A secure and production-ready PHP autoresponder designed for controlled email automation. The script reads incoming messages via IMAP (INBOX only) and sends plain-text replies through SMTP with advanced safety protections.

Built for cron/CLI environments, it prevents reply loops, bounce storms, and excessive sending while maintaining full control over rate limits and mailbox behavior.

The script uses a file-based state system and does not require a database, making deployment lightweight and simple.

Suitable for automated support inboxes, lead capture workflows, and structured auto-reply systems.

• INBOX-only processing
• Plain-text autoresponses (no HTML)
• Multi-mailbox support
• Auto-reply loop protection
• Bounce detection
• Per-run, hourly, daily, and per-sender rate limits
• Sender cooldown control
• SMTP failure detection with cooldown protection
• File-based state directory (no database required)
• Optional Message-ID deduplication
• Log rotation by size
• Token-based browser execution control
• Cron/CLI optimized
• Single-instance lock (cron overlap protection)
• Optional recipient allowlist validation

• PHP 8.0 or newer recommended
• PHP IMAP extension enabled
• OpenSSL enabled
• Outbound access to IMAP server (usually port 993)
• Outbound access to SMTP server (587 STARTTLS or 465 SSL)
• Write permissions for state directory and log files
• Cron access recommended for production use

Installation & Usage

1. Upload autoresponder.php to your server (preferably outside public web root).
2. Configure IMAP and SMTP credentials in the $config section.
3. Set reply_only_if_to_matches if recipient validation is required.
4. Set a strong web_access_token for optional browser testing.
5. Ensure the state directory is writable.
6. Start with delete_after_reply = false for safe testing.
7. Run via CLI or cron for production automation.
8. After confirming correct behavior, optional automatic deletion can be enabled.

Important: When deletion mode is enabled, emails are permanently removed and may bypass the Trash folder. Always test carefully before activating.