=== SMS8 — Free SMS Gateway for WordPress, WooCommerce SMS Notifications & OTP via your own Android phone ===
Contributors: sms8io
Tags: sms, woocommerce, sms notifications, otp, two-factor authentication
Requires at least: 5.8
Tested up to: 6.7
Requires PHP: 7.4
Stable tag: 4.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Send free SMS from WordPress and WooCommerce through your own Android phone. Order notifications, OTP login, two-factor codes, bulk SMS — no Twilio, no per-message fees, no A2P 10DLC.

== Description ==

**SMS8 turns your Android phone into a free SMS gateway for WordPress and WooCommerce.** Pair an Android device with your free SMS8 account, paste your API key into the plugin, and your WordPress site can send SMS notifications, one-time passwords, two-factor codes and bulk messages — straight from your own SIM card, with no Twilio account, no Vonage, no Plivo, no per-message fees, and no US A2P 10DLC paperwork.

Built for WooCommerce stores that hate getting nickel-and-dimed by CPaaS providers, OTP-driven membership sites that don't want to pay per verification, and any WordPress install that just wants reliable SMS without subscribing to a third gateway.

= What you get in v4 =

* **Free SMS gateway** — no per-SMS fees. Use your existing mobile plan. SMS8 itself starts at $29/month for unlimited messages through one device.
* **WooCommerce SMS notifications** for every order status — Pending, Processing, On hold, Completed, Cancelled, Refunded, Failed — each with its own toggle and template. Placeholders for customer name, order ID, total, tracking number, payment method and more.
* **Admin order alerts** — also text the store owner whenever an order lands, with a separate template.
* **OTP shortcode** — drop `[sms8_otp]` on any page to render a two-step phone verification form. Works with membership plugins, custom registration flows, account-recovery pages.
* **Two-factor authentication helper** — `SMS8_API::send_otp()` and `verify_otp()` for your own login hooks, including BuddyPress, WP Members, and custom theme registration.
* **Bulk SMS from custom code** — `do_action('sms8_send_sms', '+14155550101', 'Hi')` from any theme, MU-plugin or cron job.
* **Device picker** — pull the list of your paired Android phones with one click and pin a specific device or SIM slot for sends.
* **Tabbed admin** — Connection, WooCommerce, Custom + OTP, Logs. Everything on one screen, no scattered settings.
* **Send log** — last 100 attempts with status, error, source, and timestamp. Auto-pruned per retention setting.
* **HPOS-compatible** — full support for WooCommerce High-Performance Order Storage.
* **No tracking, no analytics, no phone home.** GPLv2. The plugin only talks to the SMS8 API endpoint you configured.

= Why not Twilio? =

Twilio, Vonage, MessageBird and Plivo charge $0.0075 to $0.04 per SMS in the US, require A2P 10DLC registration paperwork, and treat your messages as third-party A2P traffic. Recipients see a short code or random number they don't recognise.

SMS8 routes through a real Android phone you own. The message arrives from your real local number. Recipients reply directly to you, not to a 5-digit short code that disappears next quarter. And it costs $29/month flat, not $300/month at any meaningful volume.

= How does it work technically? =

1. Install the free SMS8 Android app, sign in with your SMS8 account, scan the QR on app.sms8.io/devices.php to pair the phone.
2. Install this plugin, paste your API key from app.sms8.io/api.php into the Connection tab.
3. Configure WooCommerce templates per status, or just turn on Processing + Completed defaults and you are done.
4. When a WooCommerce order triggers a status change, the plugin POSTs to app.sms8.io with `Authorization: Bearer <api_key>`, SMS8 queues the message, your paired Android polls SMS8, sends the SMS, and reports back.

The whole round-trip is typically under 4 seconds. Plugin requests use a 10 second timeout — checkout will never block longer than that even if the SMS8 API is slow.

