Email Health Chk guide

What your server needs

• WordPress 5.8 or newer and PHP 7.4 or newer.
• Outbound DNS lookups from the server (TXT, MX, A and the rest). The whole analysis depends on them.
• Outbound connections on port 25 for the mail server checks (STARTTLS and the certificate). Many hosting and cloud providers block that port: the rest of the analysis still runs.
• WordPress able to send email (the verification codes and the reports go out by email).

Put the tool on a page Required

Create or edit a page and add the shortcode [email_health]. Publish it. That is enough for the free analysis. See The tool on your site.

Connect an AI provider (required for the report)

The analysis works without AI. The written report does not: without an AI key, a visitor who asks for it gets an error. In Email Health Chk > Settings, under AI Provider, pick Google Gemini, OpenAI or an OpenAI-compatible service and paste its key. See AI provider.

Check it is protected

Without a check against bots, anyone can script your tool and spend your AI credits and your server time. The built-in check is on with nothing to set up; if you prefer Cloudflare Turnstile, choose it in Settings and paste its two keys. See Cloudflare Turnstile.

Decide how the report travels Recommended

The report goes by email as a PDF made by Gotenberg, a converter you host yourself. Set its address in Settings > Gotenberg, or switch the attachment to HTML in Email Reports if you cannot run it. In Email Reports, also put your name, logo and colors on the PDF and, if you want, your own SMTP server. See PDF with Gotenberg and Email Reports.

Check the addresses people give you Recommended

In Email Verification, add a Reoon or Emailit key so the plugin confirms that an address is real before it sends a code or a report to it. See Email Verification.

Hear about new leads Optional

In Notifications, turn on an email alert or a webhook (Microsoft Teams works too) for each new lead or critical finding. See Notifications.

Sell your help Optional

In Sales Pitch, write the card that offers your services after the results, in the report email and in the PDF. See Sales Pitch.

Make it yours Optional

Colors and texts of the tool in Customize Widget, the dark Console look in Settings > Widget Style, a floating button on every page in Settings > Global Popup / FAB, terms and a usage limit in Settings. See Customize Widget, Floating button, Terms and conditions and Usage wall settings.

Check that everything is green

Open Email Health Chk > Plugin Info. The Subsystem Status tiles show what is configured and what is not. Then analyze a domain you know on your page and ask for its report with your own email. See Plugin Info.

The visitor asks for it

Under the results, the visitor writes their email and presses "Send My Briefing →" (in the report form on its own, "Send code"). Before sending anything, the plugin checks, in this order:

• The per-minute limit for this visitor and, if you set it up, Turnstile. See Rate limits and Cloudflare Turnstile.
• The terms, when you made them required. See Terms and conditions.
• Your address rules, the list of disposable email services and whether the domain of the address accepts mail. See Allowed emails.
• Reoon or Emailit, if you turned them on for Briefing requests. See Email Verification.

If an address fails, the visitor sees why (for example "Please use a non-disposable email address.") and nothing is sent.

The code arrives

The visitor gets an email with the subject Your Northwind Dental verification code: 123456, where the company is the Name of your Sales Pitch or, without it, your site name. The code:

• lasts 10 minutes and works once;
• locks that address for 15 minutes after 3 wrong attempts ("Too many attempts. Try again in 15 minutes.");
• can be sent up to 5 times per hour to one address and 5 times per hour from one visitor, unless you change it in Settings > Rate Limits.

The visitor has 15 minutes between asking for the code and typing it. After that, they start over.

The report is written

The visitor types the code and presses "Verify & Generate" ("Verify and generate briefing" in the form on its own). The plugin analyzes the domain again, the AI writes the report, and the result shows on the page in 15 to 30 seconds. If the main AI fails and you set a backup AI, the backup tries once.

The on-screen report has the overall state, "What we found" with each problem and its evidence, the DNS record to publish ("Type", "Host" and "Value"), and the "Action plan" with an effort estimate per step. It ends with your Sales Pitch card if you turned it on, or with the AI's "Ready to fix this?" paragraph if not (you can turn that paragraph off in Email Reports).

The email with the PDF

At the same time, the visitor gets the email Your Email Health Briefing for example.com with the report attached as a PDF (or as an HTML file, if you chose that in Email Reports). The email repeats your Sales Pitch card when it is on.

