SMSKora – Smart & Secure SMS OTP Alerts for WordPress

Description

SMSKora is a modular SMS platform for WordPress. It lets you send SMS OTP codes and SMS notifications through a range of popular SMS gateways, with zero code required for most use cases. Advanced developers get a clean PHP API, action/filter hooks, and an extensible provider registry.

SMS Providers

SMSKora ships with built-in support for the following SMS gateways:

• Custom API — Connect any HTTP-based SMS gateway using a configurable URL template (GET or POST).
• BulkSMSBD — Bangladeshi gateway with GET/POST support, balance checks, and sender ID configuration.
• MimSMS — Bangladeshi gateway with OTP and general SMS support.
• SMSNetBD — Bangladeshi gateway with GET/POST support and balance check.
• Twilio — International gateway. Enter Account SID, Auth Token, and sender number.
• Vonage (Nexmo) — International gateway. Enter API Key, API Secret, and brand name.

Additional providers can be registered using the smskora_register_providers filter hook.

Features

WordPress Login OTP
Add two-factor SMS verification to the default WordPress login form. After username and password are accepted, an OTP is sent to the user’s saved phone number. Supports Password + OTP mode. Users without a saved phone number are allowed to log in normally and are reminded to add a phone number from their profile page.

• Configurable OTP mode: Password + OTP, Phone + OTP, or Email/Username + OTP.
• “Remember verified device” option with configurable expiry (days).
• Restrict OTP enforcement to specific user roles (e.g. administrator, editor, shop_manager).
• Resend OTP button with AJAX support.
• Non-JS fallback form.

WordPress Registration OTP
Verify the phone number entered during WordPress default registration before the account is created.

• Customizable phone field label.
• Optional phone number requirement.
• Block duplicate phone numbers across accounts.
• Auto-login after verification option.
• Configurable user meta key for storing the phone number.

WooCommerce Order SMS Notifications
Send SMS notifications to both the store admin and customers when WooCommerce order events occur.

• Admin SMS on new order (configurable admin phone number).
• Customer SMS on: Processing, Completed, Cancelled, Failed, and Refunded order statuses.
• Each event can be toggled individually.
• Message templates use dynamic variables (order number, total, customer name, etc.).

Custom SMS Notification
Trigger one-off SMS messages from the admin Tools page or from your own code.

• Restrict the Tools sender to administrators only.
• Configurable default log context.

Developer API
Enable PHP helper functions, action hooks, and filter hooks for use in themes, plugins, and custom integrations.

• Global helper functions always available.
• REST API endpoint placeholder (disabled by default, enable from Features screen).
• All developer sends are logged with configurable context.

Message Templates

Every SMS notification uses a customizable template. Templates support the following dynamic variables:

• {otp} — The generated OTP code.
• {order_id} — WooCommerce order number.
• {order_total} — Order total with currency.
• {customer_name} — Customer billing first name.
• {site_name} — Your WordPress site name.
• {user_name} — Display name of the user.

Developer API

PHP Helper Functions

smskora_send_sms( $message, $number, $args ) — Send a plain SMS.
smskora_send_otp( $number, $context, $args ) — Generate and send an OTP.
smskora_verify_otp( $number, $otp, $context ) — Verify a submitted OTP code.
smskora_get_option( $key, $default ) — Read a plugin setting.

Static Class API

\SMSKora\SMSKora::send_sms( $message, $number, $args )
\SMSKora\SMSKora::send_otp( $number, $context, $args )
\SMSKora\SMSKora::verify_otp( $number, $otp, $context )

Action Hooks

smskora_before_send_sms — Fires before an SMS is dispatched.
smskora_after_send_sms — Fires after an SMS is dispatched.
smskora_otp_sent — Fires after an OTP is sent successfully.
smskora_otp_verified — Fires after an OTP is verified successfully.
smskora_feature_registered — Fires when a feature is registered.

Filter Hooks

smskora_register_providers — Register custom SMS provider classes.
smskora_sms_message — Filter the SMS message text before sending.
smskora_otp_length — Filter the OTP code length.
smskora_otp_expiry — Filter the OTP expiry time in minutes.

OTP Security

• OTP codes are hashed with password_hash() before being stored.
• Codes are single-use and expire after a configurable time window.
• Attempt limits are enforced to prevent brute-force guessing.
• Expired OTPs are automatically cleaned up via WP-Cron.

Privacy & Data

SMSKora stores SMS log records (recipient, message status, provider, context) and OTP records (hashed OTP, phone, expiry) in custom database tables. No data is sent to third-party servers by this plugin. Data is sent only to the SMS gateway you configure. All stored data is deleted when the “Delete Data on Uninstall” setting is enabled.

