SMSGELY – Order SMS Notification & Login OTP For WooCommerce

SMSGELY for WooCommerce connects your store to SMSGELY, a business SMS service and Bangladesh SMS gateway. It sends WooCommerce SMS notifications when an order changes status, and lets customers log in, register and verify their phone number with a one-time password (OTP) sent by SMS.

• WooCommerce order SMS notifications — your customers (and, if you like, your team) get an SMS when an order is placed, processing, on hold, completed, cancelled, failed or refunded.
• OTP login and registration — customers sign in or create an account with their mobile number and a one-time code, on the My Account page or at checkout.
• Phone verification — a new mobile number is saved only after the customer confirms it with a code.

Every message is sent through the SMSGELY SMS API using your own SMSGELY account. Everything is set up from one SMSGELY menu in your WordPress admin. No coding, shortcodes or theme changes are needed. The plugin is designed for Bangladeshi mobile numbers and supports English and Bangla SMS. 01712345678, +8801712345678 and 8801712345678 are all understood as the same number. This plugin is the SMSGELY integration for WooCommerce, published by the team behind SMSGELY. It needs an SMSGELY account to send messages. It is not part of WordPress or WooCommerce, and it is not affiliated with or endorsed by WordPress.org, WooCommerce or Automattic. The plugin adds no credit, link or logo to your store. An optional "Powered by SMSGELY" line under the OTP login form appears only if you turn it on in SMSGELY → Settings. Features

• WooCommerce order SMS for seven order events, each with its own on/off switch
• Send to the customer, up to five admin numbers, or both
• OTP login and OTP registration on My Account, the classic checkout and the WooCommerce Checkout Block
• Phone number verification in My Account → Account details
• English and Bangla SMS templates with placeholders and a live preview
• Character count and SMS part estimate while you type
• Background sending with WooCommerce's Action Scheduler
• Duplicate-send protection and safe automatic retries
• SMS logs with filters, one-click retry and delivery status
• Rate limits per phone number and IP address
• Optional CAPTCHA: Cloudflare Turnstile, Google reCAPTCHA or a built-in math question, plus a honeypot field
• Daily and monthly SMS limits to protect your SMSGELY wallet
• Encrypted storage of the API key and CAPTCHA secret keys
• Compatible with WooCommerce High-Performance Order Storage (HPOS)
• Works with WordPress personal data export and erase
• Translation-ready

How it works WooCommerce SMS notifications

1. You connect your SMSGELY account in SMSGELY → Connection with an API key from your SMSGELY dashboard.
2. You choose which order events send an SMS, and to whom.
3. When an order reaches one of those statuses, the plugin queues the message in the background.
4. The plugin sends the message to the SMSGELY SMS API over HTTPS.
5. SMSGELY delivers the SMS and bills your SMSGELY wallet.

OTP login, registration and phone verification

1. The customer enters their mobile number on the login, registration or checkout form.
2. The plugin asks SMSGELY to send a one-time code to that number.
3. The customer types the code into the form.
4. Your server checks the code. The customer is logged in, or continues to a short registration form if the number is new.

The plugin does not include an SMS gateway or SMS credit of its own. SMSGELY is the external service that sends every message. Choose the features you need In SMSGELY → Settings → Choose Your SMSGELY Features, pick one of:

• Login & Registration OTP — phone login, registration and phone verification only.
• WooCommerce Order SMS — order status SMS only. Your store keeps the normal WooCommerce login.
• Both — everything (the default).

A feature you switch off is not loaded at all: it adds nothing to your store pages and sends no SMS. Switching never deletes settings, templates or logs, so you can switch back at any time. WooCommerce order SMS notifications

• Turn each order event on or off.
• Choose who receives each message: the customer, up to five admin numbers, or both.
• Messages are sent in the background with WooCommerce's Action Scheduler, so checkout is not slowed down.
• A failed SMS never changes or blocks the order. The result is added as a private order note with the number masked (you can turn this off).
• Works for registered customers and guest orders; the billing phone number is used.

