kwtsms

<p><strong>kwtSMS</strong> replaces or supplements WordPress passwords with SMS one-time codes, sends WooCommerce order updates automatically, and lets you verify phone numbers on any contact form. Built on the <a href="https://www.kwtsms.com" rel="nofollow ugc">kwtSMS</a> SMS gateway.</p>
<p>Built for Arabic-speaking markets (Kuwait, Saudi Arabia, UAE, Bahrain, Qatar, Oman) with full RTL admin support and bilingual SMS templates in English and Arabic.</p>
<h4>Authentication</h4>
<ul>
<li><strong>2FA Mode:</strong> users log in with username + password, then confirm with a 6-digit SMS code</li>
<li><strong>Passwordless Mode:</strong> users enter their phone number and receive an OTP to log in directly, no password needed</li>
<li><strong>Both Modes:</strong> let each user choose their preferred method</li>
<li><strong>Password Reset via SMS:</strong> replace the email link with an SMS OTP verification flow</li>
<li><strong>Role-Based Enforcement:</strong> configure which user roles must pass OTP (exclude administrators, apply only to customers, etc.)</li>
<li><strong>Welcome SMS:</strong> send a customisable welcome message when a new user registers</li>
<li><strong>Country Code Dropdown:</strong> restrict the dial-code selector on login forms to GCC countries or a custom list</li>
</ul>
<h4>WooCommerce Integration</h4>
<ul>
<li><strong>7 order status notifications:</strong> Processing, On-Hold (Shipped), Completed, Cancelled, Pending Payment, Refunded, Failed</li>
<li><strong>Admin order notifications:</strong> automatically notify a configurable admin phone number on any order status change</li>
<li><strong>Checkout OTP Gate:</strong> require phone verification before the customer can place an order (all methods or COD-only)</li>
<li><strong>Per-status templates:</strong> independent English + Arabic SMS template for every order status</li>
<li><strong>Admin SMS panel:</strong> send a custom free-text SMS to any order’s customer from the order edit screen</li>
<li><strong>Stock alerts:</strong> low stock, out of stock, and backorder notifications to admin</li>
<li><strong>New product SMS:</strong> notify admin when a product is first published</li>
<li><strong>Back-in-stock notifications:</strong> customers subscribe on out-of-stock product pages, SMS sent automatically on restock</li>
<li><strong>Instant new order SMS:</strong> notify admin the moment an order is placed, before status processing</li>
<li><strong>Cart abandonment recovery:</strong> detect abandoned carts, send recovery SMS with auto-generated coupon codes, track recovery stats on the dashboard</li>
<li><strong>Multivendor support:</strong> per-vendor order SMS for Dokan, WCFM, and WC Vendors</li>
<li>HPOS (High-Performance Order Storage) compatible</li>
</ul>
<h4>Contact Form Integrations</h4>
<p>Each integration supports two modes: <strong>Notification</strong> (send a confirmation SMS on submit) and <strong>OTP Gate</strong> (block submission until the phone number is verified):</p>
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Ninja Forms</li>
</ul>
<h4>Security</h4>
<ul>
<li>Sliding-window rate limiting per phone number, per IP address, and per user account</li>
<li>Duplicate OTP guard: reuses existing valid OTP on double-click or page reload</li>
<li>IP Allowlist/Blocklist with CIDR support for IPv4 and IPv6</li>
<li>IPHub proxy/VPN detection (optional): silently block or flag OTP requests from known proxies</li>
<li>Registration OTP gate: verify phone via OTP before account creation</li>
<li>Trusted Devices: trust a device for 30 days after 2FA, with profile revoke controls</li>
<li>Phone blocking list: silently drop OTP requests from blocked numbers (anti-enumeration)</li>
<li>Attempt lockout after configurable max failures</li>
<li>Google reCAPTCHA v3 and Cloudflare Turnstile support</li>