External services

SMSKora connects to external SMS gateway APIs only when a site administrator configures an SMS provider and the plugin sends an SMS message, OTP message, order notification, login verification message, registration verification message, or balance-check request.

The plugin does not send SMS data to servers controlled by the SMSKora plugin author. SMS data is sent only to the SMS gateway provider selected and configured by the site administrator.

For configured providers, the following data may be sent to the selected provider:

• Recipient phone number.
• SMS message body.
• Sender ID or sender number, if configured.
• API key, access token, username, password, or other gateway credentials required by the provider.
• Request metadata required by WordPress and the remote API, such as the site server IP address and HTTP request headers.
• For balance-check requests, the plugin sends the configured API credentials to the selected provider to retrieve the account balance.

No external SMS gateway request is made unless the administrator configures a provider and a plugin feature triggers an SMS send or balance check.

BulkSMSBD

This plugin can connect to the BulkSMSBD SMS gateway to send SMS messages and check account balance.

API domains used by this plugin:

• http://bulksmsbd.net/api/smsapi
• http://bulksmsbd.net/api/getBalanceApi

Data sent:

• Recipient phone number and SMS message body when sending SMS.
• API key, sender ID, and other configured gateway credentials required by BulkSMSBD.
• API credentials when checking account balance.

Service website: https://bulksmsbd.com/
Terms of Service: https://bulksmsbd.com/terms-and-conditions.php
Privacy Policy: Not publicly listed by the provider at the time of writing. Users should contact BulkSMSBD through https://bulksmsbd.com/contact for privacy information before enabling this provider.

MimSMS

This plugin can connect to the MimSMS SMS gateway to send SMS messages and check account balance.

API domains used by this plugin:

• https://api.mimsms.com/api/SmsSending/Send
• https://api.mimsms.com/api/SmsSending/SMS
• https://api.mimsms.com/api/SmsSending/balanceCheck

Data sent:

• Recipient phone number and SMS message body when sending SMS.
• API key, sender ID, username, password, or other configured gateway credentials required by MimSMS.
• API credentials when checking account balance.

Service website: https://mimsms.com/
Terms of Service: https://www.mimsms.com/terms-of-service
Privacy Policy: https://www.mimsms.com/privacy-policy

SMSNet BD / sms.bd

This plugin can connect to the SMSNet BD / sms.bd SMS gateway to send SMS messages and check account balance.

API domains used by this plugin:

• https://api.sms.net.bd/sendsms
• https://api.sms.net.bd/user/balance/

Data sent:

• Recipient phone number and SMS message body when sending SMS.
• API key, sender ID, and other configured gateway credentials required by SMSNet BD / sms.bd.
• API credentials when checking account balance.

Service website: https://sms.bd/
Terms of Service: https://sms.bd/Terms_Condition/
Privacy Policy: Not publicly listed by the provider at the time of writing. Users should contact SMSNet BD / sms.bd through https://sms.bd/Contact/ for privacy information before enabling this provider.

Custom API provider

This plugin includes a Custom API provider that allows the site administrator to configure their own SMS gateway endpoint.

External service used:

• The custom endpoint URL entered by the site administrator in the plugin settings.

Data sent:

• Recipient phone number and SMS message body when sending SMS.
• Any custom API credentials, headers, parameters, sender ID, or authentication values configured by the administrator.
• The destination URL and provider are fully controlled by the site administrator.

Because the Custom API provider can connect to any administrator-configured endpoint, site administrators are responsible for reviewing that provider’s terms of service and privacy policy before enabling it.

Twilio

This plugin may include Twilio as an SMS provider option. If configured by the site administrator, it can connect to Twilio to send SMS messages.

Data sent:

• Recipient phone number and SMS message body when sending SMS.
• Twilio Account SID, Auth Token, sender number, and other configured Twilio credentials.

Service website: https://www.twilio.com/
Terms of Service: https://www.twilio.com/en-us/legal/tos
Privacy Policy: https://www.twilio.com/en-us/legal/privacy

Vonage / Nexmo

This plugin may include Vonage as an SMS provider option. If configured by the site administrator, it can connect to Vonage to send SMS messages.

Data sent:

• Recipient phone number and SMS message body when sending SMS.
• Vonage API key, API secret, sender number/name, and other configured Vonage credentials.

Service website: https://www.vonage.com/
Terms of Service: https://www.vonage.com/legal/
Privacy Policy: https://www.vonage.com/legal/privacy-policy/