= WooCommerce SMS templates supported =

Every WooCommerce order status has its own message template with these placeholders:

* `{first_name}` `{last_name}` `{full_name}` `{customer_name}`
* `{order_id}` `{order_total}` `{order_currency}` `{order_status}`
* `{tracking_number}` (works with most shipment-tracking plugins)
* `{site_name}` `{site_url}` `{payment_method}`

= What about WordPress core events? =

Use the `sms8_send_sms` action from any plugin or theme. Example: send the admin an SMS when a new user registers.

`add_action('user_register', function ($user_id) {`
`    $user = get_userdata($user_id);`
`    do_action('sms8_send_sms', get_option('admin_phone'), "New signup: {$user->user_email}");`
`});`

= OTP and two-factor =

The `[sms8_otp]` shortcode renders a self-contained two-step form: phone field, "Send code" button, code field, "Verify" button. On successful verification it fires `do_action('sms8_phone_verified', $phone)` so any membership plugin or theme can mark the phone verified. Optional `redirect="/my-account"` attribute sends the user somewhere after verification.

= Legal and compliance =

The plugin sends SMS through your real mobile number via P2P (person-to-person) messaging. In the US this is **exempt from A2P 10DLC registration requirements** that apply to bulk SMS providers. You still need to comply with TCPA: get explicit opt-in from recipients for marketing messages, honor STOP keywords, and never send between 9pm and 8am local time. Outside the US, check your local regulator's text-marketing rules.

= Who is SMS8.io? =

SMS8.io is an Android-phone-based SMS gateway service. We have been running since 2024 and are used by hundreds of e-commerce stores, agencies, and SaaS apps to send SMS without CPaaS fees. Full marketing site at [sms8.io](https://sms8.io). REST API docs at [sms8.io/sms8-api-documentation](https://sms8.io/sms8-api-documentation).

== Installation ==

= Standard install =

1. In your WordPress admin, go to **Plugins → Add New**.
2. Search for **SMS8**.
3. Click **Install Now**, then **Activate**.
4. A new **SMS8** item appears in your admin sidebar. Click it.
5. On the **Connection** tab, paste your API key from [app.sms8.io/api.php](https://app.sms8.io/api.php).
6. Click **Load devices** to populate the device picker (or leave on "Primary").
7. Type your own phone number into the Test send box, click **Send test**. You should receive an SMS within 5 seconds.
8. For WooCommerce, switch to the **WooCommerce** tab and turn on the order statuses you want to text customers about.

= Manual install =

1. Download the .zip from this page.
2. **Plugins → Add New → Upload Plugin → choose the file → Install Now → Activate.**

= Getting an API key =

If you don't already have an SMS8 account, sign up for free at [app.sms8.io](https://app.sms8.io). Free 5-day trial, no card required. Then visit [app.sms8.io/api.php](https://app.sms8.io/api.php) to copy your key.

= Pairing an Android device =

You need at least one paired Android phone for SMS to actually go through. Install the SMS8 app from [sms8.io/sms-gateway-apk-android](https://sms8.io/sms-gateway-apk-android), sign in, and scan the pairing QR shown at [app.sms8.io/devices.php](https://app.sms8.io/devices.php).

== Frequently Asked Questions ==

= Is the SMS8 WordPress plugin really free? =

The plugin is free, GPLv2-licensed. You need an SMS8 account to send SMS — that has a free 5-day trial, then $29/month for one device with unlimited SMS. There is no per-message fee.

= Do I need a Twilio, Vonage or Plivo account? =

No. SMS go through your own Android phone via SMS8. No CPaaS account anywhere.

= Do I need A2P 10DLC registration in the US? =

No. P2P SMS from a real mobile number through your own device is exempt from the A2P 10DLC requirements that apply to bulk SMS providers. You still need explicit opt-in for marketing messages (TCPA).

= Does this work with WooCommerce HPOS (High-Performance Order Storage)? =

Yes. We use `wc_get_order()` and the `woocommerce_order_status_{x}` hook family, both fully HPOS-compatible. The plugin declares HPOS compatibility on activation.