<li>All credentials stored server-side, never output to HTML</li>
<li>Nonces on every form and AJAX action</li>
<li>Anti-enumeration: password reset never reveals whether an account exists</li>
</ul>
<h4>External Services</h4>
<p>This plugin connects to the following external services:</p>
<p><strong>1. kwtSMS API</strong> (required): sends all SMS messages. <a href="https://www.kwtsms.com" rel="nofollow ugc">kwtsms.com</a> | <a href="https://www.kwtsms.com/policy.html" rel="nofollow ugc">Terms</a> | <a href="https://www.kwtsms.com/privacy.html" rel="nofollow ugc">Privacy</a></p>
<p><strong>2. ipapi.co</strong> (optional): detects visitor country for dial-code pre-selection. <a href="https://ipapi.co" rel="nofollow ugc">ipapi.co</a> | <a href="https://ipapi.co/terms/" rel="nofollow ugc">Terms</a> | <a href="https://ipapi.co/privacy/" rel="nofollow ugc">Privacy</a></p>
<p><strong>3. IPHub</strong> (optional): proxy/VPN detection on OTP requests. <a href="https://iphub.info" rel="nofollow ugc">iphub.info</a> | <a href="https://iphub.info/legal" rel="nofollow ugc">Terms</a> | <a href="https://iphub.info/legal" rel="nofollow ugc">Privacy</a></p>
<p><strong>4. Google reCAPTCHA v3</strong> (optional): bot protection on OTP forms. <a href="https://www.google.com/recaptcha/" rel="nofollow ugc">google.com/recaptcha</a> | <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a> | <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy</a></p>
<p><strong>5. Cloudflare Turnstile</strong> (optional): alternative bot protection. <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">cloudflare.com/turnstile</a> | <a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Terms</a> | <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Privacy</a></p>
<h4>Admin</h4>
<ul>
<li><strong>Users Without Phone</strong> sub-page under the WordPress Users menu: lists all registered users missing a phone number, with a dynamic count badge on the menu item</li>
</ul>
<h4>Test Mode</h4>
<p>Enable <strong>Test Mode</strong> in the Gateway settings to test without receiving real SMS messages. Messages are queued on the kwtSMS server but never delivered to the phone. Credits are still deducted. To recover them, log in to your kwtSMS account dashboard and delete the queued messages. The OTP code is visible under kwtSMS > Logs > Debug Log so you can complete flows during development.</p>
<h4>Languages</h4>
<p>Ships with English (default) and Arabic translations. The plugin admin UI and all user-facing strings are fully translatable.</p>
<h3>Help & Support</h3>
<ul>
<li><strong><a href="https://www.kwtsms.com/faq/" rel="nofollow ugc">kwtSMS FAQ</a></strong>: Answers to common questions about credits, sender IDs, OTP, and delivery.</li>
<li><strong><a href="https://www.kwtsms.com/support.html" rel="nofollow ugc">kwtSMS Support</a></strong>: Open a support ticket or browse help articles.</li>
<li><strong><a href="https://www.kwtsms.com/#contact" rel="nofollow ugc">Contact kwtSMS</a></strong>: Reach the kwtSMS team directly for Sender ID registration and account issues.</li>
<li><strong><a href="https://www.kwtsms.com/sender-id-help.html" rel="nofollow ugc">Sender ID Help</a></strong>: Sender ID registration and guidelines.</li>
<li><strong><a href="https://www.kwtsms.com/login/" rel="nofollow ugc">kwtSMS Dashboard</a></strong>: Recharge credits, buy Sender IDs, view message logs, and manage coverage.</li>
<li><strong><a href="https://www.kwtsms.com/integrations.html" rel="nofollow ugc">Other Integrations</a></strong>: Plugins and integrations for other platforms and languages.</li>
<li><strong><a href="https://github.com/boxlinknet/kwtsms-wordpress/issues" rel="nofollow ugc">Plugin Issues</a></strong>: Report bugs or request features for this WordPress plugin.</li>
</ul>


