Your WhatsApp Business number was restricted. Now what?
Most merchant bans trace to one decision made at signup — and it isn't what you were sending.
A WhatsApp Business restriction is Meta limiting or removing your ability to send messages, and it arrives in stages rather than all at once. Understanding the ladder tells you how much trouble you are actually in, and what to do next.
The enforcement ladder
From Meta's policy enforcement documentation:
| Stage | What happens | Duration |
|---|---|---|
| 1 | Warning | — |
| 2 | Block on one message type (marketing, utility or authentication) | 1 to 3 days |
| 3 | Block on all messaging | 5, 7 or 30 days |
| 4 | Indefinite account lock | Appealable |
| 5 | Permanent offboarding | Final |
Named triggers include spam, template misclassification, high-risk categories — adult content, alcohol, tobacco, drugs, gambling, unsafe supplements — and excessive negative user feedback. Appeals go through Business Support Home and are typically decided in 24 to 48 hours.
The cause most merchants never suspect
A large share of merchant restrictions have nothing to do with what was sent. They come from how it was sent.
There are two ways to automate WhatsApp. One is the official Cloud API, which Meta provides and sanctions. The other is an unofficial route where a tool links itself to the WhatsApp Business app as a device — often set up by scanning a QR code — and drives it. The second is cheaper, needs no template approval, and is against WhatsApp's terms.
Merchants using such tools report being restricted while sending nothing but order confirmations, because the detection is on the automation pattern rather than the message content. One merchant reviewing such an app on the Shopify App Store put it precisely: their account was restricted after months of use, they had sent no broadcasts and no spam, and the cause was that the app connected by linking a device rather than through the official API.
How to tell which you have. If setup involved scanning a QR code with your phone, or the tool asks you to keep the WhatsApp Business app open or reconnect periodically, it is not the official API. If setup involved Meta Business Manager, a display name review and template approval, it is. ConvoFly uses the official Cloud API — which is also why templates need approving here and do not there.
The other common causes
- Messaging people who did not opt in. Blocks and reports are the strongest negative signal there is. See opt-in rules.
- Template misclassification. Repeatedly submitting promotional content as utility is a named trigger, not a clever saving. See utility versus marketing.
- Restricted categories. See what you cannot sell on WhatsApp.
- Volume with no engagement. Large sends that nobody replies to, repeatedly.
What to do in the first hour
- Read the notice. It names the stage and usually the reason. A 1–3 day block on one message type is very different from an indefinite lock.
- Stop sending. Pause broadcasts and switch off marketing automations. Continuing to push against a block makes stage 3 more likely.
- Do not create a second account. This reads as evasion and is a reliable route to permanent removal.
- Identify what changed. A new campaign, a new template, a new tool, a bought list — restrictions rarely arrive without a change.
- Appeal through Business Support Home, stating what happened and what you have changed.
What to fix before you resume
- Move to the official API if you were not on it. Nothing else matters until this is true.
- Cut your list to people who have engaged in the last 90 days.
- Re-audit template categories honestly.
- Add an easy opt-out and a per-contact frequency cap — opt-outs, frequency and quality covers both.
- Resume at low volume and watch the quality rating before scaling.
The warning sign before a restriction
Quality rating is the leading indicator. It moves from green to yellow to red based on recent user feedback — blocks and reports — and a downgrade usually precedes enforcement. Meta describes the rating in its Business Help Centre. Treat yellow as a stop signal rather than a caution: what to do when quality turns yellow.
The uncomfortable summary
Merchants who lose their number rarely lose it for one dramatic mistake. They lose it for a cheap setup decision made months earlier, compounded by a list that was never really opted in. Both are fixable in advance and neither is fixable afterwards.
Official API or linked device: how to tell, and why it decides everything
Because this is the cause behind most merchant restrictions, it is worth being able to identify in under a minute.
| Signal | Official Cloud API | Unofficial linked device |
|---|---|---|
| How you set it up | Meta Business Manager, display name review | Scanned a QR code with your phone |
| Templates | Must be approved by Meta before sending | None needed — send anything |
| Does the phone need to stay connected? | No | Yes, and it drops |
| Message charges | Billed by Meta per template message | Usually just a subscription |
| Ban risk | Normal policy risk | Structural |
The counter-intuitive part is that the unofficial route looks better on every line except the last one. No approval queue, no per-message fee, faster setup. That is precisely why merchants choose it, and why they are surprised when a compliant-looking operation gets restricted.
