SendSMS Subscribers & 2FA

SendSMS Subscribers & 2FA connects your WordPress site to the sendsms.ro SMS gateway and gives you two independent capabilities: a full subscriber management and SMS marketing system, and an SMS-based two-factor authentication layer on the wp-admin login form.

Subscriber management and campaigns:

• Subscribe and unsubscribe widgets you can drop into any widgetised area on the frontend.
• Optional phone-verification step on subscribe/unsubscribe (sends a one-time code; IP rate-limiting prevents abuse).
• Subscriber admin page with a searchable list table — add, edit, delete, or sync contacts to your sendsms.ro address book with one click.
• Mass-send SMS to all subscribers, or to WordPress users filtered by role.
• Complete SMS history log of every message the plugin sends.
• “Send a test SMS” page for verifying your sender label and message content against any phone number.

SMS two-factor authentication:

• Enable 2FA per user role — only the roles you pick require a second factor.
• On first login, users who don’t yet have a phone number stored are prompted to enrol.
• A one-time code is sent to the user’s phone; the wp-admin session is not opened until the code is validated.
• Codes are time-limited and bound to a signed cookie so they cannot be replayed.

Compatibility: PHP 7.4 through 8.3, WordPress 6.0 through 7.0. Verified on PHP 7.4 and PHP 8.3 against WordPress 7.0.

This plugin requires a sendsms.ro account. Sign-up is free; SMS pricing is per message and depends on the destination country.

External services

This plugin connects to the sendsms.ro SMS gateway — a third-party service operated by SC sendSMS Solutions SRL — to deliver text messages and manage your contact list. Using the plugin requires an active sendsms.ro account.

What the service is used for:

• Sending the subscribe/unsubscribe confirmation and one-time verification-code SMS to the phone numbers visitors enter in the frontend forms.
• Sending the two-factor-authentication code SMS to wp-admin users when SMS 2FA is enabled for their role.
• Sending the test SMS triggered from the SendSMS Dashboard → Send a test SMS page.
• Sending bulk SMS triggered from the SendSMS Dashboard → SMS sending page (to all subscribers, or to WordPress users filtered by role).
• Reading your account balance to display it on the Settings page.
• Creating and updating contacts (and the contact group) in your sendsms.ro address book when you sync a subscriber from the Subscribers page.

What data is sent, and when:

• On every outbound SMS: your sendsms.ro username and API key/password, the configured sender label, the recipient phone number (a visitor/subscriber number, an admin-supplied number for tests, or a user’s stored number for 2FA), and the message body. Bulk sends POST the recipient list and message together as a batch.
• On a contact sync: your username, API key/password, and the subscriber’s phone number, first name, and last name.
• On a balance check: your username and API key/password.
• No data is sent until you have entered credentials and either a visitor submits a form, a protected user logs in, or you press a send/sync button — or you open the Settings page, which checks the balance once per page load and caches it for 5 minutes.

Service endpoint used: https://api.sendsms.ro/json (HTTPS).

Third-party terms of service and privacy:

• Terms and conditions: https://www.sendsms.ro/en/terms-and-conditions/
• GDPR / privacy: https://www.sendsms.ro/en/gdpr/
• ISO 27001 certification: https://www.sendsms.ro/en/iso-27001-certified/