=== SMS8 – SMS Gateway for WooCommerce, Order Notifications, OTP Login & 2FA via Android ===
Contributors: sms8io
Tags: sms, woocommerce, otp, sms notifications, sms gateway
Requires at least: 5.8
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 4.1.4
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

SMS gateway for WordPress & WooCommerce. Order notifications, OTP login, 2FA, bulk SMS through your own Android phone. No Twilio. No per-SMS fees.

== Description ==

**SMS8 turns your Android phone into a free SMS gateway for WordPress and WooCommerce.** Send WooCommerce order SMS notifications, OTP login codes, two-factor authentication messages and bulk SMS straight from your own SIM card — no Twilio, no Vonage, no Plivo, no per-message fees, no US A2P 10DLC paperwork. Pair an Android device with your SMS8 account, paste your API key into the plugin, and your WordPress site starts texting customers in minutes.

Built for WooCommerce stores tired of getting nickel-and-dimed by CPaaS providers, OTP-driven membership sites that don't want to pay per verification, and any WordPress install that just wants reliable SMS without subscribing to a third gateway. Full project home and documentation at [sms8.io](https://sms8.io).

= Features =

* **SMS gateway for WordPress** — send through your real mobile number with no per-SMS fees. SMS8 starts at $29/month for unlimited messages through one device.
* **WooCommerce SMS notifications** for every order status — Pending, Processing, On hold, Completed, Cancelled, Refunded, Failed — each with its own toggle and message template. Placeholders for customer name, order ID, total, tracking number, payment method and more.
* **Admin order SMS alerts** — text the store owner whenever a new order lands, with a separate template.
* **OTP login shortcode** — drop `[sms8_otp]` on any page to render a two-step phone verification form. Works with membership plugins, custom registration flows, account-recovery pages.
* **Two-factor authentication (2FA) helper** — `SMS8_API::send_otp()` and `verify_otp()` for your own login hooks, including BuddyPress, WP Members, and custom theme registration.
* **Bulk SMS from custom code** — `do_action('sms8_send_sms', '+14155550101', 'Hi')` from any theme, MU-plugin or cron job.
* **Device & SIM picker** — pull the list of your paired Android phones with one click and pin a specific device or SIM slot for sends.
* **Setup wizard** — 3-step onboarding on activation: Connect, pick device, send a test SMS.
* **One-click Connect** — popup OAuth-style flow grabs your API key from SMS8 automatically. No copy-paste.
* **Send log** — last 100 attempts with status, error, source, and timestamp. Auto-pruned per retention setting.
* **HPOS-compatible** — full support for WooCommerce High-Performance Order Storage.
* **Translations included** — English, French, Spanish, Arabic (RTL).
* **No tracking, no analytics, no phone home.** GPLv2. The plugin only talks to the SMS8 API endpoint you configured.

= Why pick SMS8 over Twilio / Vonage / Plivo? =

Twilio, Vonage, MessageBird and Plivo charge $0.0075 to $0.04 per SMS in the US, require A2P 10DLC registration paperwork, and route your messages as third-party A2P traffic. Recipients see a short code or random number they don't recognise — and reply rates collapse.

SMS8 routes through a real Android phone you own. The message arrives from your real local number. Recipients reply directly to you, not to a 5-digit short code that disappears next quarter. And it costs $29/month flat for unlimited SMS, not $300/month at any meaningful volume. Full pricing and pricing calculator on [sms8.io](https://sms8.io).

= How does it work? =

1. Install the free SMS8 Android app from [sms8.io/sms-gateway-apk-android](https://sms8.io/sms-gateway-apk-android), sign in with your SMS8 account, scan the QR on app.sms8.io/devices.php to pair the phone.
2. Install this WordPress plugin, click **Connect with SMS8** in the setup wizard — a popup signs you in and auto-fills your API key.
3. Configure WooCommerce templates per order status, or just turn on Processing + Completed defaults and you're done.
4. When a WooCommerce order triggers a status change, the plugin POSTs to app.sms8.io with `Authorization: Bearer <api_key>`, SMS8 queues the message, your paired Android polls SMS8, sends the SMS, and reports back.

