In 2026, a site that sends mail through Gmail SMTP has only two workable options: turn on 2-Step Verification and then create an app password, or switch to OAuth 2.0. Filling in the Gmail sign-in password no longer works, and online guides that still tell people to enable less secure apps are out of date.
A typical company site can finish this in three steps: enable 2-Step Verification, obtain a 16-character app password, and enter smtp.gmail.com in the admin panel. The sections below follow that order and also cover sending quotas and common failures.
Connect the mail path so form notices reach the inbox
SMTP (Simple Mail Transfer Protocol) is the protocol that carries messages out, much like the site's mail carrier. Contact-form receipts, order confirmations, and password-reset messages all depend on it.
Many sites send by default through the host's built-in mail() function. Those messages lack sender authentication, so they often land in spam or are rejected outright.
In client conversations, a familiar story comes up: the site has been live for half a year, and only later does anyone notice that inquiry mail never arrived. The cause is usually an unset delivery path. After switching to Gmail SMTP, Google verifies the sender, and messages are much more likely to reach the inbox.
Password-only sign-in for sending mail is fully retired
Google has phased out Less Secure Apps, meaning third-party programs that sign in with only an account name and password:
| When | What changed | Who was affected |
|---|---|---|
| 2022-05-30 | External apps that sign in with only a password were no longer supported | Personal Google accounts |
| Summer 2024 | New connections were blocked, and admins could not turn the option back on | Google Workspace |
| 2025 | SMTP, IMAP, and POP stopped accepting ordinary passwords (app passwords still allowed) | Google Workspace |
| 2026, now | Only an app password or OAuth 2.0 remains available | All accounts |
For Workspace, Google first announced a cutoff of 14 March 2025, then moved it to 1 May. Both dates have passed, and the outcome is the same: site mail must use a method that is still allowed.
Check Gmail SMTP sending quotas before you configure
Google's published limits are roughly as follows. After a limit is exceeded, sending can be paused for up to 24 hours; receiving is not affected:
| Item | Personal Gmail | Google Workspace |
|---|---|---|
| Messages per day | 500 | 2,000 per user (rolling 24 hours) |
| Recipients per message | 500 | 100 when sent over SMTP |
| Recipients per day | Not published | 10,000 total (3,000 external) |
| Trial accounts | Not applicable | 500 per day |
| Best fit | Form alerts on a small site | Sites that send order or member mail |
For contact-form notices on a typical company site, 500 messages a day on personal Gmail is usually enough. Bulk newsletters should not use Gmail SMTP; use a dedicated sender such as Mailchimp or SendGrid.
Step one: turn on Google 2-Step Verification
2-Step Verification means that, after the password, sign-in also requires a phone check. Without it, an app password cannot be created.
- Sign in to the Google account that will send the mail
- Open Google Account, then Security
- Find 2-Step Verification and finish the phone check on screen
- Choose Google prompt or an authenticator app
- When the status shows On, this step is done
Watch step 4: if the account uses only a security key, the app-password option will not appear. Add at least one more verification method.
Turning on 2-Step Verification is not only for sending mail; it is a basic account safeguard. For a wider view, see the site security guide.
Step two: create a 16-character app password
An app password is a 16-character password made for programs that cannot use Google sign-in, such as a site admin panel. It is not the password you use to open Gmail.
- Open myaccount.google.com/apppasswords directly in the browser
- If you cannot find it, search for App passwords at the top of the Google Account page
- Enter a label you will recognize, such as company site mail
- Choose Create; a 16-character password appears
- Copy and store it immediately, because it is shown only once
Remove spaces before pasting into the site
Google displays the password in four groups, for example abcd efgh ijkl mnop. When entering it in the site settings, drop the spaces and use abcdefghijklmnop. Some plugins treat the spaces as part of the password and then fail authentication.
