Send WhatsApp Messages Using PHP cURL Without Getting Banned

15 Sep 2026·8 min read

You run an e-commerce store in Mumbai or a delivery service in Lahore. Every day, you get dozens of orders. Half of your Cash on Delivery (COD) customers enter fake addresses or typo-ridden phone numbers. You want to trigger an automated WhatsApp message the second an order is placed: "Please reply with 1 to confirm your order."

You searched for a PHP cURL example because you want a direct, lightweight script. You do not want to pay for an expensive Shopify or WooCommerce app that charges a heavy markup on every message. You want to connect your own server directly to WhatsApp.

This guide will show you exactly how to do that using the official Meta Cloud API. We will write the code, look at the real costs, and cover the traps that get your number blocked.

The Two Ways to Send WhatsApp Messages via PHP

Before you write a single line of code, you must choose between the official route and the unofficial route. Making the wrong choice here will ruin your customer communication.

The Unofficial Route: Web Scrapers and Puppeteer (Avoid This)

You will find scripts online that use headless browsers to control WhatsApp Web. They promise "free unlimited messages" using a QR code scan.

Do not use them.

Meta actively monitors accounts for automated browser behavior. If you send 50 automated messages in an hour from a personal WhatsApp number using a scraper, Meta will ban your number. You will lose your chat history, your customers will see a "banned" status, and you will have to buy a new SIM card. It is a bad idea for any real business.

The Official Route: Meta Cloud API (Use This)

This is the official API hosted by Meta. It is fast, reliable, and your number will not get banned if you follow their basic commerce policies.

Meta charges you per "conversation" (a 24-hour window). The exact cost depends on your country and the category of the message (Utility, Authentication, or Marketing). For example, a utility message (like an order confirmation) sent to a user in India or Pakistan costs a fraction of a rupee. You can check the exact current rates directly on the Meta WhatsApp Business Pricing page.

Prerequisites for the PHP cURL Script

To run the script below, you need three things from your Meta Developer console:

A Temporary or Permanent Access Token: This authenticates your PHP script.
A Phone Number ID: This is a unique string of numbers Meta assigns to your sender phone number. It is not the actual phone number itself.
An Approved Message Template: You cannot send free-form text messages to customers who have not messaged you first in the last 24 hours. You must use a pre-approved template (for example, a welcome message or order alert).

To get these, sign up at developers.facebook.com, create a Business App, and add the WhatsApp product to your app. Meta will provide a test phone number and a temporary access token to test your code immediately.

The PHP cURL Code Example

Below is a clean, production-ready PHP script using cURL. It formats the data into JSON, sets the correct headers, and sends the request to Meta's servers.

<?php

// Replace these variables with your actual Meta Developer credentials
$accessToken = 'YOUR_META_ACCESS_TOKEN';
$phoneNumberId = 'YOUR_PHONE_NUMBER_ID';
$recipientNumber = '923001234567'; // Use country code without + or 00
$templateName = 'order_confirmation'; // Must match your approved template name in Meta dashboard
$languageCode = 'en_US';

// The API endpoint URL (we are using API version v20.0)
$url = 'https://graph.facebook.com/v20.0/' . $phoneNumberId . '/messages';

// Define the payload for a template message with two variables (Customer Name and Order ID)
$payload = [
    'messaging_product' => 'whatsapp',
    'to' => $recipientNumber,
    'type' => 'template',
    'template' => [
        'name' => $templateName,
        'language' => [
            'code' => $languageCode
        ],
        'components' => [
            [
                'type' => 'body',
                'parameters' => [
                    ['type' => 'text', 'text' => 'Ali'], // Variable 1 (Name)
                    ['type' => 'text', 'text' => '#9845'] // Variable 2 (Order ID)
                ]
            ]
        ]
    ]
];

// Convert payload to JSON
$jsonPayload = json_encode($payload);

// Initialize cURL session
$ch = curl_init($url);

// Set cURL options
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $jsonPayload,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . $accessToken,
        'Content-Type: application/json'
    ],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_SSL_VERIFYPEER => true // Always keep this true in production for security
]);