The PDF carries your cover (logo, company name, tagline and colors), a table of the findings, the detailed findings with the records to publish, the action plan, your Sales Pitch or the AI closing, and an appendix with every record and probe result of the analysis. The foot of every page carries your footer text and the line "A tool by Digital Checkmark".

What you get

When the report is sent, and Lead capture is on, the address is saved in Leads with the domain and the number of findings by severity. Your Notifications fire, and Leads Chk receives the contact if it is installed. The visitor's IP is also freed from the usage wall for 24 hours.

Choose the provider

In Email Health Chk > Settings > AI Provider, pick the Provider. Only the fields of the provider you pick are shown.

Get a Gemini key

1. Open aistudio.google.com/app/apikey and sign in with a Google account.
2. Create an API key in a Google Cloud project with billing turned on. On the free tier, Google may use what you send (your visitors' domain data) to improve its products.
3. Copy the key. It starts with AIza.

Get an OpenAI key

1. Open platform.openai.com/api-keys and sign in.
2. Create a secret key and copy it. It starts with sk-. Use is billed to your OpenAI account.

Paste it and choose the model

1. Paste the key in its field.
2. Pick the model. The list marks the recommended one for each provider: Gemini 3.8 Flash and GPT-5.4 Mini. Pro and flagship models are slower and cost more, and the report has 60 seconds to be written.
3. With Gemini 3 models, leave "Thinking level" in low (the value on a new install) to keep the report well inside the 60 seconds. "Google default" lets Google decide.
4. Press Save Changes.

To check it, ask for a report on your page with your own email. If it fails, open the Debug Log.

A custom service

1. In Custom Endpoint URL, paste the full chat completions address, ending in /v1/chat/completions (for example https://openrouter.ai/api/v1/chat/completions). Addresses on private networks are refused.
2. In Custom API Key, paste the key. The plugin sends it as a Bearer token. It needs one: without a key, the plugin treats the service as not configured.
3. In Custom Model, type the exact model name the service expects (for example meta-llama/llama-3.3-70b-instruct).

Backup AI

"Backup AI (optional)" is a second service that is tried once, on its own, when the main provider fails (an error, a timeout, a reply that is not valid). Use a service from a different company than the main one. It must have a Chat Completions API.

1. In "Endpoint URL", paste its chat completions address (for example https://api.deepinfra.com/v1/openai/chat/completions).
2. In "API Key", paste its key. It is never shown again after saving: leave the field empty to keep it.
3. In "Model", type the model name.
4. In "Reasoning effort", leave "Not sent (provider default)" unless the model needs it.

The backup only runs when all three (address, key and model) are filled in, and only if the main provider failed within its first 40 seconds. Leave "Endpoint URL" empty to turn the backup off.

Run Gotenberg

Gotenberg runs as a Docker container. On the same server as WordPress, or on another machine your server can reach:

docker run -d --restart unless-stopped -p 127.0.0.1:3000:3000 gotenberg/gotenberg:8

That publishes it only on the machine itself, at http://127.0.0.1:3000. If it runs on another machine, put it behind HTTPS and a password, or on a private network.

Connect it

1. Open Email Health Chk > Settings > Gotenberg.
2. In Service URL, paste its base address, for example http://127.0.0.1:3000. Only the base: the plugin adds the conversion path. Use a plain http or https address, without a user or password inside it.
3. If your Gotenberg asks for a password (basic authentication), fill in Basic Auth User and Basic Auth Password. The password is never shown again after saving.
4. Press Save Changes.

Check it

Open Email Health Chk > Plugin Info. The Gotenberg tile says Reachable when its health address answers, Unreachable when it does not, and Not configured with no address. The answer is kept for 5 minutes, so wait a little after a change. Then ask for a report with your own email and look for the PDF.

Without Gotenberg

On shared hosting, where you cannot run a container, go to Email Reports > Report options and set Attachment format to HTML (no converter needed). The same document goes as an .html file. Many mail gateways quarantine or strip .html attachments, because they are a common way to deliver phishing, so the report may not arrive. Prefer the PDF whenever you can run the converter. See Email Reports.

The check against bots: three options

Settings > Cloudflare Turnstile starts with "Check visitors are human":

• Built-in check (recommended): invisible and with no outside accounts. The visitor's computer or phone solves a short calculation before sending (well under a second on a normal phone). "Difficulty" (Low, Normal or High) sets how long it takes, and "Minimum seconds before sending" (2 by default, 0 = off) refuses answers sent faster than a person could. It stops automated spam by volume; against a determined attacker, the limits and the email code help too.
• Cloudflare Turnstile: the check described below, with its two keys. Without both keys, the built-in check is used.
• None: only the rate limits.

