kwtsms

<p><strong>kwtSMS</strong> replaces or supplements WordPress passwords with SMS one-time codes, sends WooCommerce order updates automatically, and lets you verify phone numbers on any contact form. Built on the <a href="https://www.kwtsms.com" rel="nofollow ugc">kwtSMS</a> SMS gateway.</p>
<p>Built for Arabic-speaking markets (Kuwait, Saudi Arabia, UAE, Bahrain, Qatar, Oman) with full RTL admin support and bilingual SMS templates in English and Arabic.</p>
<h4>Authentication</h4>
<ul>
<li><strong>2FA Mode:</strong> users log in with username + password, then confirm with a 6-digit SMS code</li>
<li><strong>Passwordless Mode:</strong> users enter their phone number and receive an OTP to log in directly, no password needed</li>
<li><strong>Both Modes:</strong> let each user choose their preferred method</li>
<li><strong>Password Reset via SMS:</strong> replace the email link with an SMS OTP verification flow</li>
<li><strong>Role-Based Enforcement:</strong> configure which user roles must pass OTP (exclude administrators, apply only to customers, etc.)</li>
<li><strong>Welcome SMS:</strong> send a customisable welcome message when a new user registers</li>
<li><strong>Country Code Dropdown:</strong> restrict the dial-code selector on login forms to GCC countries or a custom list</li>
</ul>
<h4>WooCommerce Integration</h4>
<ul>
<li><strong>7 order status notifications:</strong> Processing, On-Hold (Shipped), Completed, Cancelled, Pending Payment, Refunded, Failed</li>
<li><strong>Admin order notifications:</strong> automatically notify a configurable admin phone number on any order status change</li>
<li><strong>Checkout OTP Gate:</strong> require phone verification before the customer can place an order (all methods or COD-only)</li>
<li><strong>Per-status templates:</strong> independent English + Arabic SMS template for every order status</li>
<li><strong>Admin SMS panel:</strong> send a custom free-text SMS to any order’s customer from the order edit screen</li>
<li><strong>Stock alerts:</strong> low stock, out of stock, and backorder notifications to admin</li>
<li><strong>New product SMS:</strong> notify admin when a product is first published</li>
<li><strong>Back-in-stock notifications:</strong> customers subscribe on out-of-stock product pages, SMS sent automatically on restock</li>
<li><strong>Instant new order SMS:</strong> notify admin the moment an order is placed, before status processing</li>
<li><strong>Cart abandonment recovery:</strong> detect abandoned carts, send recovery SMS with auto-generated coupon codes, track recovery stats on the dashboard</li>
<li><strong>Multivendor support:</strong> per-vendor order SMS for Dokan, WCFM, and WC Vendors</li>
<li>HPOS (High-Performance Order Storage) compatible</li>
</ul>
<h4>Contact Form Integrations</h4>
<p>Each integration supports two modes: <strong>Notification</strong> (send a confirmation SMS on submit) and <strong>OTP Gate</strong> (block submission until the phone number is verified):</p>
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Ninja Forms</li>
</ul>
<h4>Security</h4>
<ul>
<li>Sliding-window rate limiting per phone number, per IP address, and per user account</li>
<li>Duplicate OTP guard: reuses existing valid OTP on double-click or page reload</li>
<li>IP Allowlist/Blocklist with CIDR support for IPv4 and IPv6</li>
<li>IPHub proxy/VPN detection (optional): silently block or flag OTP requests from known proxies</li>
<li>Registration OTP gate: verify phone via OTP before account creation</li>
<li>Trusted Devices: trust a device for 30 days after 2FA, with profile revoke controls</li>
<li>Phone blocking list: silently drop OTP requests from blocked numbers (anti-enumeration)</li>
<li>Attempt lockout after configurable max failures</li>
<li>Google reCAPTCHA v3 and Cloudflare Turnstile support</li>
<li>All credentials stored server-side, never output to HTML</li>
