How to Set Up SMTP on a PHP Website

Many traditional, custom, and legacy PHP websites still rely on PHP’s native mail() function to send contact form submissions, registration confirmations, and customer order inquiries. However, the default PHP mail() function sends unauthenticated messages without standard SMTP handshakes, SPF alignment, or DKIM cryptographic signatures. As a result, major email providers like Google Gmail, Microsoft Outlook, and Yahoo frequently reject these emails or route them directly into the recipient’s Spam folder.

Configuring SMTP (Simple Mail Transfer Protocol) on your PHP website connects your application directly to an authenticated mail server using secure SSL/TLS encryption. This ensures high deliverability, prevents email spoofing, and guarantees that your website emails reach the recipient’s primary inbox.

In this comprehensive guide, we will walk you through setting up SMTP on a PHP website using the popular and reliable PHPMailer library. We cover both Composer installation (for modern PHP projects) and Manual installation (for legacy PHP websites without Composer), complete with full working code examples, input sanitization, and debugging tips.

Prerequisites

• An active Web Hosting account.
• A PHP website hosted on your server (see How to Host a PHP Website in DirectAdmin).
• A domain name configured (see How to Add a Domain Name in DirectAdmin) or a subdomain (see How to Create a Subdomain in DirectAdmin).
• Your domain pointed to Aveshost nameservers (refer to Where to find Aveshost nameservers).
• An active SSL certificate installed and HTTPS enforced (see How to Install an SSL Certificate in DirectAdmin and How to Force HTTP to HTTPS in DirectAdmin).
• A custom domain email account created (such as [email protected]; see How to Create an Email Account in DirectAdmin).

Standard SMTP Configuration Parameters

When connecting any PHP mail library to your hosting mail server, use the following standard parameters:

Method 1: Installing PHPMailer via Composer (Modern PHP)

Step 1: Install PHPMailer Package

In your PHP project root directory, run the following command via SSH terminal:

composer require phpmailer/phpmailer

Step 2: Create the Mail Sending Script (send_mail.php)

Create a script that autoloads Composer and initializes the PHPMailer client:

<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;

// Load Composer autoload
require 'vendor/autoload.php';

// Instantiate PHPMailer with Exceptions enabled
$mail = new PHPMailer(true);

try {
    // Server settings
    // $mail->SMTPDebug = SMTP::DEBUG_SERVER; // Uncomment for detailed debug output
    $mail->isSMTP();
    $mail->Host       = 'mail.domain.com';
    $mail->SMTPAuth   = true;
    $mail->Username   = '[email protected]';
    $mail->Password   = 'YourStrongPasswordHere';
    $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS; // Port 465 SSL
    $mail->Port       = 465;

    // Sender and recipient settings
    $mail->setFrom('[email protected]', 'Aveshost Support');
    $mail->addAddress('[email protected]', 'Valued Customer');
    $mail->addReplyTo('[email protected]', 'Support Team');

    // Email Content
    $mail->isHTML(true);
    $mail->Subject = 'Welcome to Our Website!';
    $mail->Body    = '<h2>Thank you for contacting us!</h2><p>This email was sent securely via authenticated SMTP on our PHP website.</p>';
    $mail->AltBody = "Thank you for contacting us! This email was sent securely via authenticated SMTP.";

    $mail->send();
    echo "Message has been sent successfully!";
} catch (Exception $e) {
    echo "Message could not be sent. Mailer Error: {$mail->ErrorInfo}";
}

Method 2: Installing PHPMailer Manually (Legacy PHP Websites)

If you have an older PHP website that does not use Composer or package managers, you can download PHPMailer directly and include the files manually:

1. Download the latest release zip of PHPMailer from GitHub (PHPMailer Releases).
2. Extract the archive and upload the src/ directory into your website’s public_html/phpmailer/ folder.
3. Include the three core files directly in your script:

<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;

// Manually require the three essential PHPMailer files
require 'phpmailer/Exception.php';
require 'phpmailer/PHPMailer.php';
require 'phpmailer/SMTP.php';

$mail = new PHPMailer(true);

try {
    $mail->isSMTP();
    $mail->Host       = 'mail.domain.com';
    $mail->SMTPAuth   = true;
    $mail->Username   = '[email protected]';
    $mail->Password   = 'YourStrongPasswordHere';
    $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
    $mail->Port       = 465;

    $mail->setFrom('[email protected]', 'Aveshost Support');
    $mail->addAddress('[email protected]');

