SMSTunnel

Get the SMSTunnel app on Google Play

SMSTunnel links your WordPress site to your own Android phone. When your site needs to send a text – for example a form or order notification from one of the SMSTunnel add-ons, or a sign-in code – it hands the message to your phone, which sends it from your own number on your own SIM.

You link the site once: open SMSTunnel > Quick Setup, scan the QR code with the SMSTunnel app and approve the connection on your phone. You can remove the connection anytime in the app (Connections); from then on the site can no longer send through your phone. io dashboard (API Keys).

End-to-end encryption, on every plan. Turn it on in the SMSTunnel settings and your site encrypts its texts for your phone before they leave WordPress, so only your phone can read the words. Sign-in codes (2FA) are the exception: they are not encrypted.

We still see the number, your account, your phone and the time. After your phone sends it, a text travels over the mobile network like any other SMS.

io and have your phone send them.

Texts for Fluent Forms and Forminator, built in

If Fluent Forms or Forminator is active on your site, SMSTunnel adds its texts to it. No extra plugin is needed, and both work with the free versions.

• SMSTunnel SMS – a text to you or your team when someone submits a form. Several numbers allowed; each number gets its own text.

• SMSTunnel SMS (2) Autoresponder – a confirmation text to the person who filled in the form, at the number they entered.

Messages can include the answers from the form. Numbers must be in international format (+40…); numbers without the country code and premium-rate numbers are skipped.

• Fluent Forms: open the form, go to Settings & Integrations > Configure Integrations > Add New Integration, and pick SMSTunnel SMS or SMSTunnel SMS (2) Autoresponder. You can switch the integration off in Fluent Forms > Integrations.

• Forminator: activate SMSTunnel once in Forminator > Integrations. Then open the form, go to its Integrations tab and click + next to SMSTunnel.

SMSTunnel is not affiliated with, endorsed by, or sponsored by WPManageNinja (Fluent Forms) or WPMU DEV / Incsub (Forminator). Fluent Forms and Forminator are trademarks of their owners.

Key Features

• Your Own Phone and Number – Texts are sent from your SIM, on your mobile plan; recipients see your number and can reply

• Quick Setup by QR Code – Approve the connection on your phone, remove it anytime from the app

• Form Notifications – Built-in texts for Fluent Forms and Forminator: to you, and to the person who filled in the form

• Two-Factor Authentication – Optional SMS codes to secure WordPress logins

• End-to-End Encryption – Optional; messages are encrypted for your phone (RSA keys) before they leave your site

Emergency 2FA recovery

When SMS 2FA is required and the “server fallback” option is OFF (the secure default), a total SMS outage would lock every admin out of wp-login – and the fallback option can only be changed while logged in. php over FTP/SSH (or use WP-CLI) and add this line above the “That’s all, stop editing” comment:

define('SMSTUNNEL_2FA_EMERGENCY_BYPASS', true);

While this constant is true, admins can log in without entering a 2FA code. Every use is recorded in the PHP error log. Remove the line as soon as SMS delivery is restored.

Advanced users can instead hook the ‘smstunnel_2fa_emergency_bypass’ filter and return true.

External Services

This plugin connects to external services to provide certain functionality. Below are the details of each service:

SMSTunnel API

• Purpose: Core service that enables the plugin to communicate with the SMSTunnel mobile app for sending SMS messages from your phone

• When data is sent: During Quick Setup (when pairing via QR code), when sending SMS messages (including the texts you set up for Fluent Forms or Forminator forms, each time such a form is submitted), and when verifying API connections

• Data sent:

• During setup: Site URL, site token (random identifier), admin email (for account creation)

• When sending SMS: Phone number, message content (encrypted if E2E is enabled), API key for authentication. For form texts, the message contains the form answers you chose to include

• Service provider: SMSTunnel.io (NARBOWEB SRL)

• Privacy Policy: https://smstunnel.io/privacy

• Terms of Service: https://smstunnel.io/terms

SMSTunnel Authentication

• Purpose: Optional sign-in via Google, Facebook, or email to link your SMSTunnel account with WordPress

• When data is sent: Only when the admin uses the “Connect with Google/Facebook/Email” options on the plugin settings page

• Data sent:

• Google/Facebook: Redirects to smstunnel.io/auth/google or smstunnel.io/auth/facebook with a callback URL and CSRF state token

• Email login: Email and password sent to smstunnel.io/api/v1/auth/login

• After authentication: Fetches user profile from smstunnel.io/auth/me and creates an API key via smstunnel.io/api/v1/api-keys

• Service provider: SMSTunnel.io (NARBOWEB SRL)

• Privacy Policy: https://smstunnel.io/privacy

• Terms of Service: https://smstunnel.io/terms

js). No external QR code generation services are used. All SMS messages are sent through your own Android phone – the SMSTunnel server only acts as a relay to connect WordPress with your phone.