About this plugin
HantarSMS connects your WordPress site to HantarSMS, a Malaysian SMS service that sends from a short code to Maxis, CelcomDigi, U Mobile, Unifi Mobile and YES numbers. 20 per SMS, no monthly fee.
One plugin covers the three reasons a Malaysian site sends SMS:
1. OTP verification codes
- “Log in with an SMS code” on the WordPress login page, or anywhere with the [hantarsms_otp_login] shortcode.
- Codes are random, stored only as a keyed hash, expire after a few minutes and allow five attempts.
- Limits per phone number and per IP address stop bots from running up your SMS bill through your login form.
- The form does not reveal whether a number belongs to an account, and no SMS is sent (or paid for) when it does not.
- Administrators cannot log in with an SMS code alone, by default.
- Developers can use hantarsms_otp_send() and hantarsms_otp_verify() in their own forms.
2. WooCommerce order SMS
- An SMS to the customer when an order becomes Processing, Completed, Cancelled, Refunded and more — each status with its own editable template.
- A new-order alert to your own phone numbers.
- Placeholders such as {first_name}, {order_number}, {order_total} and {shop}.
- Sent in the background with Action Scheduler, so checkout is never slowed down. Each SMS is noted on the order.
- Compatible with High-Performance Order Storage and the block-based checkout.
3. SMS marketing campaigns
- An optional, unticked “Send me offers by SMS” checkbox at checkout (classic and block checkout), and a consent setting on each user profile.
- Write a campaign, see the character count, number of segments and estimated cost while you type, review, then send now or schedule it.
- Send to everyone who agreed to marketing SMS, or paste your own list (you confirm you have consent).
- Unsubscribe built in: recipients cannot reply to a short code, so the plugin creates an unsubscribe page and can add its link to every campaign. Unsubscribed numbers are removed from every marketing send.
- Batches of up to 10,000 numbers per request, each with an idempotency key, so a retry never sends the same campaign twice.
Also included
- Balance and price per SMS on the settings screen, and a test SMS button.
- A log of every send with cost and any error, kept for 180 days. Phone numbers in the log are masked and OTP codes are never stored.
- hantarsms_send_sms( $to, $text ) for developers, plus filters and actions to change messages and recipients.
Numbers can be typed in any Malaysian format: 0123456789, 012-345 6789, 60123456789 or +60123456789. Only Malaysian mobile numbers are supported.
External services
com/). It does nothing until you enter an API key from your HantarSMS account.
What is sent, and when:
- When an SMS is sent (an OTP code, an order update, a campaign or a test), the plugin sends the recipient phone number(s), the message text and a short reference (such as “order-123-processing”) to https://hantarsms.com/api/v1/messages, together with your API key.
- When you open the plugin’s admin screens, it requests your account balance from https://hantarsms.com/api/v1/balance, together with your API key.
No other data about your site or its visitors is sent. HantarSMS passes the phone numbers and message text to Malaysian mobile operators to deliver the SMS.
- Terms of Service: https://hantarsms.com/en/terms
- Privacy and data protection: https://hantarsms.com/en/pdpa-sms-compliance-malaysia