Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
IT Security Toolsboha v0.20.2(20.09.2026 um 16:32 Uhr)
IT Security Toolscyberbro v0.15.0(20.09.2026 um 17:32 Uhr)
IT Security NachrichtenUS, China seek Xi-Trump summit deliverables in New York talks(20.09.2026 um 16:34 Uhr)
Sicherheitslücken (CVE)Gyazo Server Vulnerability Targeted to Steal Millions of User Records(20.09.2026 um 17:02 Uhr)
IT Security NachrichtenHearth and Hamlet Review (PC)(20.09.2026 um 16:40 Uhr)
IT Security NachrichtenKI knackt Weltkriegs-Funkspruch - Historiker irrten sich 108 Jahre lang(20.09.2026 um 16:41 Uhr)
IT Security Toolsboha v0.20.2(20.09.2026 um 16:32 Uhr)
IT Security Toolscyberbro v0.15.0(20.09.2026 um 17:32 Uhr)
IT Security NachrichtenUS, China seek Xi-Trump summit deliverables in New York talks(20.09.2026 um 16:34 Uhr)
Sicherheitslücken (CVE)Gyazo Server Vulnerability Targeted to Steal Millions of User Records(20.09.2026 um 17:02 Uhr)
IT Security NachrichtenHearth and Hamlet Review (PC)(20.09.2026 um 16:40 Uhr)
IT Security NachrichtenKI knackt Weltkriegs-Funkspruch - Historiker irrten sich 108 Jahre lang(20.09.2026 um 16:41 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

WPForms not sending email notifications — three ways leads vanish quietly

Reagiere als Erste:r — dein Feedback zählt!

WPForms is a good plugin, and most "not sending email" advice for it is the same generic SMTP checklist you have already read. So let's skip that and start with the three failures that are specific to WPForms, all of which share one property: the visitor sees a success message, and you receive nothing.

Failure 1: the entry was marked as spam — so no email is sent

This is the one that surprises people, and it is documented behaviour. From WPForms' own documentation on spam entries:

"After enabling this option, the form will allow all submissions (including spam entries) instead of blocking them. However, form notification emails won't be delivered if an entry is identified as spam."wpforms.com — Viewing and Managing Spam Entries

Read the consequence carefully. A real customer fills in your client's form. Akismet or the built-in anti-spam decides, on some heuristic, that they are a bot. The customer sees "Thanks for contacting us!" and goes about their day, satisfied. The entry lands in a Spam folder inside WordPress. No notification is sent to anyone. Nobody knows this happened unless someone thinks to open the spam tab.

Marking the entry "Not Spam" afterwards does send the notification — retroactively, once you have found it. Which requires knowing to look.

Failure 2: background sending, and a queue that stopped

WPForms has an option called Optimize Email Sending. Instead of sending during the submission request, it queues the notification through Action Scheduler and sends it in the background. Faster form, better user experience — with a dependency most people never think about: WP-Cron.

WordPress's scheduler is not a real cron. It fires when someone visits the site. On a low-traffic client site — exactly the kind of site whose owner is anxious about enquiries — the queue can sit for a long time. If Action Scheduler is unhealthy or WP-Cron is disabled without a real cron replacement, queued notifications may never go out at all.

The form still says "success", because from the form's point of view it did its job: it put the email in a queue. WPForms' own troubleshooting docs suggest turning this option off while diagnosing missing notifications — which tells you how often it is the culprit. And it is a good reminder that a stalled WP-Cron breaks far more than plugin updates.

Failure 3: on Lite, the lead does not exist anywhere else

"WPForms does not store entries without a paid license, but you can back them up remotely using Lite Connect… Since WPForms Lite doesn't save entries to your WordPress database, Lite Connect gives you a place to store them safely off your site."wpforms.com — Lite Connect

On Lite, the email is the delivery mechanism. There is no database copy to fall back on. If the notification fails for any of the reasons above, the enquiry is gone — no entry, no record, no way to know it ever happened. (Lite Connect keeps an off-site backup, but restoring it into your dashboard requires upgrading.)

This matters for agencies: a client on Lite who says "we've had no enquiries for a month" may have had thirty, all of which evaporated.

The usual suspects, briefly

These apply to every WordPress form plugin, WPForms included, and they are well covered elsewhere — so, briefly:

  • No SMTP. WPForms sends via wp_mail(), which by default hands off to PHP mail() on your host. Unauthenticated, unaligned with SPF or DKIM, from a shared IP. Modern mail providers filter or drop that.
  • From address outside your domain. WPForms' docs ask for a domain-specific From address. The visitor's address goes in Reply-To, never From.
  • Host blocks or throttles mail(). Common, and deliberate — hosts do it to stop compromised sites spamming.
  • Notification switched off or gated by conditional logic. Check the notification is Active and the conditions actually match.
  • It arrived in the spam folder of the recipient. Every log says "sent". The client says "nothing".

Why "the SMTP log says Sent" is not an answer

People reach for an email log and feel safe. Here is what a log actually certifies, in WP Mail SMTP's own words:

Sent — "The email was sent successfully. This status does not tell you whether the email was delivered."wpmailsmtp.com — How to View Email Logs

There is a Confirmed status, but it only exists for mailers with delivery webhooks, and even then it means the provider handed the message to the recipient's mail server. It does not mean the message is in the inbox rather than the junk folder, and it certainly does not mean a human saw it.

So the honest hierarchy of what each tool proves:

The only check that closes the loop

There is exactly one way to know that a lead reaches a human: send one, and then look in the mailbox for it.

That is what our form monitoring does. On a schedule it submits a synthetic lead through the real form, with a unique marker in the body, and then searches a monitored mailbox over IMAP for that marker. If it turns up, the entire chain is proven end to end — the plugin, the anti-spam rules, wp_mail(), SMTP authentication, the recipient's filters. If it doesn't turn up in the expected window, you get an alert.

It is not a clever check. It is the check a careful person would run by hand, if a careful person were willing to do it every hour and never forget. The reason it matters is that none of the other signals in this article can catch a spam-flagged entry, a stalled queue, or a message quietly filed into Junk — and those are exactly the failures that cost your client a month of enquiries before anyone notices.

FAQ

Why does WPForms show success but send no notification?

Three WPForms-specific reasons: the entry was flagged as spam (documentation states notification emails are not delivered for spam entries, while the visitor still sees success); background sending queued the email and the queue stalled; or the mail was sent unauthenticated and dropped by the receiving server.

Does WPForms Lite store entries?

No — entries are not stored without a paid license. Lite Connect backs them up remotely, but restoring into the dashboard requires upgrading. On Lite, a failed email means the lead is gone.

What is Optimize Email Sending?

It queues notifications through Action Scheduler instead of sending during the request. If WP-Cron or Action Scheduler is unhealthy — common on low-traffic sites — queued emails can be badly delayed or never sent, while the form reports success.

Does an SMTP log prove the lead arrived?

No. WP Mail SMTP's docs state the Sent status "does not tell you whether the email was delivered". Confirmed exists only for mailers with webhooks, and means handoff to the recipient's server — not inbox versus junk.

Originally published at pingvera.com.

Originally published at pingvera.com.

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten WPForms not sending email notifications — three ways leads vanish quietly

Thematisch verwandte Begriffe: WPForms, sending, email, notifications · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-93956 | A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by thi…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick