Create, bind and deliver each message code safely
-
1
Use a dedicated plugin
Build or install the integration as a protected WordPress plugin, preferably a must-use plugin. Do not paste an API key into a theme, page builder, browser script or email template.
-
2
Limit the verified sender
Apply the integration only when the final From address and sender domain match the issued High Security seal. Decide explicitly whether password resets, store notices and contact-form mail are included.
-
3
Integrate at the PHPMailer layer
Use WordPress’s phpmailer_init hook or a custom mail transport that can set PHPMailer MessageID, call VerifySeal, add the returned custom header and modify both Body and AltBody before preSend and DKIM signing.
-
4
Fail closed for selected mail
If the API call fails, stop or queue the selected High Security message for retry. Log only the send ID and error state; never log the API key or private message content.
-
5
Check SMTP plugin ordering
SMTP and delivery plugins can replace WordPress’s PHPMailer transport, headers or Message-ID. Test the exact production plugin combination after every mail-plugin change.
-
6
Verify an external WordPress message
Trigger a real transactional email to an external mailbox and inspect its original source for the preserved Message-ID, VEM header/footer and passing aligned DKIM/DMARC.