The whole round-trip is typically under 4 seconds. Plugin requests use a 10-second timeout — checkout will never block longer than that even if the SMS8 API is slow.

= WooCommerce SMS notification templates =

Every WooCommerce order status has its own message template with these placeholders:

* `{first_name}` `{last_name}` `{full_name}` `{customer_name}`
* `{order_id}` `{order_total}` `{order_currency}` `{order_status}`
* `{tracking_number}` (works with most shipment-tracking plugins)
* `{site_name}` `{site_url}` `{payment_method}`

= Send SMS from your own code =

Use the `sms8_send_sms` action from any plugin or theme. Example: send the admin an SMS when a new user registers.

`add_action('user_register', function ($user_id) {`
`    $user = get_userdata($user_id);`
`    do_action('sms8_send_sms', get_option('admin_phone'), "New signup: {$user->user_email}");`
`});`

= OTP login and 2FA shortcode =

The `[sms8_otp]` shortcode renders a self-contained two-step form: phone field, "Send code" button, code field, "Verify" button. On successful verification it fires `do_action('sms8_phone_verified', $phone)` so any membership plugin or theme can mark the phone verified. Optional `redirect="/my-account"` attribute sends the user somewhere after verification.

= Legal and compliance =

The plugin sends SMS through your real mobile number via P2P (person-to-person) messaging. In the US this is **exempt from A2P 10DLC registration requirements** that apply to bulk SMS providers. You still need to comply with TCPA: get explicit opt-in from recipients for marketing messages, honor STOP keywords, and never send between 9pm and 8am local time. Outside the US, check your local regulator's text-marketing rules.

= About SMS8 =

SMS8 is an Android-phone-based SMS gateway service running since 2024, used by hundreds of e-commerce stores, agencies and SaaS apps to send SMS without CPaaS fees. Marketing site, blog and pricing at [sms8.io](https://sms8.io). REST API documentation at [sms8.io/sms-api-documentation](https://sms8.io/sms-api-documentation). Get the Android gateway app at [sms8.io/sms-gateway-apk-android](https://sms8.io/sms-gateway-apk-android).

== Installation ==

= Standard install =

1. In your WordPress admin, go to **Plugins → Add New**.
2. Search for **SMS8**.
3. Click **Install Now**, then **Activate**.
4. The activation wizard opens automatically. Click **Connect with SMS8** — a popup signs you in and pastes your API key for you.
5. Pick a paired Android device (or leave on "Primary") and send a test SMS to your own number.
6. For WooCommerce, switch to the **WooCommerce** tab and turn on the order statuses you want to text customers about.

= Manual install =

1. Download the .zip from this page.
2. **Plugins → Add New → Upload Plugin → choose the file → Install Now → Activate.**

= Getting an API key =

If you don't already have an SMS8 account, sign up for free at [app.sms8.io](https://app.sms8.io). Free 5-day trial, no card required. The one-click "Connect with SMS8" button in the setup wizard handles the key transfer automatically, or you can paste it manually from [app.sms8.io/api.php](https://app.sms8.io/api.php).

= Pairing an Android device =

You need at least one paired Android phone for SMS to actually go through. Install the SMS8 Android app from [sms8.io/sms-gateway-apk-android](https://sms8.io/sms-gateway-apk-android), sign in, and scan the pairing QR shown at [app.sms8.io/devices.php](https://app.sms8.io/devices.php).

== Frequently Asked Questions ==

= Is the SMS8 WordPress plugin really free? =

The plugin is free, GPLv2-licensed. You need an SMS8 account to send SMS — that has a free 5-day trial, then $29/month for one device with unlimited SMS. There is no per-message fee.

= Do I need a Twilio, Vonage or Plivo account? =

No. SMS go through your own Android phone via SMS8. No CPaaS account anywhere, no third-party gateway, no per-message billing.

= Do I need A2P 10DLC registration in the US? =

No. P2P SMS from a real mobile number through your own device is exempt from the A2P 10DLC requirements that apply to bulk SMS providers. You still need explicit opt-in for marketing messages (TCPA).