<li>Nonces on every form and AJAX action</li>
<li>Anti-enumeration: password reset never reveals whether an account exists</li>
</ul>
<h4>External Services</h4>
<p>This plugin connects to the following external services:</p>
<p><strong>1. kwtSMS API</strong> (required): sends all SMS messages. <a href="https://www.kwtsms.com" rel="nofollow ugc">kwtsms.com</a> | <a href="https://www.kwtsms.com/policy.html" rel="nofollow ugc">Terms</a> | <a href="https://www.kwtsms.com/privacy.html" rel="nofollow ugc">Privacy</a></p>
<p><strong>2. ipapi.co</strong> (optional): detects visitor country for dial-code pre-selection. <a href="https://ipapi.co" rel="nofollow ugc">ipapi.co</a> | <a href="https://ipapi.co/terms/" rel="nofollow ugc">Terms</a> | <a href="https://ipapi.co/privacy/" rel="nofollow ugc">Privacy</a></p>
<p><strong>3. IPHub</strong> (optional): proxy/VPN detection on OTP requests. <a href="https://iphub.info" rel="nofollow ugc">iphub.info</a> | <a href="https://iphub.info/legal" rel="nofollow ugc">Terms</a> | <a href="https://iphub.info/legal" rel="nofollow ugc">Privacy</a></p>
<p><strong>4. Google reCAPTCHA v3</strong> (optional): bot protection on OTP forms. <a href="https://www.google.com/recaptcha/" rel="nofollow ugc">google.com/recaptcha</a> | <a href="https://policies.google.com/terms" rel="nofollow ugc">Terms</a> | <a href="https://policies.google.com/privacy" rel="nofollow ugc">Privacy</a></p>
<p><strong>5. Cloudflare Turnstile</strong> (optional): alternative bot protection. <a href="https://www.cloudflare.com/products/turnstile/" rel="nofollow ugc">cloudflare.com/turnstile</a> | <a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Terms</a> | <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Privacy</a></p>
<h4>Admin</h4>
<ul>
<li><strong>Users Without Phone</strong> sub-page under the WordPress Users menu: lists all registered users missing a phone number, with a dynamic count badge on the menu item</li>
</ul>
<h4>Test Mode</h4>
<p>Enable <strong>Test Mode</strong> in the Gateway settings to test without receiving real SMS messages. Messages are queued on the kwtSMS server but never delivered to the phone. Credits are still deducted. To recover them, log in to your kwtSMS account dashboard and delete the queued messages. The OTP code is visible under kwtSMS > Logs > Debug Log so you can complete flows during development.</p>
<h4>Languages</h4>
<p>Ships with English (default) and Arabic translations. The plugin admin UI and all user-facing strings are fully translatable.</p>
<h3>Help & Support</h3>
<ul>
<li><strong><a href="https://www.kwtsms.com/faq/" rel="nofollow ugc">kwtSMS FAQ</a></strong>: Answers to common questions about credits, sender IDs, OTP, and delivery.</li>
<li><strong><a href="https://www.kwtsms.com/support.html" rel="nofollow ugc">kwtSMS Support</a></strong>: Open a support ticket or browse help articles.</li>
<li><strong><a href="https://www.kwtsms.com/#contact" rel="nofollow ugc">Contact kwtSMS</a></strong>: Reach the kwtSMS team directly for Sender ID registration and account issues.</li>
<li><strong><a href="https://www.kwtsms.com/sender-id-help.html" rel="nofollow ugc">Sender ID Help</a></strong>: Sender ID registration and guidelines.</li>
<li><strong><a href="https://www.kwtsms.com/login/" rel="nofollow ugc">kwtSMS Dashboard</a></strong>: Recharge credits, buy Sender IDs, view message logs, and manage coverage.</li>
<li><strong><a href="https://www.kwtsms.com/integrations.html" rel="nofollow ugc">Other Integrations</a></strong>: Plugins and integrations for other platforms and languages.</li>
<li><strong><a href="https://github.com/boxlinknet/kwtsms-wordpress/issues" rel="nofollow ugc">Plugin Issues</a></strong>: Report bugs or request features for this WordPress plugin.</li>
</ul>


kwtSMS: OTP & SMS Notifications

SMS OTP login, password reset, and WooCommerce order notifications via the kwtSMS gateway. Arabic RTL support included.

