Phone Number Verification (SMS OTP) for WHMCS
Clients confirm their phone number with a one-time SMS code at signup or checkout, sent through your own SMS provider, with resend limits and lockouts.
What will the phone verification module do?
When a client signs up, or when they reach checkout if you prefer, the module texts a six-digit code to the phone number on their profile. They enter it, and the number is marked verified with the date. Until then they cannot complete checkout. If they change the number later, the new one has to be verified too. Staff see a verified or unverified badge on the client profile and can reset a number or mark it verified by hand.
This product is built to order: you get the license key once your account has been checked and the download within 10 business days of purchase.
What does WHMCS already do, and what does this add?
WHMCS stores a phone number on each client profile, lets you make the field optional, and can verify email addresses with a link. Its two-factor login works with time-based tokens, Duo Security and YubiKey. It cannot send an SMS or check that a phone number belongs to the person ordering. This module adds that check through an SMS provider you already pay for.
What is included?
| Part | What you get |
|---|---|
| When | At signup, at checkout, or both |
| Codes | Six digits, single use, valid for the minutes you set |
| Sending | Your own SMS provider account and API key |
| Resend limits | Wait time between codes and a maximum per hour, per number and per IP address |
| Lockout | After the number of wrong codes you set, for the period you choose |
| Countries | Codes sent only to the country codes you allow |
| Badge | Verified or unverified, on the client profile and in the client area |
| Log | Every code sent and every attempt, with the number partly masked |
Who is it for?
Hosts who get signups with made-up numbers, who phone clients about abuse reports or overdue accounts, or who sell servers and domains where a reachable owner matters. If you message clients on WhatsApp, my WhatsApp Cloud API module has its own phone opt-in check.
What do you need, and what are the limits?
Requirements: WHMCS 8.13 or 9.x (I confirm your exact version at purchase), PHP 8.1 or newer, and an account with an SMS provider that offers an HTTP API. Tell me your provider at purchase and I connect it; you enter your own API key and pay for each message.
Limits: a verified number proves the client could receive a text on it once, not who they are, and virtual numbers can pass. Delivery depends on your provider and the destination country. The country list and send limits matter because bots that request codes to costly destinations can run up an SMS bill.
It costs $49 once for a lifetime license with twelve months of updates and support, and a seven-day refund window. I check each new account by hand, which can take up to 24 hours, before the license key is issued, and the download follows within 10 business days of purchase.
Key features
- Six-digit SMS code at signup, at checkout or both
- Checkout blocked until the phone number is verified
- New verification when a client changes their number
- Sent through your own SMS provider account and API key
- Single-use codes with an expiry you set
- Resend wait and hourly limits per number and IP address
- Lockout after repeated wrong codes
- Allowed country codes to keep SMS costs in check
- Verified badge on the client profile and in the client area
- Staff reset or manual verification, with a log of every send and attempt
Why customers buy this module
- →Fewer fake signups with made-up phone numbers
- →A working number on file when you need to call a client
- →SMS spending stays under control with limits and a country list
Frequently asked questions
Which SMS providers does it work with?
Any provider with an HTTP API for sending SMS. Because the module is built to order, you tell me at purchase which provider you use and I connect that one. You enter your own API key in the module settings, it stays on your WHMCS server, and the provider bills you directly for each message.
What happens if a client cannot receive the SMS?
They can ask for a new code after the wait time you set, up to your hourly limit. If it still does not arrive, they contact you, and your staff can mark the number verified from the client profile, which is logged with the staff member's name. Clients whose number is in a country you have not allowed see a message asking them to contact support.
When will I get it, and what if you can't deliver?
It is built to order. Your account is checked by hand, which can take up to 24 hours, and then you get the license key; the download arrives within 10 business days of purchase. If I do not deliver it in that time, you get a full refund. Once it is delivered, the store's 7-day refund window applies.
Technical specifications
- WHMCS
- 8.13 and 9.x (confirmed at purchase)
- PHP
- 8.1+
- SMS provider
- Your own account with an HTTP API, connected at build time
- Code
- 6 digits, single use, expiry and attempt limits set by you
- Availability
- Built to order, delivered in 10 business days
- License
- Lifetime, 1 year of updates and support included
- Delivery
- License key after a manual account check (up to 24 hours); download when built
- Refund window
- 7 days
Related modules
KYC Identity Verification Module for WHMCS
I built this KYC module to stop fraudulent signups before anything is provisioned. Customers upload ID and address proof, you review them in a queue or by API, and documents stay encrypted on your own server.
Security Hardening and Recovery Module for WHMCS
I built this module to harden a WHMCS install. It spots and blocks exploit attempts, enforces 2FA, scans for malware, sandboxes third-party addons and themes, and takes secure backups you can restore in one click.
German Legal Compliance Addon for WHMCS
I built this addon for a hosting company selling to consumers in Germany. It logs which version of your terms, privacy policy and cancellation policy each customer agreed to, gives customers an online withdrawal form, and adds receipt time and contract end to every cancellation confirmation.