In some cases, customers may report that images in WooCommerce order confirmation emails are hidden or that the email displays a warning such as “This message appears suspicious” in Gmail, Outlook, or other email clients.
This article explains why this happens and how to fix it to ensure your transactional emails are trusted and displayed correctly.
What Does the Warning Mean
When an email client marks a message as suspicious or blocks images, it means the message failed one or more security or trust checks.
To protect users from phishing, malware, and spoofed emails, modern email providers:
-
- Analyze the sending domain
- Verify sender authentication
- Check whether images and links come from trusted sources
- Evaluate how the email was sent
If any of these checks fail or are incomplete, images may be blocked by default and a warning is shown to the recipient.
Common Causes
Modern email providers apply strict security checks to protect users from phishing and spoofing. If an email does not meet their trust requirements, external content such as images may be blocked automatically.
The most common reasons include:
1. Missing Email Authentication (SPF, DKIM, DMARC)
Email authentication proves that your email was genuinely sent from your domain.
The three key mechanisms are:
-
- SPF (Sender Policy Framework): Specifies which mail servers are allowed to send emails on behalf of your domain.
- DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to each email to verify its integrity.
- DMARC: Tells receiving servers how to handle emails that fail SPF or DKIM checks.
If any of these records are missing, incomplete, or misconfigured, email providers may treat the email as unverified and block images.
2. Sender Email Address Does Not Match the Website Domain
A common configuration issue is using a sender email that does not belong to the website’s domain.
Example:
-
- Website: mystore.com
- Sender email: mystore@gmail.com
This mismatch lowers trust significantly because the email appears to be sent “on behalf of” a different domain.
3. Images Loaded from Unsecured or Untrusted Sources
Email clients are cautious about loading external images because images can be used to track users or deliver malicious content.
Problems occur when:
-
- Images are loaded over HTTP instead of HTTPS
- Images are hosted on a different or unknown domain
- Images are blocked by firewall or permission rules
4. Emails Sent Using WordPress Default Mail Function
By default, WordPress sends emails using the PHP wp_mail() function.
This method:
-
- Does not authenticate the sender properly
- Lacks reputation scoring
- Is frequently flagged by email providers
As a result, even legitimate transactional emails may be treated as suspicious.
5. Server or Hosting Limitations
Some hosting providers:
-
- Restrict outbound email
- Use shared IPs with poor reputation
- Do not automatically configure DKIM or SPF
This can negatively impact email trust even if your WooCommerce setup is correct.
How Email Providers Evaluate Trust
Before displaying images, email providers typically check:
-
- Domain authentication status
- Sender reputation
- IP reputation
- Content consistency
- HTTPS usage for external assets
If the trust score is below a certain threshold, images are blocked automatically.
Suggested Ways to Improve Email Trust
Step 1: Configure SPF, DKIM, and DMARC Records
-
- Add the required DNS records for your domain based on your email or SMTP provider. These records verify that your emails are legitimately sent from your domain.
- This is the most important step to prevent image blocking and warning messages.
Step 2: Send Emails from Your Own Domain
-
- Use an email address such as:
- orders@yourdomain.com
- support@yourdomain.com
- Avoid using free email services like Gmail or Yahoo as the sender.
- Use an email address such as:
Step 3: Ensure All Images Use HTTPS
Check that all images in your WooCommerce emails:
-
- Use https://
- Are accessible publicly
- Are hosted on a trusted source
Step 4: Use an SMTP Service
We strongly recommend sending WooCommerce emails through an authenticated SMTP service instead of the default WordPress mail function. You can connect using an SMTP plugin such as WP Mail SMTP or FluentSMTP.
Step 5: Test Email Delivery
After completing the configuration:
-
- Send test emails to Gmail, Outlook, and Yahoo
- Confirm that images load automatically
- Ensure no security warnings are displayed
The above suggestions may help reduce warnings and allow images to display more consistently across email clients.
Hidden images and security warnings in WooCommerce emails are caused by email trust and authentication issues, not by the plugin itself. Proper domain authentication, secure image hosting, and SMTP configuration will resolve the issue in most cases.