SMS8.io

<p><strong>SMS8 turns your Android phone into a free SMS gateway for WordPress and WooCommerce.</strong> Send WooCommerce order SMS notifications, OTP login codes, two-factor authentication messages and bulk SMS straight from your own SIM card — no Twilio, no Vonage, no Plivo, no per-message fees, no US A2P 10DLC paperwork. Pair an Android device with your SMS8 account, paste your API key into the plugin, and your WordPress site starts texting customers in minutes.</p>
<p>Built for WooCommerce stores tired of getting nickel-and-dimed by CPaaS providers, OTP-driven membership sites that don’t want to pay per verification, and any WordPress install that just wants reliable SMS without subscribing to a third gateway. Full project home and documentation at <a href="https://sms8.io" rel="nofollow ugc">sms8.io</a>.</p>
<h4>Features</h4>
<ul>
<li><strong>SMS gateway for WordPress</strong> — send through your real mobile number with no per-SMS fees. SMS8 starts at $29/month for unlimited messages through one device.</li>
<li><strong>WooCommerce SMS notifications</strong> for every order status — Pending, Processing, On hold, Completed, Cancelled, Refunded, Failed — each with its own toggle and message template. Placeholders for customer name, order ID, total, tracking number, payment method and more.</li>
<li><strong>Admin order SMS alerts</strong> — text the store owner whenever a new order lands, with a separate template.</li>
<li><strong>OTP login shortcode</strong> — drop <code>[sms8_otp]</code> on any page to render a two-step phone verification form. Works with membership plugins, custom registration flows, account-recovery pages.</li>
<li><strong>Two-factor authentication (2FA) helper</strong> — <code>SMS8_API::send_otp()</code> and <code>verify_otp()</code> for your own login hooks, including BuddyPress, WP Members, and custom theme registration.</li>
<li><strong>Bulk SMS from custom code</strong> — <code>do_action('sms8_send_sms', '+14155550101', 'Hi')</code> from any theme, MU-plugin or cron job.</li>
<li><strong>Device & SIM picker</strong> — pull the list of your paired Android phones with one click and pin a specific device or SIM slot for sends.</li>
<li><strong>Setup wizard</strong> — 3-step onboarding on activation: Connect, pick device, send a test SMS.</li>
<li><strong>One-click Connect</strong> — popup OAuth-style flow grabs your API key from SMS8 automatically. No copy-paste.</li>
<li><strong>Send log</strong> — last 100 attempts with status, error, source, and timestamp. Auto-pruned per retention setting.</li>
<li><strong>HPOS-compatible</strong> — full support for WooCommerce High-Performance Order Storage.</li>
<li><strong>Translations included</strong> — English, French, Spanish, Arabic (RTL).</li>
<li><strong>No tracking, no analytics, no phone home.</strong> GPLv2. The plugin only talks to the SMS8 API endpoint you configured.</li>
</ul>
<h4>Why pick SMS8 over Twilio / Vonage / Plivo?</h4>
<p>Twilio, Vonage, MessageBird and Plivo charge $0.0075 to $0.04 per SMS in the US, require A2P 10DLC registration paperwork, and route your messages as third-party A2P traffic. Recipients see a short code or random number they don’t recognise — and reply rates collapse.</p>
<p>SMS8 routes through a real Android phone you own. The message arrives from your real local number. Recipients reply directly to you, not to a 5-digit short code that disappears next quarter. And it costs $29/month flat for unlimited SMS, not $300/month at any meaningful volume. Full pricing and pricing calculator on <a href="https://sms8.io" rel="nofollow ugc">sms8.io</a>.</p>
<h4>How does it work?</h4>
<ol>
