sms.bd

SMS, OTP login, WooCommerce notifications, and two-factor authentication for WordPress.

sms.bd connects your sms.bd account to WordPress and WooCommerce. One connection, one send path (smsbd()->send()), used everywhere: order notifications, one-time-password login and registration — including a mandatory two-factor step built directly into WooCommerce's own login and registration forms — checkout verification, admin alerts, and a developer API for anything else.

Contents

• Screenshots
• Features
• Requirements
• Installation
• Getting started
• Shortcodes
• REST API
• Developer hooks
• Frequently asked questions
• Security notes
• License

Screenshots

Dashboard — balance, delivery stats, system health	Templates — dynamic variables, segment estimation	Guided 7-step setup wizard

Features

Core

• A single, centralized send path (smsbd()->send()) used by every feature in the plugin — one place to see, log, and debug every outgoing message.
• Bangladesh-first phone normalization, connection testing, live balance display.
• A template manager with dynamic variables ({customer_name}, {order_total}, {otp_code}, …), automatic character/segment (GSM-7 / Unicode) estimation, and restorable default templates.
• A searchable SMS log with masked phone numbers and per-row resend.

OTP & two-factor authentication

• OTP login, registration, and standalone mobile verification — as shortcodes ([smsbd_login], [smsbd_register], [smsbd_phone_verify]) and built directly into WooCommerce's own My Account login/registration forms, so customers use the store's normal screens.
• Optional mandatory SMS two-factor step on WooCommerce login: a correct password isn't enough on its own — a verification code sent to the customer's phone is required to complete login. Accounts without a phone on file are guided to add and verify one first.
• Optional OTP-verified mobile number requirement on WooCommerce registration — the account isn't created until the code is confirmed.
• Optional OTP verification gate on WooCommerce classic checkout, before an order can be placed.
• Rate limiting (per phone and per IP), attempt limits, resend cooldowns, and hashed-at-rest codes and phone numbers.
• Every one of the above is its own on/off switch — nothing changes behavior until you turn it on.

WooCommerce

• Order-status SMS (new, pending, processing, on-hold, completed, cancelled, failed, refunded).
• Admin alerts: payment failed, order cancelled, refund, low stock, out of stock, new customer.
• Never fatals when WooCommerce is inactive — the integration simply doesn't load.

Admin experience

• A guided 7-step setup wizard for first activation.
• Custom CSS field (Settings → Advanced) to restyle any of the plugin's widgets or admin screens without touching a file.

Developer

• A REST API, a stable PHP send function, WordPress action/filter hooks around every send and every OTP event, and shortcodes for every front-end widget.

Requirements

Installation

1. Upload the smsbd-wordpress folder to /wp-content/plugins/, or install the zip via Plugins → Add New → Upload Plugin.
2. Activate the plugin.
3. Follow the setup wizard to connect your sms.bd API key and configure Sender ID, WooCommerce, and OTP options.

Getting started

• Send your first message: sms.bd → Send SMS, or from code: smsbd()->send(['to' => '01700000000', 'message' => 'Hello']).
• Turn on OTP login/registration: sms.bd → OTP. Each toggle documents which shortcode or native form it affects.
• Turn on Checkout OTP: sms.bd → WooCommerce (classic checkout only).
• Restyle a widget: sms.bd → Settings → Advanced → Custom CSS.

Shortcodes

Each shortcode also has a matching on/off setting under sms.bd → OTP — the shortcode renders nothing (an HTML comment) when its feature is turned off.

REST API

All endpoints are namespaced under /wp-json/smsbd/v1/:

Developer hooks

// Register a custom event so it appears in the Templates editor.
smsbd_register_event( 'my_custom_event', [ 'label' => 'My Event', 'variables' => [ 'first_name' ] ] );

// Filter/observe every send.
add_filter( 'smsbd_before_send', function ( $args ) { return $args; } );
add_action( 'smsbd_after_send', function ( $response, $args ) { /* ... */ }, 10, 2 );
add_action( 'smsbd_send_failed', function ( $response, $args ) { /* ... */ }, 10, 2 );

// React to OTP lifecycle events.
add_action( 'smsbd_otp_created', function ( $user_id, $purpose ) { /* ... */ }, 10, 2 );
add_action( 'smsbd_otp_verified', function ( $user_id, $purpose ) { /* ... */ }, 10, 2 );
add_action( 'smsbd_otp_failed', function ( $purpose ) { /* ... */ } );

// Pause all outgoing SMS without touching any other setting.
add_filter( 'smsbd_should_send', fn( $should_send ) => $should_send && my_condition() );

Frequently asked questions

Does this require WooCommerce? No. WooCommerce-dependent features (order notifications, checkout OTP, native-form 2FA) simply don't load when WooCommerce is inactive; everything else works standalone.

Will the native login/registration integration work with my theme? It's built on WooCommerce's standard template and filter hooks (wc_get_template, woocommerce_register_form, the core authenticate filter), not anything theme-specific, so it works with the large majority of WooCommerce themes. It doesn't (yet) support the newer Blocks-based Account page, since that doesn't use the classic template system. Test on your actual theme before a full rollout.

Does 2FA affect wp-admin login? No — it's scoped specifically to WooCommerce's customer-facing My Account form. Admin/staff login at wp-login.php is untouched by design.

Where do I get an API key? Sign up at sms.bd — API docs at sms.bd/api.

Security notes

• OTP codes and phone numbers are hashed at rest (SHA-256), never logged in plaintext, and compared with timing-safe comparison.
• The two-factor login flow never re-transmits the account password after the first submission — a short-lived, cryptographically random server-side token carries the "password already verified" state, not a hidden form field.
• Every OTP purpose has independent rate limiting (per phone and per IP) and a maximum-attempts lockout.
• "Delete plugin data on uninstall" is off by default — data is only removed if you explicitly opt in under Settings → Security.

License

GPLv2 or later — see license text.