poppydev

Very interesting read – thank you.

Very silly of WordPress updating the core function that effects the mailing system, more so if thousands of plugins rely on it for admin or mailer responders.

They do need to resolve this in a patch as most users might rely on this method of contact by security plugins and or internal communication if logging errors etc. Forcing users to install additional plugins is just a poor excuse, and ads bloat. Or they need to setup SPF policies with the host (which I would be surprised if not already).

I know my mail boxes are setup correctly for each domain, both by the host and office 365. The issue I have is I am using a forwarder to another email from my host mailbox to my 365 mailbox. All have their SPF setup correctly for all domains or I wouldn’t have been getting emails at all in 365.

So the best solution for me (and possibly many others) is this

function use_no_sender( $phpmailer ) {
$phpmailer->Sender = “”;
}

add_action( ‘phpmailer_init’, ‘use_no_sender’ );

It now allows me to receive emails from WordPress when using Solid Security and have a custom email for the authenticator. Same goes for other plugins I use that send reports. These stopped until the above was added in a function.php.

I know many cannot do this out of the box but Solid Security should have an option to allow this to be added if users are not receiving emails all of a sudden, rather then adding additional plugins or expecting someone to know where this goes.

I can assume WordPress have had a large amount of complaints since this has been removed. I get they have made it secure but not all hosts/plugin developers have catered for this change yet, or aware of it effecting them.

Nice to see them caring but at the same time also being careless.

• This reply was modified 5 months, 4 weeks ago by poppydev.

Hi,

I have confirmed a reproducible issue affecting Solid Security’s email-based 2FA after updating WordPress to version 6.9.Summary of the Issue

After updating to WordPress 6.9, Solid Security’s email authentication / 2FA emails no longer send, even when:

• The domain has correct SPF, DKIM, and DMARC
• The mailbox exists and receives normal emails
• WordPress core emails (password reset etc.) work
• Other plugins using SMTP (e.g., Piotnet Forms) send emails successfully
• The hosting provider (Fasthosts) confirms no mail blocks or filtering

This issue occurs across multiple websites and is isolated only to Solid Security’s 2FA email method.

Technical Cause

WordPress 6.9 includes a major update to PHPMailer, introducing stricter RFC compliance for sending emails.

Specifically:1. The “From” address must match the authenticated mailbox

PHPMailer now rejects or blocks emails when the plugin sets:

• A dynamic From address
• A From address that does not match the authenticated mailbox
• A From address without explicit $phpmailer->Sender

Solid Security’s 2FA email currently relies on WordPress’ default wp_mail() without setting an aligned, authenticated From address.2. $phpmailer->Sender is now required for many hosts

WordPress 6.9’s PHPMailer enforces that the Sender address must be explicitly set.
Solid Security does not set this, so mail hosts (including Fasthosts, SiteGround, IONOS, GoDaddy, Hostinger, etc.) reject the message entirely.3. Other plugins work because they set proper SMTP headers

Form builders and SMTP plugins correctly set:

• The authenticated sending mailbox
• The From address
• The Sender header
• SPF/DKIM-aligned headers

Solid Security’s 2FA email does not, which is why only this feature fails after WP 6.9.

Why This Is a Solid Security Compatibility Bug

This is not a hosting, server, WordPress, or user configuration issue.

It is a plugin-level compatibility issue caused by Solid Security continuing to rely on older PHPMailer behaviour that WordPress 6.9 no longer supports.

To restore functionality, Solid Security needs to:

$headers[] = ‘From: “Site Security” [email protected]‘;
$phpmailer->Sender = ‘[email protected]’;

Or provide a setting to force a specific From/Sender mailbox.

• This reply was modified 6 months ago by poppydev.

Spoke to soon. The bug has come back again. Thought it might have been the link I mentioned previously.

You’re welcome. Look forward to the update :).

Ok I got it working by disabling all plugins and activating one at a time, starting with yours, then security plugins and all others.

The only issue I have found on your plugin is when I try and flush the cache with the green cloud icon on WP top menu.

When I hover over the icon and click on “Purge whole cache”.

URL on link: /wp-admin/admin.php?page=super-page-cache-settings#

I get the error: “Error: undefined Cannot read properties of null (reading ‘innerText’)”

Same for “Purge this page only” link.

Everything else looks to be working for now.

• This reply was modified 10 months, 3 weeks ago by poppydev.
• This reply was modified 10 months, 3 weeks ago by poppydev.
• This reply was modified 10 months, 3 weeks ago by poppydev.
• This reply was modified 10 months, 3 weeks ago by poppydev.

Why not follow the route below to secure this without removing access to .htaccess etc:

1. Role-Based Access Control
   Only allow access to sensitive files like .htaccess, wp-config.php, .env, etc., for users with the administrator role or a custom capability (e.g., filester_manage_sensitive_files).
2. Optional Password Prompt (Re-authentication)
   Prompt users to enter their WordPress password before accessing/editing protected files. This is a common pattern in WordPress (e.g., exporting personal data or changing site settings).
3. Developer Override (for advanced users)
   Add a constant or filter to allow controlled override, like: phpCopyEditdefine('FILESTER_ALLOW_HTACCESS_EDIT', true); or phpCopyEditadd_filter('filester_allow_htaccess_edit', '__return_true');

This approach keeps things locked down by default for most users but still provides developers and advanced admins with the flexibility they need — especially since files like wp-config.php are still editable in the current version.

• This reply was modified 1 year ago by poppydev.
• This reply was modified 1 year ago by Jan Dembowski.