// Execute the request
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

// Check for cURL execution errors
if (curl_errno($ch)) {
    echo 'cURL Error: ' . curl_error($ch);
} else {
    curl_close($ch);

    // Parse response
    $responseData = json_decode($response, true);

    if ($httpCode === 200) {
        echo "Message sent successfully! Message ID: " . $responseData['messages'][0]['id'];
    } else {
        echo "Error sending message. HTTP Status Code: " . $httpCode . "\n";
        print_r($responseData);
    }
}
?>

How the Code Works

First, we build the payload array. Meta requires specific formatting. The messaging_product key must always be set to whatsapp. The to field requires the recipient's phone number with the country code, but without any leading zeros, plus signs, or spaces. For example, a Pakistani number becomes 923001234567, and an Indian number becomes 919876543210.

Next, we use json_encode(). Meta's API only accepts raw JSON payloads. If you try to send the data as a standard form-urlencoded POST request, Meta will return a 400 Bad Request error.

We then set our headers. The Authorization header must contain the word Bearer followed by a space and your access token. Miss that space, and you will get a 401 Unauthorized error.

Finally, we capture the HTTP status code. A successful API call returns 200 OK. If anything goes wrong, Meta returns detailed JSON error messages explaining what failed.

Common Mistakes That Will Break Your Script

If you copy this code and run it, you might hit a few speed bumps. Here are the most common issues developers face when setting this up.

Using a Temporary Token in Production

When you set up a test account on Meta, they give you a temporary token. This token expires exactly 24 hours after you generate it. Your script will work perfectly during testing, but the next morning, your system will throw OAuthException errors.

You must generate a permanent System User Token in your Meta Business Manager console to use this in production.

Disabling SSL Verification

Many developers get an SSL certificate error when running cURL on their local machines (like XAMPP or WAMP). To bypass this, they add CURLOPT_SSL_VERIFYPEER => false to their script.

Do not do this in production. It exposes your server to man-in-the-middle attacks. Your WhatsApp API credentials can be intercepted. Instead, download the latest cacert.pem file from the official curl website, update your php.ini file to point to it, and keep SSL verification active.

Incorrect Recipient Formatting

If you pass a phone number like +92-300-1234567, the API will fail. You must strip all non-numeric characters before sending the payload. Use a simple PHP regex to clean the input before passing it to cURL:

$cleanNumber = preg_replace('/[^0-9]/', '', $rawNumber);

When to Use WA Link Instead of Direct cURL

Writing raw PHP cURL code gives you complete control, but it also means you have to build your own dashboard, manage webhook event listeners, handle opt-out requests, and manage template approvals manually inside the Meta Developer interface.

At WA Link, we provide an API wrapper that simplifies this process. We handle the complex Meta configurations and offer a clean API endpoint for developers who want to send messages without navigating Meta's complicated Developer Console.

However, we do not bypass WhatsApp's core rules. You still need to use approved templates for outbound messages, and you must respect user opt-out requests to keep your quality rating high.

Frequently Asked Questions

Do I need a credit card to start testing?

No. Meta allows you to use a sandbox environment with a free test phone number and up to 5 registered recipient numbers without adding a payment method. You will only need to add a credit card when you transition to a live business phone number.

Can I send free-form text messages using PHP?

Only if the customer has sent you a message first within the last 24 hours. Once a user initiates a conversation, a 24-hour "customer service window" opens. During this window, you can send free-form text messages using PHP. Once that window closes, you must use an approved template again.

Why does my script work on localhost but fail on my live server?

This is usually due to firewall restrictions or outdated software. Some shared hosting providers block outbound ports or have old versions of cURL and OpenSSL installed that do not support Meta's security protocols. Check with your hosting provider to ensure outbound HTTPS requests on port 443 are allowed.

Can I send PDFs or images using PHP cURL?

Yes. You can send media by changing the type key in your JSON payload from template to document or image, and providing a direct public URL to the file in your payload. Meta will download the file from your server and deliver it to the user.

Read the API documentation