title: WhatsApp anti-ban playbook: safe messaging practices for bots description: >- The WhatsApp anti-ban playbook for bot builders in 2026. Inbound-first rules, safe-send checklists, account warm-up, and how to stay healthy long-term. date: '2026-07-15' author: Rebecca Pearson authorAvatar: /blog/authors/rebeca-avatar.webp category: Resources cover: /blog/whatsapp-anti-ban-playbook/blog-thumbnail-blank.png readingTime: 7 tags:
- WhatsApp anti-ban
- WhatsApp bot safe messaging
- WhatsApp automation ban prevention
- WhatsApp business API safety sourceUrl: 'https://www.codewords.ai/blog/whatsapp-anti-ban-playbook'
Getting your WhatsApp number banned kills your automation overnight. Worse, Meta can ban the number, the device, or even the Business API account — and appeals are slow and rarely successful. This playbook gives you actionable rules for every stage: before you connect, while you're running, and how to maintain a healthy account over time.
TL;DR
- Inbound-first is the safest pattern. Let customers message you before your bot sends anything. Meta rewards this explicitly.
- The safe-send checklist — delays, daily caps, personalisation, opt-out honoring, deduplication — covers the signals Meta monitors most closely.
- Account warm-up is non-negotiable. New numbers that immediately send high volumes are flagged before they send a single outbound message.
Understand what Meta monitors — the foundation of your WhatsApp anti-ban strategy
Meta's trust system scores your WhatsApp account on several signals. Understanding these helps you see why the rules below exist.
Reply rate. If you send outbound messages and recipients don't reply, your score drops. High reply rates signal that people want to hear from you. Low reply rates signal spam.
Send velocity. A sudden jump from 0 to 500 messages per day is a red flag. Gradual volume increase looks like natural business growth.
Block rate. If a significant number of recipients block you or report you as spam, Meta acts quickly. Even a handful of reports in a short window can trigger a review.
Identical content. Sending the same message repeatedly to different contacts — especially without personalisation — is a spam signal. Meta's systems detect template repetition.
Number age and history. New numbers with no prior WhatsApp history that immediately start sending outbound automation are high-risk. Old numbers with a track record of legitimate use are lower risk.
Most bans are preventable if you understand these signals. The rules below are designed to keep each signal healthy.
The inbound-first rule in detail
The safest WhatsApp automation pattern is inbound-first: your bot only responds to messages that customers initiate.
Here's why this matters at a signal level. When a customer messages you first, they've opted into the conversation. Your reply rate is structurally high (they sent a message, they're expecting a response). Your block rate is low (they chose to contact you). Your content relevance is high (you're answering their specific question).
When you send outbound messages to contacts who didn't ask to hear from you, every one of these signals inverts. Even if your content is genuinely useful, the mechanics of cold outbound put you at risk.
Inbound-first isn't just the safe choice — it's also the higher-quality automation pattern. Customers who message you are further along in their decision-making. The conversations are more productive.
If you do need to send outbound — follow-ups, reminders, re-engagement — use the Business API with approved message templates, send only to contacts who have explicitly opted in, and follow the safe-send checklist below.
The safe-send checklist
Use this before running any outbound campaign or scheduled messaging sequence.
Add delays between messages. Don't send in rapid bursts. A minimum of two to five seconds between messages, with some randomisation, looks more like human behaviour. For bulk sends, space messages at least 60–90 seconds apart.
Respect daily volume caps. On a fresh Business API account, start with 50–100 messages per day maximum. Increase by no more than 20–30% per week. A Personal Device connection is even more conservative — stay under 50 outbound messages per day during warm-up.
Personalise every message. At minimum, use the recipient's name. Better: reference something specific to their situation (last purchase, appointment type, location). Identical messages to different recipients are a spam signal regardless of content quality.
Honour opt-outs immediately. If someone replies "stop," "unsubscribe," "remove me," or anything similar, they should receive no further messages within seconds. Build this into your bot's logic as a hard rule, not a soft guideline.
Deduplicate your send lists. Sending the same person the same message twice in a short window triggers both block reports and algorithmic flags. Deduplicate before every send.
Have a kill switch. Before any campaign goes live, you should be able to pause all outbound messaging with a single action. This is your emergency brake — use it the moment you see unusual block rates or report spikes.
What to do before connecting any automation
Warm up the account
Account warm-up is the process of establishing a normal usage history before adding automation. Meta's systems use historical behaviour as a baseline. If your number has never sent more than five messages a day and suddenly runs 500 automated replies, it looks suspicious — even if those replies are entirely legitimate.
For a new number:
- Week one: use it manually. Send real conversations to real contacts. Keep volume low (five to 15 messages/day).
- Week two: introduce light automation. Start with inbound replies only. Keep inbound volume under 50/day.
- Week three onwards: gradually increase volume. Stay under 100/day for the first month on a Personal Device.
For a Business API account:
- Meta provides a formal tier system (Tier 1: 1,000 conversations/day; Tier 2: 10,000/day; Tier 3: 100,000/day). You start at Tier 1 and move up based on message quality metrics.
- Rushing tier increases by trying to push volume artificially is one of the fastest ways to get flagged.
Check your number's history
If you're connecting an existing phone number, check whether it has any WhatsApp history that could affect your starting position. Numbers that have been used for spam in the past — even by a previous owner — can start with a disadvantaged trust score.
Test with a small inbound-first pilot before committing to a full build.
Maintaining a healthy account over time
Getting through the first month without a ban doesn't mean you're permanently safe. Ongoing account health requires ongoing attention.
Monitor your quality rating in the Business Manager. Meta provides a quality rating (Green/Yellow/Red) in the WhatsApp Business Manager for API accounts. Check it weekly. A drop to Yellow is a warning. A drop to Red means pause outbound immediately and audit your practices.
Watch your block and report rates. If more than 0.3–0.5% of recipients in any week are blocking or reporting you, something is wrong. Investigate the content and audience before sending more.
Refresh your message templates regularly. Templates that have been used for months without variation accumulate negative signals. Rotate your wording, even slightly, to avoid identical-content flags.
Don't share your number across multiple automation tools. Running two different bots on the same WhatsApp number creates conflicting session states and unpredictable behaviour. One number, one bot.
Keep your content legitimate. This sounds obvious, but it's worth stating: the fastest route to a ban is sending content that recipients don't want. Relevance is the best anti-ban strategy.
How CodeWords enforces safe defaults
CodeWords builds several of these protections into its default behaviour. Cody, the AI automation assistant, includes built-in safe-send defaults: message spacing, daily volume limits, and opt-out handling that activates without configuration.
The inbound-first pattern is the default connection type — you connect a number, and it responds to messages rather than initiating them. Outbound sends go through a review layer that checks for common spam signals before execution.
This doesn't replace the need for you to follow the practices above. But it means the most common failure modes are protected against at platform level.
If you're building a new WhatsApp automation — for yourself or a client — start with CodeWords and let the defaults do the heavy lifting while you focus on building something genuinely useful.