Sites from before version 1.4.0 that used Turnstile with both keys keep it; the rest move to the built-in check.

Turnstile is Cloudflare's free check against bots. With it, a script cannot run your tool in a loop and spend your AI credits, your verification credits and your server time. It is optional, and recommended on any public site. You do not need to have your site on Cloudflare.

Create the widget in Cloudflare

1. Sign in at dash.cloudflare.com (a free account works) and open Turnstile.
2. Add a widget. Give it a name, such as Email Health Chk, and add the domain of your site (for example example.com).
3. Choose the Managed mode.
4. Create it and copy the two keys: the Site Key and the Secret Key.

Paste the keys

1. Open Email Health Chk > Settings > Cloudflare Turnstile.
2. Paste the Site Key and the Secret Key. You need both: with only the site key, the box shows but nothing is checked.
3. In Turnstile Appearance, choose Always visible (the default) or Invisible (show only when interaction is required).
4. Press Save Changes.

Check it

Open the page with the tool in a private window and analyze a domain. The Turnstile box shows under the field (or not, in invisible mode) and the result arrives. Plugin Info shows the Turnstile tile as Configured.

How it is used

• The check runs on each analysis and on the request for a code. A visitor who passed it can ask for a code within the next 30 minutes without a new check, and a resent code needs none.
• Cloudflare also says which site the check was made on. If it is not your site, the plugin refuses it.
• If the check fails, the visitor sees "Bot-check verification failed. Please reload and try again." See If something does not work.
• To stop using Turnstile, choose "Built-in check (recommended)" or "None" in "Check visitors are human" and save.

Choose the mode

In Mode:

• Off (default): nothing is shown.
• Optional: the switch and the terms are shown, but the visitor can go on without turning it on.
• Required: the visitor must turn it on before they analyze or ask for the report. If they do not, they see "Please accept the terms & conditions to continue." (in the report form on its own, "Please accept the terms to continue."). The plugin checks it again on its server before it sends a code. Choose this one if your visitors may be in the European Union.

Write the texts

• Checkbox Label: the short text next to the switch. A new install fills in I agree to the Terms & Conditions and Privacy Policy. Empty, the switch reads "I agree to the terms & conditions."
• Privacy Policy URL (optional): the address of your privacy policy. It shows as the link "View full Terms & Conditions" at the end of the terms.
• T&C Body: the terms themselves. The plugin comes with a template in plain English (purpose, data collected, third-party services, no warranty, email verification, retention, acceptable use, changes). Edit it for your country or replace it. Paragraphs separated by a blank line are kept, and basic HTML is accepted. Reset to default template puts the template back in the box (it asks first if the box has text).

Press Save Changes.

What the visitor sees

Under the domain field, a switch with your label, a red asterisk when it is required, and "Read Terms & Conditions", which opens your text right there. The link to the full terms appears at the end when you set an address. "Read Terms & Conditions" only appears when the body or the address has something.

Turn it on

1. Tick Enable Usage Wall (off by default).
2. In Daily limit, set the free analyses per IP every 24 hours. The default is 3, a good start for most sites.
3. Write the texts: Heading (default Continue Analyzing), Description (default Enter your email to keep analyzing email health today.) and Button text (default Continue). Keep the description to one or two short sentences.
4. Press Save Changes.

Check what it needs

• A working AI provider. Unlocking the wall writes and sends the report for the domain, like the card under the results does.
• The code email reaching the visitor. Ask for one with your own address first.
• If you want Reoon or Emailit to check the addresses of the wall, tick Usage wall unlock in Email Verification. It is off by default.

Good to know

• The count is per IP address. Visitors behind the same office connection share it.
• An unlocked IP is free from the wall for 24 hours. Without unlocking, the count resets 24 hours after the last analysis that counted.
• The addresses captured by the wall are saved with the source usage_wall only when Lead capture is on. See Lead capture and retention.

Turn it on

1. Tick Enable (Inject the popup widget across the site).
2. In Button Text, write the label of the button. Empty, it reads Check Email Health.
3. In Button Side, choose Bottom-right corner (default) or Bottom-left corner.
4. In Visibility, choose All pages (default) or Home page only.
5. Press Save Changes and open your site in a private window.