    $mail->isHTML(true);
    $mail->Subject = 'Legacy PHP Website SMTP Test';
    $mail->Body    = '<p>Your custom PHP script is successfully sending authenticated SMTP emails!</p>';
    $mail->AltBody = 'Your custom PHP script is successfully sending authenticated SMTP emails!';

    $mail->send();
    echo "Message sent successfully!";
} catch (Exception $e) {
    echo "Error: {$mail->ErrorInfo}";
}

Real-World Contact Form Processor Example

Here is a complete, production-ready example of handling a contact form submission (contact_process.php) with input sanitization and error protection:

<?php
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\Exception;

require 'vendor/autoload.php'; // or manual require

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    // 1. Sanitize user inputs
    $senderName  = htmlspecialchars(strip_tags(trim($_POST["name"] ?? "")));
    $senderEmail = filter_var(trim($_POST["email"] ?? ""), FILTER_SANITIZE_EMAIL);
    $userSubject = htmlspecialchars(strip_tags(trim($_POST["subject"] ?? "New Contact Message")));
    $userMessage = htmlspecialchars(strip_tags(trim($_POST["message"] ?? "")));

    // 2. Validate required fields
    if (empty($senderName) || empty($userMessage) || !filter_var($senderEmail, FILTER_VALIDATE_EMAIL)) {
        die("Invalid form input. Please go back and ensure all fields are filled correctly.");
    }

    $mail = new PHPMailer(true);

    try {
        $mail->isSMTP();
        $mail->Host       = 'mail.domain.com';
        $mail->SMTPAuth   = true;
        $mail->Username   = '[email protected]';
        $mail->Password   = 'YourStrongPasswordHere';
        $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
        $mail->Port       = 465;

        // Set your verified domain email as the From address
        $mail->setFrom('[email protected]', 'Website Contact Form');
        
        // Set the user's email as the Reply-To address
        $mail->addReplyTo($senderEmail, $senderName);
        
        // Send notification to your inbox
        $mail->addAddress('[email protected]', 'Site Administrator');

        $mail->isHTML(true);
        $mail->Subject = "Contact Form: " . $userSubject;
        $mail->Body    = "<h3>New Message from {$senderName}</h3>
                          <p><strong>Email:</strong> {$senderEmail}</p>
                          <p><strong>Message:</strong><br>" . nl2br($userMessage) . "</p>";
        $mail->AltBody = "Name: {$senderName}\nEmail: {$senderEmail}\nMessage:\n{$userMessage}";

        $mail->send();
        echo "<p style='color: green;'>Thank you! Your message has been sent successfully.</p>";
    } catch (Exception $e) {
        echo "<p style='color: red;'>Sorry, an error occurred while sending your message. Please try again later.</p>";
    }
}

Security Best Practices for PHP SMTP

• Never hardcode passwords in public repository files: Store your SMTP credentials in an environment file (e.g. .env with vlucas/phpdotenv) or in a configuration file located outside the web root (e.g. /home/username/config.php).
• Always set setFrom() to your verified domain: Always set the setFrom() address to a mailbox that belongs to your domain (e.g. [email protected]), and place the user’s email into addReplyTo(). Sending emails with external domains (like `@gmail.com`) in the From header will fail SPF checks.
• Protect forms against spam bots: Add a CAPTCHA (such as Google reCAPTCHA v3 or Cloudflare Turnstile) or a hidden honeypot field to your HTML forms to prevent automated spam abuse.

Frequently Asked Questions & Troubleshooting

Q: Why do I get "SMTP Error: Could not authenticate"?
A: Double-check that your $mail->Username is your full email address (e.g. [email protected]) and that your password is correct. Also verify in DirectAdmin that the email account is not suspended.

Q: Why does the connection time out on port 465?
A: Ensure that your SMTPSecure parameter matches your port. Use Port 465 with PHPMailer::ENCRYPTION_SMTPS, or Port 587 with PHPMailer::ENCRYPTION_STARTTLS.

Q: How do I attach files to an email in PHPMailer?
A: Use the addAttachment() method: $mail->addAttachment('/path/to/uploaded/document.pdf', 'Invoice.pdf');.

Q: How can I enable detailed debugging when an email fails to send?
A: Add $mail->SMTPDebug = SMTP::DEBUG_SERVER; before $mail->send(). PHPMailer will print out the full SMTP client-to-server handshake conversation to help diagnose network or authentication issues.

Need Further Assistance?

If you encounter any issues configuring SMTP on your PHP website, troubleshooting contact form scripts, or verifying DNS authentication records, our technical support team is available 24/7. Feel free to submit a support ticket through your client area for expert assistance.