= Does this plugin work with WooCommerce HPOS (High-Performance Order Storage)? =

Yes. The plugin uses `wc_get_order()` and the `woocommerce_order_status_{x}` hook family, both fully HPOS-compatible, and declares HPOS compatibility on activation. Works on classic CPT storage too.

= Which WooCommerce events does it support? =

All seven standard order statuses: Pending payment, Processing (paid), On hold, Completed (shipped), Cancelled, Refunded, Failed. Each has its own enable toggle and message template. Plus an optional admin-alert SMS to the store owner.

= What placeholders can I use in SMS templates? =

`{first_name}`, `{last_name}`, `{full_name}`, `{customer_name}`, `{order_id}`, `{order_total}`, `{order_currency}`, `{order_status}`, `{tracking_number}`, `{site_name}`, `{site_url}`, `{payment_method}`.

= Can I send SMS for events other than WooCommerce? =

Yes. Use the action `do_action('sms8_send_sms', $phone, $message)` from any plugin, theme, MU-plugin, or wp-cron job. Optional third argument is an array of options like `['device_id' => 11029, 'sim_slot' => 0]`.

= Can I render an OTP login form on the front-end? =

Yes. Drop the shortcode `[sms8_otp]` on any page. It renders a two-step form: phone, code, verify. On success it fires `do_action('sms8_phone_verified', $phone)` for membership plugins and custom themes. Works alongside WooCommerce checkout, BuddyPress, WP Members, and most custom registration flows.

= Does this work with two-factor authentication (2FA) on WordPress login? =

Yes. Use `SMS8_API::send_otp($phone)` and `SMS8_API::verify_otp($phone, $code)` inside your own `wp_authenticate` or `authenticate` hook. The plugin handles delivery, code generation, expiry and per-phone rate limits for you.

= Can I send bulk SMS from this plugin? =

The plugin does not include a bulk-SMS UI inside WordPress — that lives in the SMS8 dashboard at [app.sms8.io](https://app.sms8.io). Use the plugin for transactional and event-driven SMS; use the dashboard for marketing broadcasts.

= What if my Android phone is offline? =

Messages queue inside SMS8 and send when the device comes back online. The Logs tab shows queued and sent states.

= Which countries are supported? =

Anywhere your Android phone can send a normal SMS — over 200 countries. There is no allow-list of destinations, no per-country pricing, no extra paperwork for non-US sends. Carrier rates from your own SIM apply.

= Does this support dual-SIM and eSIM phones? =

Yes. The device picker lists every SIM slot on every paired phone. You can pin a specific SIM per template (for example, send WooCommerce alerts from SIM 1, OTP from SIM 2), or per `do_action('sms8_send_sms', ...)` call via the `sim_slot` option.

= How is the data stored? =

Plugin settings live in the WordPress options table under the single key `sms8_options`. A custom table `{prefix}sms8_log` stores send attempts. Old log rows auto-prune per the retention setting.

= Does the plugin phone home or send telemetry? =

No. The plugin only talks to `https://app.sms8.io` (the API endpoint you configured) to send SMS and list devices. No analytics, no telemetry, no third-party JavaScript.

= I'm upgrading from version 3.x — what happens to my settings? =

Automatic migration. On first run after upgrade, your old `sms8_io_api_key`, `sms8_io_device_id` and order-template options are folded into the new tabbed settings. The legacy options are kept (not deleted) so you can downgrade safely in the first day if needed.

= Is this GDPR-compliant? =

The plugin processes the recipient's phone number and message body for the explicit purpose the WP admin configured. Add a clear opt-in line to your checkout if you operate in the EU / UK. No third-party data sharing happens — the API call goes only to SMS8.

= Where is the REST API documented? =

Full REST API reference, code samples in cURL, PHP, Python, Node, Go and C# at [sms8.io/sms-api-documentation](https://sms8.io/sms-api-documentation).