kwtSMS: OTP & SMS Notifications

SMS OTP login, password reset, and WooCommerce order notifications via the kwtSMS gateway. Arabic RTL support included.

ForthFocus

vgnavada

<p>ForthFocus SMS is built for Indian WooCommerce stores that need DLT-ready transactional SMS, order notifications, OTP verification, and operational visibility in one place. It sends order-status notifications to customers and adds phone-number OTP verification to important store touchpoints such as login, registration, cart, and checkout.</p>
<p>It is built for production: instant order-status sends with optional async queue, a custom log table with filtering, search, retry and CSV export, per-template DLT enforcement, real rate-limiting on OTP requests and verifications, segment-aware authoring with live variable-syntax linting, HTTP diagnostics for gateway communication, and a 3-step setup wizard so first-time configuration takes minutes instead of hours.</p>
<p>The plugin currently supports SMSGatewayHub, ForthFocus SMS Gateway, Gupshup, Fast2SMS, and 2Factor. Additional providers (MSG91, Twilio, Kaleyra) are on the roadmap. The architecture is provider-agnostic — the same templates, OTP flows, and logging continue to work as new providers are added.</p>
<h4>What makes it different</h4>
<p>Most SMS plugins focus only on sending a message or adding a basic OTP form. ForthFocus SMS is focused on the Indian WooCommerce + DLT workflow: every enabled template needs its own DLT Template ID, template syntax is checked before sending, customer OTP flows are rate-limited, gateway responses are logged, balance checks are available inside WordPress, and Diagnostics shows the actual WordPress HTTP request lifecycle for supported gateway communication.</p>
<h4>What it sends</h4>
<ul>
<li><strong>Order Processing: Online Payment</strong> — when a non-COD order moves to Processing</li>
<li><strong>Order Processing: Cash on Delivery</strong> — when a COD order moves to Processing</li>
<li><strong>Order Completed</strong> — when an order is marked Completed</li>
<li><strong>Order Cancelled</strong> — when an order is cancelled</li>
<li><strong>Order Refunded</strong> — when a refund is issued</li>
<li><strong>OTP for login</strong> — alongside the standard email/password login</li>
<li><strong>OTP for registration</strong> — verify the phone number before account creation</li>
<li><strong>OTP at checkout</strong> — verify the phone before the customer hits “Place Order” (cuts down on fake / COD fraud orders)</li>
</ul>
<h4>Why DLT compliance matters</h4>
<p>In India, every commercial SMS must use a sender ID and template registered on the DLT (Distributed Ledger Technology) portal of your telecom operator. Sending unregistered content gets rejected at the operator side, often silently. This plugin enforces DLT correctness at every layer:</p>
<ul>
<li>Each template requires its own DLT template ID before it can be enabled.</li>
<li>The plugin refuses to send any template that has no DLT ID — and logs the attempt so you can see what was skipped and why.</li>
<li>A live syntax linter catches the most common authoring mistakes (<code>{order_id)</code> instead of <code>{order_id}</code>, <code>{#var#}</code> placeholders pasted verbatim from the DLT portal) before they cause silent rejections.</li>
</ul>
<h4>Privacy</h4>
<ul>
<li>The plugin sends data to the configured SMS gateway only when an SMS-related action is performed, such as sending an order notification, sending an OTP, testing a template, or refreshing the SMS balance.</li>
<li>For SMS sending, the data sent to the selected gateway may include the recipient phone number, rendered SMS message body, sender ID/mask, route, channel, Entity ID/principalEntityId, DLT Template ID, provider credentials, and a unique provider message ID where supported.</li>
<li>For balance checks, the plugin sends the required provider credentials to the selected gateway’s balance endpoint.</li>
<li>Plugin scripts, styles, and images are loaded locally from the plugin folder. The plugin does NOT load anything from external CDNs or third-party servers on either admin or customer-facing pages.</li>
<li>The plugin does NOT send usage analytics, telemetry, tracking events, or call-home data to ForthFocus.</li>
