If you are reading this because a number is already restricted, skip to the section on what to do in the first hour. Everything else can wait.
If you are reading it before anything has gone wrong, you are in a much better position than most people who search this phrase, and the single most useful thing I can tell you up front is this: raw message volume is not what gets numbers banned. Blocks and reports are. A business sending 5,000 messages a day to people who genuinely want them is safer than a business sending 60 a day to strangers. Almost every "safe daily limit" article gets this backwards.
First, work out which problem you actually have
Four different things get called "banned," and they have four different fixes. Getting this wrong wastes days.
A temporary ban. You see a countdown: "You can use WhatsApp again in N hours." It resolves itself. Do not reinstall, do not switch devices, and do not try the number on another handset. Each of those can extend the penalty.
A permanent ban. You see "This account is not allowed to use WhatsApp" with no timer. The only route is the in-app review request.
An API-level restriction. Your WhatsApp Business Account or a specific number is restricted inside Meta Business Manager. The number still exists on WhatsApp but cannot send through the platform. This goes through your Business Solution Provider, not through the app.
A quality-rating downgrade. Nothing is banned yet. Your number has dropped to yellow or red in WhatsApp Manager, and your daily messaging tier is frozen or cut. This is a warning shot, and it is the one state where you can fix things before losing anything.
That last one matters most, because it is the only stage where intervention works cleanly. Check your quality rating a few times a week. It generally gives you a day or two of warning before enforcement lands.
How WhatsApp decides, as best anyone can tell
Meta does not publish its detection logic, so what follows is assembled from Meta's own policy documentation, error codes that surface through the API, and the consistent pattern across a large number of reported cases. Treat it as a working model rather than gospel.
Enforcement appears to run on four independent layers, and any one of them can flag you on its own.
Registration and device fingerprinting. Applied when the number first appears. Bulk-registered numbers, virtual numbers from known ranges, and numbers registered on emulators or data centre IPs start with a deficit before sending anything.
Behavioural analysis. Send velocity, the ratio of outbound to inbound, how evenly spaced your sends are, whether activity runs around the clock. A perfectly regular 500ms interval between messages is a stronger automation signal than a high daily total. In 2026 this layer added weight for unanswered messages, so a high send volume with a low reply rate now flags harder than it used to.
Recipient signals. Blocks and spam reports from the people you message. This is the heaviest layer by a wide margin, and it operates on a rolling seven-day window.
Content pattern matching. Identical message bodies sent at scale, link-heavy templates, phrasing that matches known spam corpora.
The practical consequence of these being independent is that the popular mitigations only address one layer. Randomising delays helps with behavioural signals and does nothing about blocks. Rotating numbers helps with nothing at all if the underlying message is one people report.
If you are on the official Cloud API
The official platform gives you visible guardrails, which is most of what you are paying for. Ban risk is low if you stay inside them, but "low" is not "zero," and plenty of verified businesses get restricted.
An unverified business portfolio can message 250 unique customers per rolling 24 hours. After Business Verification, you start at 1,000 and progress through 10,000, 100,000 and unlimited, driven by your quality rating and send history. Since October 2025 these limits apply across your whole business portfolio rather than per number, so adding a second number gives you redundancy, not extra capacity. Meta re-evaluates tier eligibility roughly every six hours now, which makes climbing faster than it was under the old 24 to 48-hour cycle.
Three things trip up otherwise careful teams:
Frequency capping means a WhatsApp user can only receive a small number of marketing messages per day across every brand messaging them, not just yours. If you hit a saturated recipient, the send fails with error 131049. That is not your account being penalised, but if you see it often, your audience is being marketed to heavily and your campaigns are landing in a crowded inbox.
Quality is scored on a rolling seven-day window, so one bad campaign keeps hurting you for a week after you stop. Yellow freezes tier progression. Red cuts your daily cap.
Marketing template delivery to United States numbers has been restricted since April 2025 and reintroduced in stages. If your US campaigns are silently underperforming, check whether your traffic is affected before you blame your copy.