Three common reasons the app password is hidden
| Cause | What to do |
|---|---|
| 2-Step Verification uses only a security key | Also add a Google prompt or an authenticator app |
| The account is in the Advanced Protection Program | App passwords are unavailable; use OAuth 2.0 |
| A company or school Workspace account | Ask an admin to confirm access, or use SMTP relay |
Step three: enter SMTP parameters in the site admin
WordPress, Laravel, and other systems all need the same fields:
| Parameter | Value |
|---|---|
| SMTP host | smtp.gmail.com |
| Port | 587 (TLS, preferred) or 465 (SSL) |
| Encryption | TLS with 587, SSL with 465 |
| SMTP username | The full Gmail or Workspace address |
| SMTP password | The 16-character app password from the previous step |
| Sender name | Company name or site name |
| Sender address | The same address as the SMTP username |
The From address should match the SMTP account
Set the sender address to the SMTP account itself. To send from another address, add and verify it in Gmail under Send mail as.
The port must correspond to the encryption method
Pair 587 with TLS and 465 with SSL. A mismatch usually times out. After saving, send a test message to yourself, and combine this with site SSL certificate setup so form data stays encrypted in transit.
Use an app password on ordinary sites; use OAuth 2.0 for integrations
Google's position is clear: prefer Sign in with Google or OAuth 2.0 when you can. App passwords are not recommended and are unnecessary in most cases. When a site admin panel can only store an SMTP username and password, though, an app password is still the most direct fix.
| Situation | Suggested approach | Why |
|---|---|---|
| WordPress or Laravel admin filled in directly | App password | No extra code; mail works once the fields are saved |
| Engineered integrations or a SaaS product | OAuth 2.0 | Changing the Google password does not break the grant, and scopes can be limited |
| The company uses Google Workspace | SMTP relay at smtp-relay.gmail.com | IP-based auth, no password, up to 10,000 recipients per user per day |
SMTP relay is the sending method Google prefers for Workspace. An admin must allow specific IPs in the Admin console, which suits a host with a fixed IP.
When sending fails, troubleshoot by symptom
Authentication errors usually mean a bad password
The usual mistake is entering the Gmail sign-in password. Use the 16-character app password instead, and make sure no extra spaces remain.
It used to work, then stopped: check for a password change
Changing the Google account password immediately revokes every app password. In practice this often happens when someone leaves and HR resets the sending account. Form notices stop, and nobody notices for about a week.
Two safer habits help: send from a shared company account rather than a personal one, and regenerate the app password whenever the account password changes.
If mail never arrives, add SPF, DKIM, and DMARC
Ask the recipient to check spam, and confirm the address was typed correctly. If you send from your own domain, add sender-authentication records in DNS.
Since 1 February 2024, Google has applied the following rules to mail sent to Gmail:
| Rule | All senders | Bulk senders (more than 5,000 messages a day to personal Gmail) |
|---|---|---|
| SPF and DKIM | At least one is required | Both are required |
| DMARC | Not required | Required; p=none is allowed |
| TLS in transit | Required | Required |
| Spam rate | Under 0.3% | Under 0.3%, ideally under 0.1% |
| One-click unsubscribe | Not required | Required for marketing mail |
Mail that fails these checks may go to spam or bounce. Messages from an @gmail.com address are signed by Google; a Workspace mailbox on your own domain needs an admin to turn on DKIM.
Over the daily cap, move to Workspace or a newsletter service
Above 500 messages a day, personal Gmail shows a sending-limit error and recovers in 1 to 24 hours. If volume stays above the cap, upgrade to Google Workspace or use a newsletter service. Regular site maintenance and monitoring also helps you notice delivery problems sooner.
After you finish setup, remember these three points
Configuring Gmail SMTP itself takes only three steps. After launch, problems usually come from these three points:
- Send from a shared company account: a departing employee who changes the password will not cut off every site notice.
- Regenerate the app password whenever the password changes: a new Google password immediately invalidates the old app password.
- Set SPF and DKIM on your own domain: Google expects this of every sender.
For other build details, see the full site-setup guide.
Many owners fix delivery and only then notice that nobody submits the form. Traffic without inquiries often points to the form itself; see form optimization and what to do when traffic brings no inquiries.