Supported order events:

• New order (when the customer places the order)
• Processing
• On hold
• Completed
• Cancelled
• Failed
• Refunded

"New order" and "Completed" are on by default. "Processing" is off by default, because most paid orders trigger both "New order" and "Processing". OTP login and registration for WooCommerce

• Works inside the WooCommerce My Account page, the classic checkout and the WooCommerce Checkout Block. Logging in at checkout keeps the cart.
• Choose the login screen: OTP with a "Continue with password" option (default), the normal WooCommerce form with an OTP option, or OTP only.
• Codes have 6 digits and expire after 5 minutes by default; you can change both.
• Existing customers are found by their verified number or their WooCommerce billing phone, so nobody gets a second account. Tools → Link existing customers prepares all existing accounts at once.
• New numbers continue to a short registration form. You decide whether email and password are required, optional or hidden.
• Existing passwords are never removed, and administrators and shop managers always log in with their password.

Phone number verification Customers can add or change their mobile number in My Account → Account details. A new number is saved only after it is confirmed with a code, and the verified number is also used as the WooCommerce billing phone. English and Bangla SMS templates Every message has an English and a Bangla template. Choose the SMS language once; edit the text with a live preview and insert placeholders with a click:

• Order SMS: {customer_name}, {first_name}, {order_id}, {order_total}, {order_status}, {order_date}, {payment_method}, {item_count}, {billing_city}, {phone}, {site_name}
• OTP: {otp}, {expiry_minutes}, {site_name}

SMS length and segments Long messages are sent as several SMS parts, and each part is billed. While you type, the editor shows the character count and the estimated number of parts: plain English text (GSM-7) fits 160 characters in one SMS, and Bangla (Unicode) fits 70. SMSGELY's own count is the one that is billed. Sender ID Choose the SMS type — non-masking (default, recommended for OTP) or masking (your brand name). SMSGELY sends from your account's Primary Sender ID for that type. Sender IDs are managed in your SMSGELY account and cannot be typed into the plugin. SMS logs and delivery tracking

• Every message is listed in SMSGELY → SMS Logs with filters for date, type, status, order, phone number and Sender ID. Phone numbers are masked, and OTP text is never stored.
• When your API key has the sms:read permission, the plugin checks SMSGELY a few times after sending and shows when a message is delivered.
• Failed order messages can be retried with one click.

Duplicate-send protection Each order event is sent only once per order and recipient, even if WooCommerce saves the same status several times. Temporary errors are retried automatically (up to three attempts) with the same request key, so SMSGELY does not send or charge twice. Security and bot protection

• One-time codes are generated with a cryptographically secure random number generator, expire after a few minutes, work only once and are limited in attempts and resends. Only a keyed hash is stored, never the code itself.
• Rate limits per phone number and IP address, with temporary blocking of abusive traffic.
• Optional CAPTCHA: Cloudflare Turnstile, Google reCAPTCHA (v3 or v2) or a built-in math question, plus a hidden honeypot field. "Adaptive" mode only challenges suspicious requests. Every CAPTCHA token is checked on your server.
• Login responses do not reveal whether an account exists for a number.
• Optional daily and monthly SMS limits, a daily OTP limit and a monthly spending limit help protect your SMSGELY wallet.
• The API key and CAPTCHA secret keys are stored encrypted, are never sent to the browser, and can be defined in wp-config.php instead.
• Admin actions check the user's permissions and a WordPress nonce; OTP requests are checked with a nonce. Database queries use prepared statements, input is sanitized and output is escaped.
• The SMSGELY API address must use HTTPS and be on smsgely.com.

These features are meant to help you run a safer store. They do not guarantee security or legal compliance. Built for current WooCommerce

• Compatible with High-Performance Order Storage (HPOS), on or off.
• Works with the classic checkout and the WooCommerce Checkout Block.
• Pages that do not show a login form — home, shop, product and cart — load no plugin scripts, styles or CAPTCHA.
• Translation-ready (text domain smsgely-order-sms-otp).