Make it match your site

• Overlay Opacity: how dark the page gets behind the window, from 0 to 100 (default 60).
• FAB Background and FAB Text Color: the colors of the button. Empty, it uses the plugin's colors.
• FAB Icon: Shield (default), Search, Lock, Mail or Cog.

What the visitor sees

The button with its icon and label. A click opens the window with the three steps of the report form (see The tool on your site). The × button, a click outside the window or the Esc key closes it.

Turn it on and choose where

1. Tick Enable (Show sales pitch after analysis results).
2. In Display Mode > Mode, choose: - Inline (below results) (default): the card sits in the results, above the sections. - Popup overlay: the card floats over the page with a dark background. It converts more and interrupts more.
3. With the popup, choose its Trigger: - Auto delay: it opens after Delay seconds once the results show (8 on a new install). - On scroll down: when the visitor scrolls past half of the page. - Exit intent (mouse leaves): when the mouse leaves the top of the window. - Manual only (CTA): only when your own button opens it (see below).

The popup only opens by itself on pages with the analyzer. The visitor closes it with the ×, a click outside or the Esc key.

Write the message

• Heading: default Need help fixing these issues?
• Body (HTML): two or three short sentences. Basic HTML is accepted. The live preview shows it as plain text.
• Call to Action: Button text (default Book a Free Audit) and Button URL, the page where you book the call or the contact form. Without a URL, the button goes nowhere: fill it in.

Add your company Optional

Under Company, fill in Name, Website, Email and Phone. They show under the button, as links. Leave a field empty to leave it out.

The Name is also the company shown at the top of every email the plugin sends (the code, the report and the alerts) and in the subject of the code email. Without it, the plugin uses your site name.

Pick the colors

Background, Heading, Body text, CTA button and CTA text. Choose a background that stands out from your site, and a strong color for the button.

Press Save Changes.

Open the popup from your own button

With Popup overlay and Manual only (CTA), any button of your theme can open the card with this code:

<button onclick="window.dispatchEvent(new Event('ehc-pitch-show'))">Talk to an expert</button>

The events

If you tick no event in a channel, that channel sends all of them.

Alerts by email

1. Under Email, tick Enable (Send email notifications for selected events).
2. In Recipients, write one or more addresses separated by commas.
3. In Events, tick what you want to hear about.
4. In Sources to notify, tick the origins that count: Dashboard, Usage wall and Briefing (report). All come ticked.
5. Optional: in Template (HTML), write your own email for New lead and Critical finding. Empty, the built-in one is used (View default template shows it). Variables: {event}, {email}, {domain}, {source}, {critical}, {high}, {medium}, {low}, {site_name}, {site_url} and {leads_url}. The summaries keep their own layout.
6. Optional: under Filters, Cooldown pauses the channel for that many seconds after an alert of the same event (300 by default).
7. Press Save Changes, then Send test email.

The alerts go out through WordPress, with your company at the top (see Sales Pitch).

Alerts by webhook

A webhook sends each event to another service (Zapier, Make, n8n, your own system) as a JSON POST with event, timestamp, site (name and address) and data (email, domain, source, counts and lead number).

1. Under Webhook, tick Enable (Send webhook POST requests for selected events).
2. In Webhook URL, paste the address the service gave you. Addresses on private networks are refused.
3. Optional: in Custom Headers, one header per line as Key: Value, for example Authorization: Bearer your-token.
4. Tick the Events and the Sources to notify, and the Filters if you want them.
5. Press Save Changes, then Send test webhook. The result shows next to the button.

Microsoft Teams

Teams receives the alerts as a card in a channel, through its Workflows app.

1. In Teams, open the channel, press the three dots (…) next to its name and choose Workflows.
2. Choose the template Send webhook alerts to a channel, give it a name and finish.
3. Copy the address Teams shows at the end. It starts with https:// and has logic.azure.com or powerplatform.com.
4. Paste it in Webhook URL and follow the webhook steps above. The plugin recognizes it and sends a card instead of plain JSON.

The old Teams connector addresses (webhook.office.com) stopped working in May 2026: the plugin refuses them and says so.

The summary

Under Email Digest > Schedule, choose Disabled (default), Daily digest or Weekly summary. It goes to the Recipients of the email channel, and to the webhook if it is on, with the lead counts and the top findings of the period.