= Which WooCommerce events does it support? =

All seven standard order statuses: Pending payment, Processing (paid), On hold, Completed (shipped), Cancelled, Refunded, Failed. Each has its own enable toggle and template. Plus an optional admin-alert SMS to the store owner.

= What placeholders can I use in templates? =

`{first_name}`, `{last_name}`, `{full_name}`, `{customer_name}`, `{order_id}`, `{order_total}`, `{order_currency}`, `{order_status}`, `{tracking_number}`, `{site_name}`, `{site_url}`, `{payment_method}`.

= Can I send SMS for events other than WooCommerce? =

Yes. Use the action `do_action('sms8_send_sms', $phone, $message)` from any plugin, theme, MU-plugin, or wp-cron job. Optional third argument is an array of options like `['device_id' => 11029, 'sim_slot' => 0]`.

= Can I render an OTP login form on the front-end? =

Yes. Drop the shortcode `[sms8_otp]` on any page. It renders a two-step form: phone → code → verify. On success it fires `do_action('sms8_phone_verified', $phone)` for membership plugins / custom themes.

= Can I send bulk SMS from this plugin? =

The plugin does not include a bulk-SMS UI inside WordPress — that lives in the SMS8 dashboard at [app.sms8.io](https://app.sms8.io). Use the plugin for transactional and event-driven SMS; use the dashboard for marketing broadcasts.

= What if my Android phone is offline? =

Messages queue inside SMS8 and send when the device comes back online. The Logs tab shows queued + sent states.

= How is the data stored? =

WordPress options table stores your settings under the single key `sms8_options`. A custom table `{prefix}sms8_log` stores send attempts. Old log rows auto-prune per the retention setting.

= Does the plugin phone home or send telemetry? =

No. The plugin only talks to `https://app.sms8.io` (the API endpoint you configured) to send SMS and list devices. No analytics, no telemetry, no third-party JavaScript.

= I'm upgrading from version 3.x — what happens to my settings? =

Automatic migration. On first run after upgrade, your old `sms8_io_api_key`, `sms8_io_device_id`, and order-template options are folded into the new tabbed settings. The legacy options are kept (not deleted) so you can downgrade safely in the first day if needed.

= GDPR? =

The plugin processes the recipient's phone number and message body for the explicit purpose the WP admin configured. Add a clear opt-in line to your checkout if you operate in the EU / UK. No third-party data sharing happens — the API call goes only to SMS8.io.

== Screenshots ==

1. Connection tab — paste API key, pick device, send test SMS.
2. WooCommerce tab — per-status templates with toggles.
3. OTP + Custom tab — OTP defaults and PHP hook snippet for custom triggers.
4. Logs tab — last 100 sends with status pill and error messages.
5. The `[sms8_otp]` shortcode rendered on a front-end page.

== Changelog ==

= 4.0.0 — 2026-05-29 =
* **Full rewrite.** New tabbed admin UI: Connection / WooCommerce / Custom + OTP / Logs.
* All seven WooCommerce order statuses supported (was 3 in v3.x).
* New `[sms8_otp]` shortcode for front-end phone verification.
* New `sms8_send_sms` action for custom triggers.
* New send log with auto-pruning.
* Device picker that pulls from your SMS8 account in one click.
* SIM slot override per send.
* HPOS-compatible.
* Bearer-token auth (API key no longer lands in URLs or POST bodies).
* Automatic one-shot migration from v3.x settings.
* GPLv2.

= 3.0.2 =
* Last v3 release. See v3.0.2 changelog.

== Upgrade Notice ==

= 4.0.0 =
Major rewrite with a brand-new tabbed admin UI, all 7 WooCommerce statuses, OTP shortcode, custom triggers, send log, and full HPOS support. Your v3.x settings migrate automatically — no manual steps. Strongly recommended upgrade.