The detection is on the automation pattern rather than the message content, so "we only send order confirmations" is not a defence. If your setup involved a QR code, that is the finding, and no change to what you send will alter it.
A triage checklist for the first hour
- Read the notice and identify the stage. A 1–3 day block on one message type is a warning shot. An indefinite lock is not.
- Pause every marketing automation and broadcast. Leave transactional flows running if messaging is still permitted.
- Do not create another account or number. This single decision converts recoverable situations into permanent ones more often than anything else.
- Write down what changed in the last seven days. A new list, a new template, a new tool, a higher send volume. Restrictions rarely arrive without a change, and the appeal is stronger when you can name it.
- Appeal through Business Support Home, stating what happened, what caused it, and what you have already changed. Decisions typically come in 24 to 48 hours.
- Tell your team to stop sending manually too — a blocked automation is pointless if someone is broadcasting from the inbox.
What to fix before you resume
An appeal that succeeds and is followed by the same behaviour produces a second, longer block. The order that matters:
- Move to the official API if you were not on it. Nothing else counts until this is true.
- Cut the list to people who engaged in the last 90 days. Not everyone who ever bought — everyone who recently responded.
- Re-audit template categories honestly. Template misclassification is a named trigger, so a promotional message dressed as utility is an active risk, not a saving. See utility versus marketing.
- Fix the opt-out path and test it yourself. A customer who cannot leave blocks instead, and blocks are the strongest negative signal there is.
- Set a frequency cap rather than relying on judgement.
- Resume at a fraction of previous volume to your most engaged segment, and watch the quality rating for a week before scaling.
What you lose, and how to be less exposed next time
The reason this matters more than an equivalent email problem is that the number is an asset with your customers' side of the relationship attached: it is printed on your packaging, saved in their phones, and answering your ads. You cannot replace it by opening a new one.
Two things reduce the exposure without much effort. First, separate consent for order updates and marketing at checkout, so the customers who only want tracking never have a reason to block you — opt-in rules covers the structure. Second, lean on utility flows, which generate engagement rather than complaints and are free inside an open conversation window under Meta's pricing rules. A store whose WhatsApp presence is mostly order updates and support is very hard to get restricted.
Warning signs, in the order they appear
Restrictions are the end of a sequence, not the start of one. Each of these is a chance to act while it is still cheap:
- Opt-outs rising faster than opt-ins. The earliest signal, and the one nobody watches.
- Reply rates falling on transactional messages. People have stopped reading you, which means the next marketing send lands worse.
- Quality rating moves off green. Now you have days, not weeks.
- Error 131049 on campaigns. Sends are already being declined.
- A warning notice. The ladder has started.
By stage three you should have stopped marketing entirely. By stage four you are paying to be ignored. Full triage is in what to do when quality turns yellow.
Worth saying plainly: none of this is about being cautious for its own sake. A store that keeps its number healthy can send more, reach more people and pay less, because a good rating unlocks tier increases and most of its messages sit inside free conversation windows. Account health and commercial performance are the same thing here, not a trade-off.
Frequently asked questions
Why was my WhatsApp Business account restricted when I only send order confirmations?
Most often because the tool sending them connects by linking a device rather than through the official Cloud API. Detection is on the automation pattern, not the message content, so compliant messages sent through a non-compliant route still trigger restrictions.
How long do WhatsApp restrictions last?
Meta's ladder runs from a warning, to 1–3 day blocks on one message type, to 5, 7 or 30-day blocks on all messaging, to an appealable indefinite lock, to permanent removal.
How do I appeal a WhatsApp Business restriction?
Through Business Support Home. Appeals are typically decided in 24 to 48 hours. Do not create a second account in the meantime — that reads as evasion.
How can I tell if I am on the official WhatsApp API?
If setup involved scanning a QR code, or the tool asks you to keep the WhatsApp Business app open or reconnect periodically, it is not official. The official Cloud API involves Meta Business Manager, a display name review and template approval.