What the check looks at
F4 looks at how WordPress sends mail. An active SMTP plugin the plugin knows means mail goes out through a service. Any other code hooked into phpmailer_init or pre_wp_mail means mail is probably set up some other way; the two hooks that only shape the message (a multisite Message-ID fix in core and WooCommerce’s multipart handling) are not counted. Otherwise WordPress uses PHP mail().
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | Mail goes out through an SMTP service The address of your server does not travel in the message headers. |
| InfoConfidence: Medium | Mail goes out straight from your server WordPress sends mail with PHP mail(), so the address of your server can appear in the headers. Anybody who receives a password reset or an order email can read it there. |
| InfoConfidence: Low | Mail sending is probably set up on this site Code hooks into how WordPress sends mail. The plugin cannot tell how it is sent, so it does not say whether the address travels in the headers. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- None on the site. The address is visible to anyone who opens the full headers of a message the site sent.
Why it happens
Cloudflare hides the server for web traffic only. Mail sent from the server itself is delivered from the server’s own address, and receiving mail servers record where a message came from in its headers.
Confirm it by hand
Send yourself a password reset or a test message from the site, open it, and view the original message or full headers. Look for your server’s address in the Received lines.
How to fix it
In WordPress: send mail through an SMTP service or a transactional mail provider with an SMTP plugin. That keeps the server address out of your mail.
In Cloudflare: nothing to change; mail does not pass through the proxy.
Limitations
F4 looks at settings and hooks, not at a real message. Whether the address appears depends on your mail setup, which is why the result is Info.
Related checks
- F2 DNS records revealing your server: DNS records that reveal the server.
- F1 Mail host behind the proxy: incoming mail and the proxy.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.