<li>OTP codes are hashed (with a per-phone salt) before storage. Plaintext OTP codes are redacted from log entries.</li>
<li>Store owners are responsible for ensuring that their SMS use complies with applicable consent, privacy, telecom, DLT, and customer communication rules.</li>
</ul>
<h3>External services</h3>
<p>This plugin connects to the SMS gateway selected by the site owner to send transactional SMS messages and fetch SMS balance information. A gateway account, API key, approved sender ID/Header, Entity ID, and approved DLT templates are required for live SMS delivery.</p>
<p>The plugin currently supports the following gateway endpoints:</p>
<ul>
<li><code>https://www.smsgatewayhub.com/api/mt/SendSMS</code> — used when the site owner sends an SMS through SMSGatewayHub, such as an order-status notification, OTP message, or template test. The plugin sends the recipient phone number, rendered message body, sender ID, route, channel, Entity ID, DLT Template ID, and the site’s SMSGatewayHub API key.</li>
<li><code>https://www.smsgatewayhub.com/api/mt/GetBalance</code> — used when the dashboard or gateway settings page fetches the SMSGatewayHub balance. The plugin sends the site’s SMSGatewayHub API key.</li>
<li><code>https://sms.forthfocus.com/api/mt/SendSMS</code> — used when the site owner sends an SMS through ForthFocus SMS Gateway, such as an order-status notification, OTP message, or template test. The plugin sends the recipient phone number, rendered message body, sender ID, route, channel, Entity ID, DLT Template ID, and the site’s ForthFocus SMS Gateway API key.</li>
<li><code>https://sms.forthfocus.com/api/mt/GetBalance</code> — used when the dashboard or gateway settings page fetches the ForthFocus SMS Gateway balance. The plugin sends the site’s ForthFocus SMS Gateway API key.</li>
<li><code>https://enterprise.smsgupshup.com/GatewayAPI/rest</code> — used when the site owner sends an SMS through Gupshup, such as an order-status notification, OTP message, or template test. The plugin sends the recipient phone number, rendered message body, approved sender ID/mask, Gupshup User ID, and Gupshup Password. For Gupshup, sender ID, entity, and DLT template mapping must be configured on the Gupshup account.</li>
<li><code>https://enterprise.smsgupshup.com/apps/apis/accInfo</code> — used when the dashboard or gateway settings page fetches the Gupshup balance. The plugin sends the site’s Gupshup User ID and Password.</li>
<li><code>https://www.fast2sms.com/dev/bulkV2</code> — used when the site owner sends an SMS through Fast2SMS, such as an order-status notification, OTP message, or template test. The plugin sends the recipient phone number, rendered message body, Fast2SMS Authorization Key, DLT-approved sender ID, Entity ID, DLT Template ID, and the fixed <code>dlt_manual</code> route.</li>
<li><code>https://www.fast2sms.com/dev/wallet</code> — used when the dashboard or gateway settings page fetches the Fast2SMS wallet balance. The plugin sends the site’s Fast2SMS Authorization Key.</li>
<li><code>https://2factor.in/API/R1/</code> — used when the site owner sends an SMS through 2Factor, such as an order-status notification, plugin-generated OTP message, or template test. The plugin sends the recipient phone number, rendered DLT-approved message body, 2Factor API Key, Sender ID/Header, PE ID, and DLT Template ID through the Transactional SMS API. The plugin does not use 2Factor’s OTP generation or OTP verification APIs.</li>
<li><code>https://2factor.in/API/V1/{API_KEY}/ADDON_SERVICES/BAL/TRANSACTIONAL_SMS</code> — used when the dashboard or gateway settings page fetches the 2Factor Transactional SMS balance. The plugin places the site’s 2Factor API Key in the endpoint path as required by the provider.</li>
</ul>
<p>SMS content and phone numbers are sent to the selected gateway only when the site owner enables the plugin and performs an SMS-related action or when a configured WooCommerce/OTP event triggers an SMS.</p>
<p>Service provider: SMSGatewayHub<br />
Terms and Conditions: https://www.smsgatewayhub.com/terms-and-conditions<br />
Privacy Policy: https://www.smsgatewayhub.com/privacy-policy<br />