== Screenshots ==

1. Connection tab — paste API key or one-click Connect with SMS8, pick device, send test SMS.
2. WooCommerce tab — per-status SMS notification templates with toggles and placeholders.
3. OTP + Custom tab — OTP defaults and PHP hook snippet for custom triggers.
4. Logs tab — last 100 sends with status pill and error messages.
5. The `[sms8_otp]` shortcode rendered on a front-end page.

== Changelog ==

= 4.1.4 — 2026-05-29 =
* Settings pages now use the full WP admin column width instead of being squeezed into 980px.
* After connecting, if no Android device is paired yet we show a friendly "pair an Android phone" card with step-by-step instructions linking to app.sms8.io/devices.php.
* Larger Connect-with-SMS8 popup (640x720) for better readability of the SMS8 sign-in form.

= 4.1.3 — 2026-05-29 =
* Center the wizard step indicators (Connect / Pick device / Test SMS) instead of stretching them edge-to-edge.

= 4.1.2 — 2026-05-29 =
* Restored the original SMS8 banner and icon on the WordPress.org listing.
* Bumped "Tested up to" to 6.8 so the "not tested with latest 3 major releases" warning clears.
* No code changes from 4.1.1.

= 4.1.1 — 2026-05-29 =
* readme polish: clearer keyword targeting, expanded FAQ (2FA on login, dual-SIM, country coverage, REST API).
* No code changes.

= 4.1.0 — 2026-05-29 =
* **Polished UX.** New plugin header with SMS8 logo, infinity menu icon, live connection status pill with device count.
* **One-click connect.** New "Connect with SMS8" popup flow — sign in on app.sms8.io, approve the WordPress site, your API key auto-populates. No more copy-paste.
* **Setup wizard.** On activation, jump straight to a 3-step wizard: Connect → Pick device → Test SMS.
* **Tab gating.** Until your account is connected, WooCommerce / OTP / Logs tabs are locked with a clear "connect first" message.
* **Smooth tab transitions** with subtle fade animation.
* **Plugin list quick-links.** Settings + Send test directly on the Plugins page. Plus SMS8 Dashboard, API docs, Support links in plugin row meta.
* **Translations: French, Spanish, Arabic** included out-of-the-box (RTL layout supported).
* **Refreshed styling** — less boxy, more modern, focus states, accessible toggles.

= 4.0.0 — 2026-05-29 =
* **Full rewrite.** New tabbed admin UI: Connection / WooCommerce / Custom + OTP / Logs.
* All seven WooCommerce order statuses supported (was 3 in v3.x).
* New `[sms8_otp]` shortcode for front-end phone verification.
* New `sms8_send_sms` action for custom triggers.
* New send log with auto-pruning.
* Device picker that pulls from your SMS8 account in one click.
* SIM slot override per send.
* HPOS-compatible.
* Bearer-token auth (API key no longer lands in URLs or POST bodies).
* Automatic one-shot migration from v3.x settings.
* GPLv2.

= 3.0.2 =
* Last v3 release. See v3.0.2 changelog.

== Upgrade Notice ==

= 4.1.4 =
Wider settings pages + a no-device pairing helper after Connect + larger Connect popup.

= 4.1.3 =
Quick UI polish: setup wizard step pills now centered on the page.

= 4.1.2 =
Brings back the original SMS8 branding on the plugin page and updates "Tested up to" to 6.8 so the outdated-plugin warning clears. No code changes — safe drop-in upgrade.

= 4.1.1 =
Documentation refresh — clearer install instructions, expanded FAQ covering 2FA on login, dual-SIM and eSIM phones, country coverage and REST API. No code changes; safe to update.

= 4.1.0 =
Big UX polish: SMS8 logo + status pill in the header, one-click "Connect with SMS8" popup so you never paste API keys again, a 3-step setup wizard on activation, French / Spanish / Arabic translations built in. Drop-in upgrade, no settings touch needed.

= 4.0.0 =
Major rewrite with a brand-new tabbed admin UI, all 7 WooCommerce statuses, OTP shortcode, custom triggers, send log, and full HPOS support. Your v3.x settings migrate automatically — no manual steps. Strongly recommended upgrade.