• The email channel must be on, with recipients.
• In Events, tick Daily summary or Weekly summary (or leave every event unticked).
• A period without new leads sends nothing.

What does not do anything yet

The New leads only box of Filters is saved, but in this version it does not filter anything: every alert is sent as if it were a new lead.

Local Layers

Three checks always run, for free, on every address:

• Format check: the address is well formed.
• Disposable blocklist: the domain is not a throwaway email service. The screen shows how many domains the list has.
• MX record validation: the domain of the address can receive email.

Before them, your rules of Allowed emails apply.

External Verification Provider

A paid service that confirms the mailbox exists. In Provider, choose None (format + MX + disposable only) (default), Emailit or Reoon, and paste its key in Emailit API Key or Reoon API Key. The key is never shown again after saving.

Get a Reoon key

1. Create an account at reoon.com (Reoon Email Verifier) and buy or claim credits.
2. Open the API section of your account and copy your API key.
3. In Provider, choose Reoon, paste the key in Reoon API Key and press Save Changes.

The plugin uses Reoon's power mode, which checks the mailbox itself. It only refuses clear cases: invalid, disposable, disabled (when Reoon confirms it) and spam traps.

Or use Emailit

If you send with Emailit, its verification uses the same account. Create an API key in Emailit, choose Emailit and paste it in Emailit API Key. It refuses invalid, disposable and disabled addresses, gibberish and high-risk ones.

Apply Verification On

Choose where the provider is used. The local layers run everywhere anyway.

Cache duration keeps the provider's answer for an address so the same address does not spend another credit (24 hours by default). The field accepts up to 720 hours, but the plugin keeps the answer 168 hours (7 days) at most.

What the visitor sees

When an address is refused, the visitor sees why, for example "Please use a non-disposable email address." or "This email domain does not appear to accept email. Please use a valid address.", and no code is sent.

What is sent

Every new lead (report, usage wall) goes to Leads Chk with tags: the tool (tool:email-health-chk), how the address arrived (via:briefing or via:usage_wall), whether it is a business or a personal address, and risk:critical or risk:high when the report found such problems. Addresses confirmed with a code skip the double opt-in. The lead stays in this plugin too.

At the top, the screen counts the contacts that came from this plugin and how many are subscribed, with a link to see them in Leads Chk.

Install Leads Chk

Install and activate Leads Chk. Then open Email Health Chk > Integrations. The fields below come from Leads Chk, in the language of your admin.

Decide what happens with each address

1. Connection: tick Send the contacts of this plugin to Leads Chk. Off, nothing is sent and the newsletter checkbox is not shown.
2. What happens with the address: Save it as a contact, never subscribed to the newsletter (the safe choice), Save it, and offer the newsletter with a checkbox, or Save it and subscribe it to the newsletter. Someone who asks for a report has not asked for a newsletter: subscribing everyone brings spam complaints.
3. Which list: the list for those who subscribe, or a new one.
4. With the checkbox: The checkbox starts ticked (never, everywhere except Europe, or always) and Checkbox wording. A box that arrives ticked is not valid consent in the European Union.
5. Delete leads without consent after: the days Leads Chk keeps a contact that never subscribed. Use the period of your privacy policy.
6. Newsletter form under the tool: a Leads Chk form shown under the tool, or None.
7. Press Save Changes. The screen says Saved.

The newsletter checkbox appears in the plugin's own forms: the report request and the usage wall.

Turn it on

Tick Enable (Write debug events to the log file.). It saves at once. It is the same switch as Settings > Debug. Off (the default), the plugin writes nothing, not even errors.

Read it

The table shows the Log file name, its Size, its Status and that the last 500 lines are shown below. Refresh reloads the lines without leaving the page. Clear log empties the file (it asks first).

The file lives in a protected folder of your uploads directory, with a name nobody can guess. When it reaches about 500 KB, the plugin starts a new one and keeps the previous one.

Turn the log off when you are done: it can hold visitors' addresses and domains.

When the plugin is deleted

At the bottom, "When the plugin is deleted" decides what happens if you delete the plugin from the Plugins screen. Turning it off never deletes anything.

• "Delete all its data too" off (default): settings, leads and logs stay, so a new install picks up where you left.
• On: its tables, settings, logs and files are removed for good, and the license is released if it has one.

Press "Save" under the box.