<li>Install the free SMS8 Android app from <a href="https://sms8.io/sms-gateway-apk-android" rel="nofollow ugc">sms8.io/sms-gateway-apk-android</a>, sign in with your SMS8 account, scan the QR on app.sms8.io/devices.php to pair the phone.</li>
<li>Install this WordPress plugin, click <strong>Connect with SMS8</strong> in the setup wizard — a popup signs you in and auto-fills your API key.</li>
<li>Configure WooCommerce templates per order status, or just turn on Processing + Completed defaults and you’re done.</li>
<li>When a WooCommerce order triggers a status change, the plugin POSTs to app.sms8.io with <code>Authorization: Bearer <api_key></code>, SMS8 queues the message, your paired Android polls SMS8, sends the SMS, and reports back.</li>
</ol>
<p>The whole round-trip is typically under 4 seconds. Plugin requests use a 10-second timeout — checkout will never block longer than that even if the SMS8 API is slow.</p>
<h4>WooCommerce SMS notification templates</h4>
<p>Every WooCommerce order status has its own message template with these placeholders:</p>
<ul>
<li><code>{first_name}</code> <code>{last_name}</code> <code>{full_name}</code> <code>{customer_name}</code></li>
<li><code>{order_id}</code> <code>{order_total}</code> <code>{order_currency}</code> <code>{order_status}</code></li>
<li><code>{tracking_number}</code> (works with most shipment-tracking plugins)</li>
<li><code>{site_name}</code> <code>{site_url}</code> <code>{payment_method}</code></li>
</ul>
<h4>Send SMS from your own code</h4>
<p>Use the <code>sms8_send_sms</code> action from any plugin or theme. Example: send the admin an SMS when a new user registers.</p>
<pre><code>add_action('user_register', function ($user_id) {
    $user = get_userdata($user_id);
    do_action('sms8_send_sms', get_option('admin_phone'), "New signup: {$user->user_email}");
});
</code></pre>
<h4>OTP login and 2FA shortcode</h4>
<p>The <code>[sms8_otp]</code> shortcode renders a self-contained two-step form: phone field, “Send code” button, code field, “Verify” button. On successful verification it fires <code>do_action('sms8_phone_verified', $phone)</code> so any membership plugin or theme can mark the phone verified. Optional <code>redirect="/my-account"</code> attribute sends the user somewhere after verification.</p>
<h4>Legal and compliance</h4>
<p>The plugin sends SMS through your real mobile number via P2P (person-to-person) messaging. In the US this is <strong>exempt from A2P 10DLC registration requirements</strong> that apply to bulk SMS providers. You still need to comply with TCPA: get explicit opt-in from recipients for marketing messages, honor STOP keywords, and never send between 9pm and 8am local time. Outside the US, check your local regulator’s text-marketing rules.</p>
<h4>About SMS8</h4>
<p>SMS8 is an Android-phone-based SMS gateway service running since 2024, used by hundreds of e-commerce stores, agencies and SaaS apps to send SMS without CPaaS fees. Marketing site, blog and pricing at <a href="https://sms8.io" rel="nofollow ugc">sms8.io</a>. REST API documentation at <a href="https://sms8.io/sms-api-documentation" rel="nofollow ugc">sms8.io/sms-api-documentation</a>. Get the Android gateway app at <a href="https://sms8.io/sms-gateway-apk-android" rel="nofollow ugc">sms8.io/sms-gateway-apk-android</a>.</p>


SMS8 – SMS Gateway for WooCommerce, Order Notifications, OTP Login & 2FA via Android

SMS gateway for WordPress & WooCommerce. Order notifications, OTP login, 2FA, bulk SMS through your own Android phone. No Twilio. No per-SMS fees.

kwtSMS: OTP & SMS Notifications vs SMS8 – SMS Gateway for WooCommerce, Order Notifications, OTP Login & 2FA via Android