WooCommerce Order Notifications via WhatsApp: A Webhook Setup Guide

WooCommerce ships with a REST API webhook system that most stores never touch beyond the default email notifications. That's a missed opportunity: WhatsApp open rates beat email by a wide margin, and WooCommerce's native webhooks give you everything you need to trigger a WhatsApp message the moment an order changes status — no paid "WhatsApp for WooCommerce" plugin, no extra monthly fee on top of your messaging plan.

Why use native webhooks instead of a plugin

Most WooCommerce WhatsApp plugins are thin wrappers around a webhook call you could configure yourself in five minutes, and they usually charge a recurring fee for the privilege. Wiring WooCommerce's own webhook system straight to the TextMeFlow API means you own the message copy, the trigger conditions and the timing, and everything runs on a single pricing plan instead of stacking a plugin subscription on top of your WhatsApp costs.

Step 1: Create the webhook in WooCommerce

In your WordPress admin, go to WooCommerce → Settings → Advanced → Webhooks → Add webhook and configure:

• Topic: Order updated (fires on every status change — pending, processing, completed, cancelled)
• Delivery URL: an endpoint you control, e.g. https://yoursite.com/wc-webhooks/order-status
• Secret: generate a random string and store it — WooCommerce signs every payload with it via the X-WC-Webhook-Signature header

A single webhook on the Order updated topic is enough for most stores — you branch on order.status inside your handler rather than registering one webhook per status, which keeps the WooCommerce side simple.

Step 2: Verify the signature and receive the payload

A minimal PHP receiver, since WooCommerce runs on PHP and your endpoint likely does too:

<?php
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WC_WEBHOOK_SIGNATURE'] ?? '';

$expected = base64_encode(hash_hmac('sha256', $payload, getenv('WC_WEBHOOK_SECRET'), true));
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('invalid signature');
}

$order = json_decode($payload, true);
$phone = $order['billing']['phone'] ?? null;
$status = $order['status'] ?? null;

if (!$phone || !$status) {
    http_response_code(200);
    exit; // nothing to send
}

Always verify the signature before trusting the body — WooCommerce webhook URLs are guessable, and an unverified endpoint is an open door for spoofed order data. It's the same discipline TextMeFlow expects on its own outgoing webhooks: HMAC-signed, verify or discard.

Step 3: Map order status to a message and send it

Only a handful of statuses are worth notifying on — spamming every internal transition (on-hold, pending) annoys customers and burns your message quota:

$messages = [
    'processing' => "Hi {$order['billing']['first_name']}, we've received your order #{$order['id']} and it's being prepared.",
    'completed'  => "Your order #{$order['id']} has shipped! Track it here: {$tracking_url}",
    'cancelled'  => "Your order #{$order['id']} was cancelled. Reply here if that's unexpected.",
];

if (isset($messages[$status])) {
    $ch = curl_init('https://api.textmeflow.eu/v1/messages');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            'Authorization: Bearer ' . getenv('TEXTMEFLOW_API_KEY'),
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS => json_encode([
            'to' => $phone,
            'text' => $messages[$status],
        ]),
    ]);
    curl_exec($ch);
    curl_close($ch);
}

Full request and response fields, including how to attach an invoice or packing slip as media, are in the API reference.

Handling phone number formatting

WooCommerce stores the billing phone number exactly as the customer typed it — with or without a country code, with spaces or dashes. Normalize it to E.164 (+32...) before sending, or messages will silently fail. A simple approach: strip everything but digits and a leading +, and if there's no +, prepend your store's default country code as a fallback assumption, then let customers correct it via their WooCommerce account if delivery fails.

Don't forget replies and opt-out

Customers will reply to these messages — "where's my order," "can I change the address." Configure an inbound webhook in your TextMeFlow portal to route replies into your helpdesk or CRM instead of leaving them stranded in WhatsApp. And because these are transactional messages tied to an actual purchase, they're low-risk for deliverability, but TextMeFlow's anti-spam pipeline — rate limits, STOP handling, quiet hours — still applies automatically to every message you send, so a burst of orders during a flash sale won't get your number flagged.

Try it

If you're running WooCommerce and currently rely on email-only order updates, this webhook-to-API path takes under an hour to wire up and costs nothing beyond your existing plan. Sign up free and send your first 50 WhatsApp order notifications this month at no cost.