PHPMailer not working on a live server

One message for many problems

The form works on your laptop. You upload it, press Send, and get SMTP Error: Could not connect to SMTP host. Your code did not change, so something about the server did.

To see how many different problems hide behind that line, we ran PHPMailer 7.1.1 on PHP 8.3 in fresh containers on our own server and broke the setup on purpose, one thing at a time. The port and encryption cases went to Gmail's real mail server. Each of them fails before PHPMailer sends a login, so no password left the box. The certificate and password cases went to a test mail server we ran next to it.

Four of the eight rows end in the same “Could not connect” sentence. They have different causes and different fixes, so the first job is to find out which one you have.

Turn on SMTPDebug first

PHPMailer's own troubleshooting guide says level 2, SMTP::DEBUG_SERVER, “is usually the setting you want”. It prints both sides of the conversation, and in our runs it was the only place the real reason appeared. For a blocked port it said Connection timed out (110) after 10 seconds. For the typo in the host name it said Connection refused (111) straight away. The exception text was the same for both.

Send the debug output to the error log rather than the page, because on a live site the visitor would otherwise see your server's conversation, and turn it off again when you are done.

$mail->SMTPDebug = SMTP::DEBUG_SERVER;   // 2: both sides of the conversation
$mail->Debugoutput = 'error_log';          // to the PHP error log, not the visitor's screen

// What the extra lines told us that getMessage() did not:
//   SMTP ERROR: Failed to connect to server: Connection timed out (110)   <- a firewall drops the port
//   SMTP ERROR: Failed to connect to server: Connection refused (111)     <- wrong host, or nothing listens

The host blocks outgoing SMTP

Many shared hosts stop their customers' sites from connecting to outside mail servers, because a hacked site on the same machine would otherwise send spam from their addresses. PHPMailer's wiki describes hosts that “block outbound SMTP to ports 25, 465 and 587 to all servers except their own”. Cloud servers often block port 25 too.

The sign is a timeout: send() sits for as long as Timeout allows and then fails. Leave the default and that can be minutes, which is why a contact form “hangs” before it errors. You can test the port from the server itself with nc -vz smtp.gmail.com 587 or by asking your host. If it is blocked, you have three ways out: use the host's own SMTP server with an address on your domain, ask the host to open the port, or send through an email service's HTTP API, which goes over port 443 like any web request.

Port 465 or 587, and the matching encryption

Port 465 starts encrypted from the first byte. Port 587 starts in plain text and switches to encryption with the STARTTLS command. PHPMailer has a setting for each, and its wiki is blunt about mixing them: “SMTPS on port 587 or SMTP_STARTTLS on port 465 will not work.”

In our test the 465 mix-up was the slower one. PHPMailer connected, waited 10 seconds for a greeting the server was never going to send in plain text, and gave up. The 587 mix-up failed at once. If you switch TLS off completely, Gmail answers with its own words: Must issue a STARTTLS command first and code 530.

$mail->isSMTP();
$mail->Host       = 'smtp.gmail.com';
$mail->SMTPAuth   = true;
$mail->Username   = 'you@gmail.com';
$mail->Password   = getenv('SMTP_APP_PASSWORD');  // a Google app password, never your normal one
$mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
$mail->Port       = 587;                         // or ENCRYPTION_SMTPS with 465, never mixed
$mail->Timeout    = 10;                          // fail in 10 s, not in 5 minutes
$mail->setFrom('you@gmail.com', 'Contact form'); // the account you log in with
$mail->addReplyTo($visitorEmail);                // the visitor goes here, not in From

Gmail: an app password, and the From address

Gmail no longer accepts your normal account password from a script. You need an app password, a 16-character code that Google's help page says works only “with accounts that have 2-Step Verification turned on”. Work and school accounts often cannot create one at all, and then the answer is the admin's SMTP relay or OAuth, which PHPMailer supports.

A wrong or missing app password gives SMTP Error: Could not authenticate., and with debug on you will see Gmail's 535 line. Our guide to Gmail SMTP error 535 goes through that one in detail. Keep the From address to the account you log in with and put the visitor's address in Reply-To, or Gmail may swap it for your own address and other providers may file the message as spam.

“certificate verify failed”

PHP checks the mail server's certificate, and the check fails when the certificate is for a different name than the one you connected to. On shared hosting that usually means you used localhost or the server's IP, while the certificate is issued to something like mail.yourhost.com. Use the exact host name your provider gives you for SMTP.

Many answers online tell you to switch verification off with SMTPOptions. In our test that did make the message go through, which is why people keep recommending it. PHPMailer's wiki says it “defeats much of the point of using a secure transport at all”. Use it for a minute to confirm the diagnosis, then fix the host name.

“Could not instantiate mail function”

This one is not SMTP at all. Without isSMTP(), PHPMailer uses PHP's mail(), which needs a mail program on the server. Our container had none, and PHPMailer failed instantly. Switching to SMTP fixes it. Our guide to PHP mail() not sending email explains why mail() is a poor choice for a contact form even when it does work.

If you would rather not run mail from PHP

A contact form does not have to send mail from your server. A form backend receives the post and sends the email itself, so blocked ports, app passwords and certificates stop being your problem. With Formgong the form stays plain HTML: point action at the endpoint and every message is emailed to you, kept in an inbox, and can go to Telegram or Google Sheets.

<form action="https://formgong.com/submit" method="POST">
  <input type="hidden" name="access_key" value="fk_your_access_key">
  <input type="text" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">
  <label>Name <input name="name" required></label>
  <label>Email <input type="email" name="email" required></label>
  <label>Message <textarea name="message" required></textarea></label>
  <button type="submit">Send</button>
</form>

Seeing a PHPMailer error we did not list?

Send us the exact message and your host at support@formgong.com. We will reproduce it and add a row to the table.

What Formgong's free plan includes

• Build the form or bring your own. The form builder takes the colours and fonts from your site's address, with no sign-up; ready form templates copy into your account; AI writes the fields from one sentence. Any hand-written HTML form works too.
• Websites with the form already connected. 28 free website templates post to Formgong out of the box.
• 250 submissions a month on unlimited forms. Spam does not count. Once a year, a busy month keeps delivering on credit until the 7th instead of stopping.
• Everywhere you work. Email to up to 3 people at once, Telegram with Reply and Handled buttons, Google Sheets, Notion, and 3 signed webhooks for Slack, Discord, Zapier, Make or n8n.
• Emails to your customers in your business's name. Formgong sends them under your business name and replies come back to you, with no email service of your own to set up: a review request to every lead, a reminder a visitor asked for, and review emails after an order with your logo and colours. People who agree can also go straight into your Mailchimp, Klaviyo, Brevo, MailerLite or Kit list. An automatic reply to each visitor is on Pro.
• No captcha needed. A server-side spam filter, a honeypot, allowed domains and a block list; add your own Turnstile key if you want one.
• Files and voice. Visitors can attach files, or record a voice message that arrives transcribed.
• Made for AI-built sites. A hosted form page and a contact button; step-by-step guides for sites built with Lovable, Bolt, v0, Replit and Base44; an MCP server lets Cursor or Claude wire the form for you.
• See what the form does. Analytics for views, starts, conversion and where each lead came from, and an alert when a form goes quiet.
• One account for the rest. Customer reviews and an AI help chat that answers visitors from your own pages, with every message in one inbox. Data is stored in the EU.