Sending fewer, better-targeted templates is the whole game here. The campaigns that cost the most are usually the same ones damaging your rating, which is a rare case where the cheap decision and the safe decision are identical.
If you are on a session-based API
Connecting through the WhatsApp Web protocol puts you on a different footing. There is no quality rating to watch, no tier to climb, and no official warning before enforcement. There is also no template requirement holding you back, which is exactly why people get into trouble.
Be clear-eyed about the baseline: automating a standard WhatsApp account this way is against Meta's terms, and the enforcement mechanism is account restriction. We set out the full trade-off in WhatsApp API without Meta approval, including the parts that do not flatter our own category. No provider can promise you immunity, and any that does is selling something.
What you can do is make your traffic look like what it actually is. If your messages are replies to inbound conversations, transactional updates to existing customers, or notifications to your own staff, you sit in a genuinely low-risk band. If you are contacting people who did not ask to hear from you, no amount of pacing, delay randomisation or number rotation will save you for long.
Warming up a new number
Everything in this section is field estimate, not published policy. WhatsApp does not disclose thresholds and they change without notice. Treat these as directional.
New numbers carry the highest risk in their first ten days. A number that appears and immediately messages 200 strangers matches the spam registration pattern precisely.
| Period | First-contact messages per day | What to do |
|---|---|---|
| Day 0 | 0 | Register on a real SIM in the market you operate in. Complete the profile: photo, business name, description. Then leave it alone. |
| Days 1 to 3 | 10 to 30 | Only saved contacts and people who message you first. Genuine two-way chats. Receive as much as you send. |
| Days 4 to 7 | 30 to 50 | Add real customer conversations. Keep replies flowing both ways. Vary timing. |
| Week 2 | 50 to 150 | Introduce transactional sends to opted-in contacts. Ramp gradually rather than stepping up in one jump. |
| Week 3 | 150 to 200 | Approaching normal operating volume. Watch reply rates rather than send counts. |
| Week 4 onward | Scale on evidence | If reply rates hold and blocks stay near zero, keep climbing. If either moves, stop. |
Alongside the daily figures, three pacing rules do more work than the totals:
Keep sends under roughly 30 an hour and around one a minute during bulk runs. Concentrate activity in a normal working window of about eight hours rather than spreading it across 24, because round-the-clock sending is a machine signature. And randomise the interval between messages properly, since a fixed delay is more suspicious than a fast one.
If you are recovering a number after a restriction, run the whole warm-up again from day zero. Restored accounts sit in a fragile state for one to two weeks, and the most common way people lose a number permanently is returning to full volume the day it comes back.
The operating rules that actually keep numbers alive
Opt-in is the whole foundation. Not a pre-ticked box, not a phone number you collected for SMS three years ago, not a purchased list. Explicit permission to message on WhatsApp specifically. Everything else on this list is secondary.
Make the first message from a new number worth replying to. Early replies build reputation fast. Start with people who bought from you last week, not with your coldest segment.
Watch your reply ratio, not your send count. It is the metric that most closely tracks how enforcement sees you. If a campaign gets a 2 percent reply rate, that campaign is a liability regardless of how many messages it was.
Segment numbers by function. Support on one, transactional alerts on another, campaigns on a third. When something goes wrong, you lose one function instead of the whole channel. Pacing helps here too, and the smart queue and warm-up guidance we publish exist for exactly this reason, but architecture beats throttling.
Vary your message bodies. Identical text at scale is a content-layer signal. Real personalisation, not just a name variable.
Give people an obvious way out. A clear opt-out instruction reduces blocks, and a block costs you far more than an unsubscribe.
Respect local hours. Messages arriving at 3 am get reported at a much higher rate.
Stop at two follow-ups. The first follow-up meaningfully lifts response, the second adds less, and the third adds nothing essentially while raising your report rate.
Never use a modified client. GB WhatsApp, WhatsApp Plus, and similar mods are detected reliably and result in bans that are much harder to appeal.
What to do in the first hour after a restriction
Stop all messaging immediately. Every automation, every queue, every scheduled campaign. WhatsApp checks recent activity when reviewing appeals, and continued sending while a review is pending is the fastest way to turn a recoverable case into a permanent one.
