Key Takeaways
- The shared-hosting myth is that an Android SMS gateway can live as a cPanel PHP app the way WordPress does. The radio is a phone with a SIM.
- Shared PHP can call POST /messages if you keep the key off the docroot. It cannot replace the handset.
- This is not a packaged PHP SDK. HTTPS JSON samples only.
- Cron on a noisy neighbour host is a poor OTP SLO.
- Service pricing is based on device count and total SMS sent through the gateway. You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance.
The Android SMS gateway shared hosting myth shows up in CodeCanyon-adjacent searches: “upload PHP, send SMS.” Shared hosting is a website crate. An Android SMS gateway is a phone plus a control plane. Mixing the two is how API keys land in public_html and OTP dies at 02:00 when the cron neighbour saturates CPU.
Service pricing is based on device count and total SMS sent through the gateway. Architecture: server guide. Samples: PHP HTTPS examples (not an SDK).
If the SIM is not in a room you can walk to, you do not have a gateway. You have a curl wrapper.
The myth
“Cheap cPanel = SMS server.” That was maybe true for email injection in 2008. Mobile operators do not terminate SMS from a PHP process. They terminate from a radio.
What shared hosting can and cannot do
| Job | Shared PHP | Android + control plane |
|---|---|---|
| Hold the API key | Risky if in webroot | Env on a server you control |
| POST /messages | Possible, fragile timeouts | Same HTTPS from any backend |
| Send the SMS | No | The paired phone |
| OTP SLO at 2am | Noisy neighbours | Phone power + your queue |
PHP on cPanel is a client, not a modem
If you must call from PHP, keep secrets outside the docroot and treat it like any other HTTP client:
curl -X POST "https://app.sms-gateway.app/api/v1/messages" \
-H "Authorization: Bearer $SMS_GATEWAY_API_KEY" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: 3f1b0c8a-9d2e-4c77-9f5a-2b6d1e0f4a83" \
-d '{"to":["+14155552671"],"text":"Your verification code is 481920","type":"sms"}'You need a working Android phone with a SIM and SMS credit from your mobile operator. Operator message costs are yours—we do not sell carrier SMS balance.
Timeouts, keys, and neighbours
Shared hosts kill long workers. Idempotency still matters. Retry backoff. Do not put keys in a theme file — same lesson as shop webhooks.
Where the radio actually lives
Pair the handset. Setup. Optional local control plane is still a real server, not a $3 WordPress plan. API docs.
Checklist
- No expectation that cPanel sends SMS.
- Key not in public_html.
- Phone paired and charged.
- OTP not scheduled on a crowded shared cron.
- Samples not labeled as an SDK product.
Next steps
Put the worker on a host you control, pair via downloads, and leave shared hosting for the brochure site.
Related product pages
Jump to the live product docs for this topic—not another long-form article.
- device and SMS volume pricingPlans and allowances
- Android SMS gateway product guideDefinition, product, and how to buy
- SMS API documentationLive endpoint reference
- download the Android gateway appGet the APK
