What MailPoet does on your site
MailPoet turns WordPress into an email marketing tool. You build newsletters in a drag-and-drop editor with mobile-friendly templates, schedule them or send them right away, and can have new blog posts emailed to subscribers automatically. Subscribers and lists live in your own WordPress database, and you can import them from a CSV file or straight from Mailchimp.
On the front end, the plugin adds signup forms below content, as a fixed bar, a popup, a slide-in, on exit intent or through a shortcode, plus an opt-in checkbox in comments, WordPress registration and WooCommerce checkout. On a store, it sends abandoned cart, first purchase and specific product emails, and lets you restyle WooCommerce transactional emails.
MailPoet is owned by Automattic, the company behind WooCommerce. The free plugin works for up to 1,000 subscribers when you send through your own method (your host or an SMTP service), with MailPoet branding in your emails. MailPoet plans add the MailPoet Sending Service, which signs emails with SPF and DKIM and removes bouncing addresses automatically; paid plans then add advanced segmentation, detailed statistics and automations with conditions.
Which sites MailPoet is a good fit for
MailPoet makes sense when you want to run your email marketing without leaving the dashboard:
- Blogs and publishing sites: automatic new post notifications, filterable by category or tag, save you from putting together a newsletter every time you publish.
- WooCommerce stores: abandoned cart reminders, first purchase emails and checkout opt-in are all part of the free version.
- Nonprofits and small organizations: a list of a few hundred subscribers fits in the free plan, and MailPoet advertises a 20% discount on paid plans for nonprofits.
It is not the right pick for a multisite network (MailPoet says multisite support is limited), or if you would rather hand lists and sending to an outside platform: Brevo or Mailchimp keep that data out of your database. For a simpler, fully free setup, also look at The Newsletter Plugin.
MailPoet strengths and limitations
Strengths
- Everything inside WordPress. Emails, lists, forms and basic statistics are all handled from the MailPoet menu, with no third-party account needed.
- Tight WooCommerce integration. Abandoned cart, product or category based emails and branded transactional emails are free.
- Your choice of sending method. Your host, SMTP, SendGrid, Amazon SES or the MailPoet Sending Service: you are not locked into one platform.
- Built-in form protection. A built-in CAPTCHA by default, or reCAPTCHA and Cloudflare Turnstile, with no extra anti-spam plugin.
Limitations
- Advanced features cost extra. Multi-condition segmentation, detailed statistics, Google Analytics integration and branching automations require a paid plan.
- Tight free limits. 1,000 subscribers with your own sending method, or 500 subscribers and 5,000 emails per month with the MailPoet Sending Service.
- Pricing scales with your list. Paid plans go up with the number of subscribers, and you need the Agency plan for more than one site.
- Sends through your host by default. Out of the box, MailPoet uses your web server, a method MailPoet itself advises against.
The MailPoet settings we recommend
All of these settings exist in the current free version, under MailPoet > Settings. Save each tab, then run the checks below.
| Setting | Recommended value | Why |
|---|---|---|
| Sending method MailPoet > Settings > Send With... | MailPoet Sending Service or an SMTP service, rather than "Your web host / web server" | Shared hosting throttles sending and hurts deliverability; a dedicated service authenticates your emails. |
| Default sender MailPoet > Settings > Basics | An address on your own domain | A Gmail or Outlook address as sender fails authentication checks (SPF, DKIM, DMARC) and often lands in spam. |
| Enable sign-up confirmation MailPoet > Settings > Sign-up Confirmation | Yes (default) | Double opt-in proves consent and filters out fake addresses; it is mandatory with the MailPoet Sending Service. |
| Delete unconfirmed subscribers Same tab | After 30 days | Stops you from keeping addresses that never agreed to hear from you. |
| Protect your MailPoet forms against spam signups MailPoet > Settings > Advanced | Built-in CAPTCHA (default) or Cloudflare Turnstile | Blocks bots that sign up addresses in bulk; Turnstile needs a free key from Cloudflare. |
| Stop sending to inactive subscribers MailPoet > Settings > Advanced | After 12 months (default), or 6 months if you send at least twice a month | Emailing addresses that never open anything damages your sender reputation. |
| Engagement analytics tracking MailPoet > Settings > Advanced | Partial, if your cookie banner does not cover MailPoet | The default Full level sets cookies on your site; Partial still tracks opens and clicks. |
| Load 3rd-party libraries MailPoet > Settings > Advanced | Off (default) | When on, the editors load Google Fonts and other external services. |
- On the Send With... tab, use "Send a test email" to a Gmail inbox and make sure it does not land in spam.
- Sign up with a test address on your own form: the confirmation email should arrive, then the subscriber should show as "Subscribed" under MailPoet > Subscribers.
- If you already send through an SMTP service set up with WP Mail SMTP, check that MailPoet uses the same method and the same sender.
- On the Advanced tab, leave the task scheduler on "Action Scheduler (recommended)": scheduled newsletters should go out on time.
MailPoet security: patched flaws, mostly on the admin side
According to the Patchstack database, no known vulnerability affects the current version of MailPoet. Every flaw published in recent years has been patched, and several of them required an administrator account. The ones worth knowing:
- CVE-2026-57626, fixed in 5.33.1: a CSRF flaw in versions 5.30.0 to 5.33.0; an attacker with no account could trigger an action by tricking a logged-in user (CVSS 7.1 according to Patchstack).
- Reflected XSS, fixed in 5.14.2: exploitable without an account through a crafted link, according to Patchstack (CVSS 7.1).
- SQL injection through the sort_by parameter, fixed in 5.22.4: it required an administrator account.
- CVE-2024-12743, fixed in 5.5.2: stored XSS in some settings, limited to administrators but a concern on multisite, where they are not always allowed to post unfiltered HTML.
MailPoet ships a new version almost every week, so turn on auto-updates for it under Plugins (see our guide to plugin auto-updates). WP Masquerade Pro removes part of MailPoet’s footprint from your page code, which makes it harder for bots hunting its flaws to spot it, without replacing updates.
What WP Masquerade hides for MailPoet
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to MailPoet: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
MailPoetForm - CSS classes
mailpoet_form, mailpoet_*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
MailPoet FAQ
Is MailPoet really free?
Yes, the plugin is free for up to 1,000 subscribers when you send with your own method, with MailPoet branding in your emails. The Starter plan, also free, adds the MailPoet Sending Service for up to 500 subscribers and 5,000 emails per month.
How much do MailPoet’s paid plans cost?
For 500 subscribers, the pricing page shows €8 per month for Creator (without the sending service), €10 for Business and €30 for Agency, which covers 50 sites. Prices rise with the number of subscribers, and paying yearly saves up to 15%.
Do I need an SMTP plugin on top of MailPoet?
Not for newsletters: MailPoet can send through SMTP, SendGrid, Amazon SES or its own service. An SMTP plugin is still useful for WordPress’s other emails, such as password resets, unless you also route those transactional emails through MailPoet.
Can I show past newsletters on my site?
Yes: the Basics tab in the settings gives you an archive shortcode to paste into a page, which lists the newsletters you have already sent.