Connecting WordPress to the WhatsApp Business API

There are two ways to reach the WhatsApp Business Platform. Meta's Cloud API is hosted by Meta and accessed directly with a Meta developer app, a WhatsApp Business Account and a verified phone number. You pay Meta's message charges and nothing else, and you build the integration yourself.

Alternatively, a Business Solution Provider — Gupshup, Interakt, AiSensy and Wati are common in India — wraps the same platform in a dashboard, a team inbox, campaign tools and usually a WordPress or WooCommerce plugin. They add a monthly fee or a markup on messages in exchange for not having to build or host anything.

For a store that only needs order notifications and a handful of replies, the Cloud API with a small custom plugin is cheap and has no lock-in. For a team that will run support conversations all day, a provider's inbox is worth paying for. Either way, decide early which number to use. Meta now lets some WhatsApp Business app numbers keep working in the app alongside the API, but with limitations, so a dedicated number for automated messages is still the simplest setup.

WhatsApp separates two kinds of message. When a customer messages you, a 24-hour customer service window opens and you can reply freely. Outside that window — and an order notification is almost always outside it — you can only send a message template that Meta has approved in advance.

Templates are written with numbered placeholders, such as a greeting with {{1}} for the customer's name and {{2}} for the order number, and submitted under one of three categories: utility for transactional updates such as order and delivery notifications, authentication for one-time passwords, and marketing for anything promotional. Approval is usually quick, but rejections are common for vague wording or promotional language in a utility template.

Keep utility templates strictly factual. A shipping update that adds a discount code is a marketing message, and Meta will either reject it or recategorise it — at the higher marketing rate.

WooCommerce already announces every event you would want to message about. woocommerce_payment_complete fires when payment succeeds, woocommerce_order_status_processing and woocommerce_order_status_completed fire on those status changes, and you can hook a custom shipped status if your fulfilment process uses one.

Do not call the WhatsApp API directly inside those hooks. A slow API response would hold up checkout or the admin screen, and a failure would be lost. Instead, queue the message with Action Scheduler, which WooCommerce bundles: as_enqueue_async_action schedules a background job with the order ID, and the job builds the template payload and sends it, retrying if the request fails.

• Normalise the phone number to international format with the country code, because customers type numbers every possible way at checkout.
• Store the returned message ID on the order, so delivery and read receipts from the webhook can be matched back to it.
• Add an order note for every message sent or failed, so the shop team can see what the customer received without opening another tool.
• Keep the access token in wp-config.php or an environment variable, never in the database or the plugin's code.

Customer replies, delivery statuses and read receipts arrive by webhook. In WordPress the cleanest home for that is a custom REST API route registered with register_rest_route, for example under a namespace belonging to your plugin.

Meta verifies the endpoint once with a GET request containing a mode, a challenge and the verify token you chose; your route checks the token and echoes the challenge back. After that, every event arrives as a POST with an X-Hub-Signature-256 header, which is an HMAC-SHA256 of the raw request body signed with your app secret. Compute the same HMAC and compare the two with hash_equals before trusting anything in the payload.

Respond with a 200 quickly and process the event in the background. Meta retries webhooks that fail or time out, so your handler should also ignore message IDs it has already processed.

WhatsApp requires that a person has agreed to receive messages from your business on WhatsApp before you send them anything. For a store, the natural place is a clearly labelled checkbox at checkout, unticked by default, saying they would like order updates on WhatsApp.

Save that consent on the order and the customer record with a timestamp, honour any 'stop' reply immediately, and do not reuse transactional consent for marketing campaigns. Every number has a quality rating based on how recipients respond; when people block or report your messages, the rating drops and your sending limits shrink. Sending only what customers asked for is both the rule and the best way to keep the account healthy.

Meta charges per delivered template message, with the rate depending on the template category and the recipient's country. India has its own rate card, and marketing messages cost noticeably more than utility and authentication messages. Replies within an open customer service window are free, and utility templates sent inside that window are free as well. Rates change, so check Meta's current pricing page before quoting a client a monthly figure.

To keep costs predictable, send fewer, better messages: one confirmation and one shipping update per order is usually enough. Categorise templates honestly, because a mislabelled marketing message costs more anyway. And if you use a provider, read how their fee is calculated — a flat monthly plan and a per-message markup add up very differently as order volume grows.