SMSTunnel

SMSTunnel transforms your Android phone into a powerful SMS gateway for WordPress.

Key Features

• Use Your Own Phone – No third-party SMS gateway costs
• Two-Factor Authentication – Secure WordPress login with SMS 2FA
• End-to-End Encryption – Messages encrypted with RSA keys
• Quick Setup – Scan QR code from the mobile app

Emergency 2FA recovery

When SMS 2FA is required and the “server fallback” option is OFF (the secure default), a total SMS outage would lock every admin out of wp-login – and the fallback option can only be changed while logged in. To recover, edit wp-config.php over FTP/SSH (or use WP-CLI) and add this line above the “That’s all, stop editing” comment:

While this constant is true, admins can log in without entering a 2FA code. Every use is recorded in the PHP error log. Remove the line as soon as SMS delivery is restored. Advanced users can instead hook the ‘smstunnel_2fa_emergency_bypass’ filter and return true.

External Services

This plugin connects to external services to provide certain functionality. Below are the details of each service:

SMSTunnel API

• Purpose: Core service that enables the plugin to communicate with the SMSTunnel mobile app for sending SMS messages from your phone
• When data is sent: During Quick Setup (when pairing via QR code), when sending SMS messages, and when verifying API connections
• Data sent:
  • During setup: Site URL, site token (random identifier), admin email (for account creation)
  • When sending SMS: Phone number, message content (encrypted if E2E is enabled), API key for authentication
• Service provider: SMSTunnel.io (NARBOWEB SRL)
• Privacy Policy: https://smstunnel.io/privacy
• Terms of Service: https://smstunnel.io/terms

SMSTunnel Authentication

• Purpose: Optional sign-in via Google, Facebook, or email to link your SMSTunnel account with WordPress
• When data is sent: Only when the admin uses the “Connect with Google/Facebook/Email” options on the plugin settings page
• Data sent:
  • Google/Facebook: Redirects to smstunnel.io/auth/google or smstunnel.io/auth/facebook with a callback URL and CSRF state token
  • Email login: Email and password sent to smstunnel.io/api/v1/auth/login
  • After authentication: Fetches user profile from smstunnel.io/auth/me and creates an API key via smstunnel.io/api/v1/api-keys
• Service provider: SMSTunnel.io (NARBOWEB SRL)
• Privacy Policy: https://smstunnel.io/privacy
• Terms of Service: https://smstunnel.io/terms

Note: QR codes are generated locally using an embedded JavaScript library (qrcode.min.js). No external QR code generation services are used. All SMS messages are sent through your own Android phone – the SMSTunnel server only acts as a relay to connect WordPress with your phone.