Your SMSGELY account and the SMS API You need your own SMSGELY account. You create an API key in your SMSGELY dashboard and paste it, with the API address shown there, into SMSGELY → Connection. The plugin then sends each message to the SMSGELY SMS API over HTTPS, and SMSGELY delivers it and bills your SMSGELY wallet at your account's rates. The plugin itself is free and does not include SMS credit. See "External services" below for exactly what is sent. Requirements

• WordPress 6.5 or later and PHP 7.4 or later.
• WooCommerce (the plugin stays inactive without it).
• An SMSGELY account with approved identity verification (KYC), wallet balance and an API key with the sms:send permission (add sms:read for delivery reports).
• A server that can make outgoing HTTPS requests.

Support

• For help with the plugin, use the support forum here on WordPress.org.
• For your SMSGELY account, Sender IDs, balance or API keys, contact SMSGELY support.
• SMSGELY's SMS API guide explains API keys and permissions.

1. Install and activate WooCommerce.
2. In WordPress, go to Plugins → Add New, search for "SMSGELY", then install and activate this plugin. (Or upload the plugin ZIP from Plugins → Add New → Upload Plugin.)
3. In your SMSGELY dashboard, open Developer → API keys and create a key with the sms:send permission. Add sms:read if you want delivery reports. Copy the key — SMSGELY shows it only once.
4. In WordPress, open SMSGELY → Connection. Paste the API address shown in your SMSGELY dashboard and your API key, choose the SMS type, and click Save & check connection.
5. Open SMSGELY → Settings and choose your features: Login & Registration OTP, WooCommerce Order SMS, or Both.
6. Set up order SMS, templates, OTP login and security on their pages (see Configuration below) and save each page.
7. Optional: use SMSGELY → Tools → Send an SMS to check that a message reaches your phone. This sends a real SMS and is billed to your SMSGELY wallet like any other message.

Configuration

• Order SMS — turn order events on or off, choose recipients, add admin numbers and choose the SMS language.
• Templates — edit the English and Bangla messages.
• OTP Login — choose where OTP is offered (My Account, checkout, Account details), the login screen, code length and expiry, and the registration fields.
• Security — choose the CAPTCHA, rate limits and SMS spending limits.
• Settings — features, master on/off switch, log retention and uninstall behaviour.

To keep the API key out of the database, add it to wp-config.php instead: define( 'SMSGELY_API_KEY', 'your-key' );

1.0.2

• Changed: The "WooCommerce is required" notice now appears only on the Dashboard and Plugins screens instead of every admin screen.
• Changed: The WordPress.org screenshots show the default login form, without the optional "Powered by SMSGELY" line.
• Fixed: The readme now lists every order SMS placeholder ({item_count}, {billing_city} and {phone} were missing).

1.0.1

• Changed: The "Powered by SMSGELY" line under the OTP login form is now off by default and shown only if you turn it on. Sites that had already turned it on keep their choice.
• Changed: Styles and scripts are loaded only through the WordPress enqueue functions (no inline style or script tags).
• Changed: Clearer readme: who publishes the plugin and when SMSGELY is contacted.

1.0.0

• New: WooCommerce order SMS notifications for new, processing, on-hold, completed, cancelled, failed and refunded orders, to customers and/or admin numbers.
• New: OTP login and registration on My Account, the classic checkout and the WooCommerce Checkout Block.
• New: Phone number verification in Account details.
• New: Choose Your SMSGELY Features — Login & Registration OTP, WooCommerce Order SMS, or Both.
• New: English and Bangla SMS templates with placeholders, live preview and SMS part estimate.
• New: Background sending with duplicate protection and safe retries.
• New: SMS logs with filters, retry and delivery status (when the API key has the sms:read permission).
• New: Cloudflare Turnstile, Google reCAPTCHA, math CAPTCHA and honeypot; rate limits and SMS spending limits.
• New: Personal data export and erase, log retention settings.
• Dev: Compatible with WooCommerce High-Performance Order Storage (HPOS) and the Checkout Block.