Email safety and audit history

PressedMail sanitizes email HTML and blocks remote images by default. Paid builds add link-risk analysis, phishing reports, and audit history. These controls reduce exposure; they cannot prove a message is safe.

Read HTML without running its scripts

The renderer strips scripts, forms, embedded frames, and other disallowed elements on the server. It restricts link schemes and displays the result in a sandboxed iframe without script permission.

A visually convincing message can still ask you to send money or enter a password elsewhere. Check the actual destination and confirm unusual requests through a known contact method.

Control remote images

Images loaded from a sender's server can reveal that a message was opened. Keep them blocked when you do not need them.

• Use the per-message reveal action for the message you are reading.
• Automatically load remote images is a personal preference and is off by default.
• A site-wide restriction can prevent external images from loading even when a user tries to reveal them.

The renderer neutralizes images with explicit dimensions of at most two pixels in both directions. That catches some tracking pixels, not every tracking technique. Inline message images and remote images follow different paths.

In Free, revealed external images use direct HTTPS requests. Paid builds can use a signed image proxy when proxying is enabled. Do not assume every paid image request is proxied. Even with a proxy, the upstream host can observe a request from your server.

Link warnings on paid builds

Link analysis checks features such as shortened URLs, raw IP addresses, lookalike domains, unusual ports, and link text that disagrees with its destination. These checks run locally during rendering.

The warning interstitial is a site setting and is off by default. When enabled, a flagged link opens a warning before the destination. A flagged domain can be legitimate, and an unflagged domain can be malicious.

Use Phishing reports for message-level evidence. A report and a link warning are different controls.

Audit history

Paid builds retain 365 days of connection, sending, and settings activity. The log records activity for the relevant WordPress user. Metadata filtering removes sensitive keys before insertion, but that is not permission to put secrets in arbitrary labels or messages.

Without the paid entitlement, retention is zero and new audit events are not recorded. This history is separate from the WordPress email log, which has its own 0/30/60/90-day retention.

Protect mailbox access

The mailbox lock adds a per-browser passphrase check. Impersonation protection blocks detected user-switching sessions. Both are available in Free.

These are application-level controls. Someone with direct control of WordPress code, its database, or server backups is outside that boundary. See Where your mail and data live for storage and external requests.