SMSTunnel

SMSTunnel links your WordPress site to your own Android phone. When your site needs to send a text – for example a form or order notification from one of the SMSTunnel add-ons, or a sign-in code – it hands the message to your phone, which sends it from your own number on your own SIM.

You link the site once: open SMSTunnel > Quick Setup, scan the QR code with the SMSTunnel app and approve the connection on your phone. You can remove the connection anytime in the app (Connections); from then on the site can no longer send through your phone. If you connected by signing in or with an API key instead, delete that key anytime in your smstunnel.io dashboard (API Keys).

With the same account you can also write texts on your computer at smstunnel.io and have your phone send them.

Key Features

• Your Own Phone and Number – Texts are sent from your SIM, on your mobile plan; recipients see your number and can reply
• Quick Setup by QR Code – Approve the connection on your phone, remove it anytime from the app
• Two-Factor Authentication – Optional SMS codes to secure WordPress logins
• End-to-End Encryption – Optional; messages are encrypted for your phone (RSA keys) before they leave your site

Emergency 2FA recovery

When SMS 2FA is required and the “server fallback” option is OFF (the secure default), a total SMS outage would lock every admin out of wp-login – and the fallback option can only be changed while logged in. To recover, edit wp-config.php over FTP/SSH (or use WP-CLI) and add this line above the “That’s all, stop editing” comment:

define('SMSTUNNEL_2FA_EMERGENCY_BYPASS', true);

While this constant is true, admins can log in without entering a 2FA code. Every use is recorded in the PHP error log. Remove the line as soon as SMS delivery is restored. Advanced users can instead hook the ‘smstunnel_2fa_emergency_bypass’ filter and return true.

External Services

This plugin connects to external services to provide certain functionality. Below are the details of each service:

SMSTunnel API

• Purpose: Core service that enables the plugin to communicate with the SMSTunnel mobile app for sending SMS messages from your phone
• When data is sent: During Quick Setup (when pairing via QR code), when sending SMS messages, and when verifying API connections
• Data sent:
  • During setup: Site URL, site token (random identifier), admin email (for account creation)
  • When sending SMS: Phone number, message content (encrypted if E2E is enabled), API key for authentication
• Service provider: SMSTunnel.io (NARBOWEB SRL)
• Privacy Policy: https://smstunnel.io/privacy
• Terms of Service: https://smstunnel.io/terms

SMSTunnel Authentication

• Purpose: Optional sign-in via Google, Facebook, or email to link your SMSTunnel account with WordPress
• When data is sent: Only when the admin uses the “Connect with Google/Facebook/Email” options on the plugin settings page
• Data sent:
  • Google/Facebook: Redirects to smstunnel.io/auth/google or smstunnel.io/auth/facebook with a callback URL and CSRF state token
  • Email login: Email and password sent to smstunnel.io/api/v1/auth/login
  • After authentication: Fetches user profile from smstunnel.io/auth/me and creates an API key via smstunnel.io/api/v1/api-keys
• Service provider: SMSTunnel.io (NARBOWEB SRL)
• Privacy Policy: https://smstunnel.io/privacy
• Terms of Service: https://smstunnel.io/terms

Note: QR codes are generated locally using an embedded JavaScript library (qrcode.min.js). No external QR code generation services are used. All SMS messages are sent through your own Android phone – the SMSTunnel server only acts as a relay to connect WordPress with your phone.