Identify which of the four states you are in. Countdown, no countdown, API restriction, or quality downgrade. The route differs.
Work out the cause before you appeal. An appeal that says "I did nothing wrong" when you blasted a cold list performs worse than one that identifies the problem and states what you changed. Pull your recent send logs, block rate and reply rate first.
Submit one appeal, carefully. For app-level bans, open WhatsApp and tap Request a Review on the ban screen. Give your number in international format, describe honestly how you use the account, acknowledge what may have triggered the flag, and commit to specific changes. Repeated submissions slow your case down rather than speeding it up.
Mind the 30-day window. WhatsApp's help centre states appeals must be submitted within 30 days of the ban. After that the appeal channel closes, even though the ban itself does not change. Do not sit on it while you decide what to write.
For API restrictions, go through your BSP. They have escalation paths you do not. Expect to supply opt-in evidence and template corrections.
Expect 24 to 72 hours. That is the typical window for a decision. Simple first-time cases sometimes resolve in hours. API cases can run five to ten business days. No third-party service can accelerate this, and anyone claiming a back channel to WhatsApp is lying to you.
If it comes back, treat it as a new number. Full warm-up, reduced volume, and fix whatever caused it. The reinstatement is not a reset of your history.
Things that do not work
Rotating through fresh numbers to spread the same cold campaign. You are multiplying the number of accounts that get flagged, not reducing risk, and bulk-registered numbers start with a fingerprinting deficit anyway.
Random delays alone. They address one detection layer while leaving blocks and reports untouched.
VPNs and proxies to disguise sending location. Registration-layer signals notice mismatches between number country, network and behaviour. This usually makes things worse.
Third-party unban tools. There is no software route around WhatsApp's review process. Tools that help you draft an appeal are fine. Tools that claim to remove a ban are not.
Assuming the official API makes you immune. It gives you visibility and a framework, and it substantially lowers risk. It does not exempt you from consent rules or from your recipients' opinion of your messages. If you are still weighing the two routes, the Cloud API versus session-based comparison lays out where each one sits on risk.
Common Questions asked by users
Why did my WhatsApp business account get banned? Almost always blocks and spam reports from recipients, usually because the list was not properly opted in. Secondary causes are automation patterns on a standard account, modified clients, sudden volume from a new number, and content flagged as promotional at scale.
How many messages can I send per day without getting banned? There is no published figure. Field consensus puts a warmed, established number at roughly 200 first-contact messages a day, with new numbers starting at 10 to 30. On the official Cloud API the limits are explicit: 250 unique recipients unverified, then 1,000, 10,000, 100,000 and unlimited. Note that these caps count unique people you initiate with, not total messages, and replies inside an open conversation are not capped.
How long does a WhatsApp ban last? Temporary bans show a countdown and clear themselves, usually within hours to a couple of days. Permanent bans require an in-app review request, typically decided within 24 to 72 hours. API restrictions handled through a BSP can take five to ten business days.
How do I warm up a WhatsApp number? Register on a real SIM, complete the profile, and wait a day before sending. Spend the first three days on genuine two-way conversations with saved contacts at 10 to 30 messages a day, reach 30 to 50 by the end of week one, and climb toward 150 to 200 across weeks two and three. Prioritise contacts likely to reply.
Can I get my banned WhatsApp number back? Often, yes, particularly for a first offence or a wrongful flag. Stop all activity, submit one clear appeal within 30 days, and be specific about what you changed. Bans tied to serious harm are not recoverable through any channel.
Does using an API increase ban risk? The official Cloud API does not, provided you follow template and consent rules. Session-based APIs do carry real risk, because automating a standard account breaches WhatsApp's terms. In both cases, who you message matters far more than which tool you send with.
My quality rating dropped to yellow. What now? Pause campaigns for at least a week, since the rating is scored on a rolling seven-day window and will not recover while bad traffic is still in it. Review which template caused the blocks, tighten the audience, and resume at lower volume.