Close
Case study · 02

WhatsApp
OTP Login

Passwordless sign-in and sign-up for WooCommerce. Customers type their phone number, get a 6-digit code on WhatsApp, and they’re in — no email, no password.

Platform
WordPress · WooCommerce
Channel
WhatsApp · Email fallback
Security
Bot protection · Rate limits
Compliance
Consent records (KVKK)
The problem
Sign-up forms were losing customers.

Email, password, confirm password, verify your inbox… On an e-commerce site, every one of those steps is a reason to give up before the first order.

The solution
One number. One code. Seconds.

Customers sign up or sign in with a single WhatsApp code. Once the classic form was replaced, registrations rose sharply.

10:42●●●
My account
Sign in or
create an account
No password needed. We’ll send a code to your WhatsApp.
Phone number
+90532 000 00 00
Send code via WhatsApp
Protected by bot verification
01
Type your number
10:42●●●
S
Your Store ✓
Business account
Today
Your verification code: 482913. For your security, do not share this code.
10:42
⧉ Copy code
02
Get the code on WhatsApp
10:42●●●
Verify
Enter the
6-digit code
Sent to +90 532 *** ** 00 on WhatsApp
4
8
2
9
1
3
Code expires in 4:38
✓
You’re signed in
Redirecting to the shop…
03
You’re in
Why it works

Every field you remove is a customer you keep.

Classic sign-up
5 steps
Email address
Password
Confirm password
Check your inbox
Click the link, then log in
With WhatsApp
2 steps · seconds
Phone number
6-digit code
No email to confirm, no password to forget — the same two steps for signing in and signing up.
Result
2,734
customers signed up with WhatsApp — without ever typing an email address.
After the code

One form, two outcomes — decided automatically.

Code verified
Number matched, code still valid
Number already registered
Signed in instantly
Redirected
Home, shop, My Account or checkout — set in settings
New number
Terms, KVKK & privacy
Shown in a pop-up to accept
Account created & signed in
Consent, date and IP saved to the user
Under the hood

Built to be the only door in.

The only way to sign up

WordPress registration, WooCommerce’s “create account” options on My Account and checkout, and user creation over the REST API are all switched off.

No email required

Each new account gets a placeholder address based on the phone number. Nothing is ever sent to it — not even WooCommerce’s new-account email.

Consent on record

Agreement, date and IP address are written to the user record — proof of consent for KVKK.

One phone format

Every number is normalised (90532…) and stored in a dedicated phone column that sign-in looks up.

Security

Fast for customers, hard for everyone else.

5 min
Code lifetime
5 tries
Then the code is voided
60 s
Between codes to the same number
10 / hr
Codes per IP address

Invisible bot protection checks every request in the background.

Legacy XML-RPC is disabled — an old attack surface closed.

Two-step for staff

Admins, editors, shop managers and couriers must enter their password after the code. A staff account can never be opened with a phone code alone.

Admin side

Every setting in one place.

Choose the channel: WhatsApp, or email as a fallback.

Connect the WhatsApp Business account and pick the approved message template.

Set the code lifetime, the page to land on after sign-in, bot-protection keys and the sender name and address.

Add a test number that skips the rate limits, then test the connection or send a test code.

Edit any customer’s phone number right from their user profile.

OTP Login · Settings
Connected
Channel
WhatsApp
Email
Message template
otp_login
Code lifetime
5 minutes
After sign-in, go to
Home ▾
Bot protection
● Enabled
Test number
+90 5•• ••• •• ••
Test connection
Send test code
Next case study · 03
Address Book
WooCommerce module