delivery
src/Cron/              Scheduled cleanup and summary emails
src/Security/          Secret encryption/decryption
src/Rest/              REST API routes

Secret Handling

Secrets are handled by:

				
					src/Security/Secrets.php

Credentials should be encrypted before storage.

Sensitive examples:

				
					SMTP passwords
API keys
OAuth client secrets
Access tokens
Webhook URLs
Telegram site secret

When importing settings from another site, encrypted secrets may not be reusable if the WordPress secret keys differ. In that case, the plugin should clear unsafe imported secrets and ask the admin to re-enter them.

Security Checklist

For any new feature, confirm:

User capability checks are present.
Nonces are used for admin actions.
REST/AJAX endpoints validate permissions.
Inputs are sanitized.
Outputs are escaped.
Secrets are encrypted.
Secrets are not logged.
Secrets are not sent to notification channels.
External requests use WordPress HTTP APIs where possible.

Release Checks

Before releasing a new version:

Run PHP syntax checks.
Run JavaScript syntax checks.
Activate the plugin on a test WordPress site.
Send a successful test email.
Force a failed email and confirm logging.
Test import/export with saved secrets.
Test routing if routing changed.
Test summary email if notification code changed.
Test Telegram token generation, verification, and test message if Telegram changed.
Confirm version numbers match in master-smtp.php, readme.txt, and translation metadata.
Confirm no backend-only files, test files, logs, database dumps, or credentials are included in the plugin package.