API Documentation: https://www.smsgatewayhub.com/free-sms-gateway-developer-api</p>
<p>Service provider: ForthFocus SMS Gateway<br />
Terms and Conditions: https://forthfocus.com/terms-and-conditions/<br />
Privacy Policy: https://forthfocus.com/privacy-policy/<br />
Website: https://forthfocus.com/</p>
<p>Service provider: Gupshup<br />
Website: https://www.gupshup.ai/<br />
Terms and Conditions: https://www.gupshup.ai/terms-and-conditions<br />
Privacy Policy: https://www.gupshup.ai/privacy-policy</p>
<p>Service provider: Fast2SMS<br />
Website: https://www.fast2sms.com/<br />
Terms and Conditions: https://www.fast2sms.com/terms-conditions<br />
API Documentation: https://docs.fast2sms.com/</p>
<p>Service provider: 2Factor<br />
Website: https://2factor.in/<br />
Terms and Privacy: https://2factor.in/v3/tos<br />
API Documentation: https://documenter.getpostman.com/view/301893/TWDamFGh</p>
<h4>Compatibility</h4>
<p>The plugin works on both classic (shortcode-based) and block-based WooCommerce checkout, but the depth of integration differs:</p>
<ul>
<li><strong>Classic checkout</strong> (<code>[woocommerce_checkout]</code> shortcode, used by Storefront, Astra, GeneratePress, Flatsome, URNA, Dokan-style themes, and any site with the WC checkout shortcode) — full integration. The OTP gate renders above the checkout form, the billing phone field is automatically locked to the verified number once verification is complete, and the user uses a “Change phone” link if they need to switch numbers.</li>
<li><strong>Block-based checkout</strong> (the new WC Checkout Block, used by Twenty Twenty-Five and other FSE themes by default) — basic integration. The OTP gate renders above the checkout block. The billing phone field inside the React-managed block cannot be locked from outside the block API, so the user is technically able to edit it after verifying. However, the server-side Store API guard rejects order placement if the submitted phone does not match the verified number — so the verification is still enforced, just at submission rather than at the field level. Tightening this into a native checkout-block extension is on the v1.1 roadmap.</li>
</ul>
<p>For the strictest UX and behavior (auto-locked phone field, no possibility of submitting a mismatched number), use the classic checkout. To switch from block-based to classic on a Twenty Twenty-Five site, edit the Checkout page and replace the “Checkout” block with the <code>[woocommerce_checkout]</code> shortcode.</p>
<h4>Setup wizard</h4>
<p>A 3-step setup wizard guides you through:</p>
<ol>
<li>Gateway selection and credentials (provider-specific credentials such as API key, Fast2SMS Authorization Key, 2Factor API Key, or Gupshup User ID/Password, sender ID/mask, route/channel where applicable, and DLT details where applicable)</li>
<li>Notification templates (DLT ID + approved message body for each order event you want to notify on)</li>
<li>OTP verification (which flows to enable, and the OTP message templates)</li>
</ol>
<p>You can re-run the wizard from the Dashboard at any time, or skip it entirely if you prefer to configure manually.</p>
<h3>Trademark Notice</h3>
<p>ForthFocus is a trademark of FORTHFOCUS GROUP.</p>
<p>WordPress, WooCommerce, and Woo are trademarks of their respective owners. This plugin is not affiliated with, endorsed by, sponsored by, or officially associated with the WordPress Foundation, Automattic Inc., WooCommerce, or Woo.</p>
<p>SMSGatewayHub, MSG91, Gupshup, Fast2SMS, 2Factor, Twilio, and Kaleyra are trademarks or brands of their respective owners. This plugin currently integrates with SMSGatewayHub, ForthFocus SMS Gateway, Gupshup, Fast2SMS, and 2Factor. MSG91, Twilio, and Kaleyra are referenced only as examples of additional providers planned for future releases. The plugin is not officially endorsed by or affiliated with third-party gateway brands unless stated through a formal partnership.</p>


ForthFocus SMS – OTP Verification, Order Notifications & Indian DLT for WooCommerce

Indian DLT-compliant SMS for WooCommerce: order-status notifications, OTP at login / signup / checkout, full delivery logs.

kwtSMS: OTP & SMS Notifications vs ForthFocus SMS – OTP Verification, Order Notifications & Indian DLT for WooCommerce