WordPress SMS plugin
OTP, WooCommerce orders and SMS marketing

Get it on WordPress.org Free · GPLv2 · WordPress 6.2+ · PHP 7.4+ · WooCommerce optional

Listed in the WordPress.org plugin directory. In WordPress go to Plugins → Add New, search for HantarSMS, click Install Now and activate. You can also download the zip and upload it yourself.

1. OTP verification codes

• Log in with an SMS code on the WordPress login page, or anywhere you place the [hantarsms_otp_login] shortcode.
• Random codes of 4–8 digits, stored only as a keyed hash, valid for a few minutes, five attempts before the code is cancelled.
• Limits per phone number and per IP address, and a 60-second wait before a new code, so a bot cannot send thousands of paid SMS through your login form.
• The form gives the same answer whether or not a number is registered, and sends nothing (so you pay nothing) when it is not.
• Administrators cannot log in with an SMS code alone by default: a SIM swap should not be enough to take over a site.
• For your own forms: hantarsms_otp_send( $phone, 'my-form' ) and hantarsms_otp_verify( $phone, $code, 'my-form' ).

If you would rather write the flow yourself, our PHP and WordPress OTP guide has complete code, and OTP SMS in Malaysia covers delivery speed and message wording.

2. WooCommerce order SMS

• An SMS to the customer's billing phone when an order becomes Pending, On hold, Processing, Completed, Cancelled, Refunded or Failed. Each status can be switched on or off and has its own template.
• A new-order alert to your own numbers, sent once per order.
• Placeholders: {shop}, {first_name}, {last_name}, {order_number}, {order_total}, {status}, {payment}, {order_url}.
• Sent in the background with Action Scheduler, so checkout is never slowed down by the SMS. Every SMS, or the reason one was not sent, is added as an order note.
• Works with High-Performance Order Storage and with both the classic and the block checkout.

3. SMS marketing campaigns

• An optional, unticked "Send me offers by SMS" box at checkout, and a consent setting on each user profile. Only people who agreed become subscribers.
• Write a campaign and see the character count, number of segments and estimated cost while you type. A review screen shows how many numbers were removed as invalid, duplicate or unsubscribed before anything is sent.
• Send now or schedule for later. Send to your subscribers, or paste a list you confirm has consented.
• Unsubscribe built in. Recipients cannot reply to the shared short code, so the plugin creates an unsubscribe page and can add its link to every campaign. Unsubscribed numbers are left out of every marketing send.
• Large lists go out in batches of 10,000 numbers, each with an idempotency key: a retry or a double click never sends the same campaign twice.

Marketing SMS in Malaysia needs consent under the PDPA. Our PDPA guide explains what that means in practice, and SMS marketing in Malaysia covers what to send and when.

How to install

1. In WordPress go to Plugins → Add New, search for HantarSMS (plugin page), install and activate.
2. Create a HantarSMS account and message us on WhatsApp for RM1 of trial credit.
3. In the HantarSMS console open API keys and create a key.
4. In WordPress go to HantarSMS → Settings, paste the key, save, and send yourself a test SMS.
5. Turn on what you need: OTP login, WooCommerce order SMS, and under Marketing click "Create the page for me" to set up the unsubscribe page.

You can keep the key out of the database by adding define( 'HANTARSMS_API_KEY', 'sk_live_...' ); to wp-config.php.

What it costs

The plugin is free. SMS are paid from your prepaid HantarSMS balance at the same rate as the console and the API: RM0.20 per segment, lower automatically as your volume grows, with no monthly fee and credit that does not expire. One segment holds 156 characters of plain English or 66 characters with Chinese or emoji. See pricing and the segment calculator.

Privacy and data

The plugin sends nothing until you enter an API key. After that it sends the recipient number, the message text and a short reference to the HantarSMS API for each SMS, and reads your balance when you open its settings. The send log in WordPress masks phone numbers and never stores OTP codes; entries are deleted after 180 days. Uninstalling the plugin removes its settings, tables and user data.

WordPress SMS plugin questions

Is the plugin free?

Yes. The plugin is free and open source (GPLv2). You only pay for the SMS you send, from your prepaid HantarSMS balance, from RM0.20 per segment.

Do I need WooCommerce?

No. OTP login, SMS marketing and the unsubscribe page work on any WordPress site. WooCommerce adds order SMS and the consent checkbox at checkout.

Which numbers can it send to?

Malaysian mobile numbers only. Customers can type them in any common format, such as 012-345 6789 or +60123456789; anything that is not a Malaysian mobile number is skipped and shown before you send.

Can customers reply STOP?

No. Messages come from the shared short code 66886, which cannot receive replies. That is why the plugin includes an unsubscribe page and can add its link to every campaign.

Will it slow down my checkout?

No. Order SMS are queued with Action Scheduler and sent in the background after the order is saved.

Is it on WordPress.org?

Yes. It is listed in the WordPress.org plugin directory as HantarSMS, so you can install it from Plugins → Add New inside WordPress and get updates automatically.

Last reviewed: 24 October 2026

Related: OTP in PHP and WordPress · OTP SMS Malaysia · SMS marketing · PDPA compliance · SMS API · Pricing