← All installation guides High Security Email Integrations

Set up High Security email on WordPress transactional email

Use a protected WordPress mailer plugin or gateway integration; an email signature or page-builder snippet cannot issue per-message VEM codes.

WP✉
Recommended methodServer-side per-message API
Trusted-server integration

Create, bind and deliver each message code safely

  1. 1

    Use a dedicated plugin

    Build or install the integration as a protected WordPress plugin, preferably a must-use plugin. Do not paste an API key into a theme, page builder, browser script or email template.

  2. 2

    Limit the verified sender

    Apply the integration only when the final From address and sender domain match the issued High Security seal. Decide explicitly whether password resets, store notices and contact-form mail are included.

  3. 3

    Integrate at the PHPMailer layer

    Use WordPress’s phpmailer_init hook or a custom mail transport that can set PHPMailer MessageID, call VerifySeal, add the returned custom header and modify both Body and AltBody before preSend and DKIM signing.

  4. 4

    Fail closed for selected mail

    If the API call fails, stop or queue the selected High Security message for retry. Log only the send ID and error state; never log the API key or private message content.

  5. 5

    Check SMTP plugin ordering

    SMTP and delivery plugins can replace WordPress’s PHPMailer transport, headers or Message-ID. Test the exact production plugin combination after every mail-plugin change.

  6. 6

    Verify an external WordPress message

    Trigger a real transactional email to an external mailbox and inspect its original source for the preserved Message-ID, VEM header/footer and passing aligned DKIM/DMARC.

Open WordPress phpmailer_init hook documentation ↗
High Security still requires domain authentication

A VEM code does not replace SPF, DKIM or DMARC

The sender domain must continue to publish a valid SPF record, the selected DKIM key and a DMARC policy. VerifySeal automatically rechecks these records according to the administrator schedule. For High Security messages, DKIM must cover the final Message-ID, VEM header and completed body.

  • SPF authorizes sending services
  • DKIM verifies the signed message domain
  • DMARC publishes the domain policy
Testing checklist

Confirm the installation is working

01

Message-ID

The exact final Message-ID is created before the API request and matches the sent email.

02

VEM code

The returned header and footer are present and the public verification link opens.

03

DKIM last

The receiving service reports an aligned DKIM and DMARC pass after all content was inserted.

04

Revocation

Revoking the test code immediately changes its public status.

Platform notes
  • A normal WordPress email-signature plugin can display the Low Security seal, but it cannot safely create a High Security code without trusted server-side mailer access.
  • Use one idempotency key per WordPress send or queue job so a retry returns the same VEM code.