The honest answer first: there is no safe way to blast 10,000 cold numbers from one phone. Not with a Chrome extension, not with a "bulk sender", not with a linked-device tool, and not with broadcast lists. WhatsApp’s own words are that its products "are not intended for bulk or automated messaging", and its white paper reports over two million accounts removed a month for it.
There is a safe way to message a lot of people who expect to hear from you. It is slower than a blast, it needs a real list, and it looks like a person sending messages rather than a machine. This guide covers what WhatsApp says, the four lanes, the two signals that catch bulk senders, a sending plan, and a worked example.
What WhatsApp says about bulk and automated messaging
WhatsApp’s page on unauthorised bulk messaging says: "Our products are not intended for bulk or automated messaging, both of which have always been a violation of our Terms of Service." Its responsible-use page says: "Don’t bulk message, auto-message, or auto-dial using WhatsApp," and that it "uses both machine learning technology and reports from users to detect and ban accounts that send unwanted automated messages."
It goes further than bans. Since December 2019 WhatsApp has said it will take legal action against those "engaged in or assisting others in abuse", even on off-platform evidence such as "public claims from companies about their ability to use WhatsApp in ways that violate our Terms."
Two details matter. Detection is built on behaviour: velocity, unsaved recipients, blocks and reports. And WhatsApp adds a note that cuts the other way: "receiving many messages at once will not result in an account ban." A thousand customers messaging you after an ad is not spam. A thousand messages from you to people who never asked is.
The four lanes compared
Everyone sending in volume on WhatsApp is using one of four things.
- WhatsApp Business app broadcast lists. Free, up to 256 recipients per list, created on the phone, delivered only to people who saved your number. The Help Center warns that "frequent use of broadcast messages may lead people to report your messages, and we ban accounts that are reported multiple times." Not a bulk tool.
- Browser extensions and "bulk senders". A script that drives WhatsApp Web and fires on a timer, from a pasted list, saving nobody and reading no replies. These are the products WhatsApp has in mind when it talks about legal action.
- The WhatsApp Business Platform, the API. The lane every vendor guide sells: a separate dedicated number, pre-approved templates, per-message pricing, a quality tier that limits sending when it drops, and an opt-in requirement. It fits high-volume notifications. It is not your existing number and it is not free.
- Linked-device tools such as Spun. They connect to the number you already use the way WhatsApp Web does, with nothing installed on the phone and no modded app. What separates them from an extension is what sits between you and the send button: random gaps, a server cap, quiet hours, audience filters and opt-out enforcement. The number is still judged as a normal account: the tool can slow you down, but it cannot make an unwanted message wanted.
No lane is immune. The API throttles bad senders through its quality tier; the app and a linked-device tool both end at the same ban screen. What changes is how much help you get behaving well.
The two signals that catch bulk senders
Two of the "hundreds of factors" WhatsApp’s "Stopping Abuse" white paper describes explain most bulk-sending bans, and both are visible without reading a message, because WhatsApp analyses "the frequency of account activity" rather than content.
Velocity. "Normal users operate relatively slowly on WhatsApp, tapping messages one at a time or occasionally forwarding content." The paper’s example of certain abuse is an account "attempting to send 100 messages in 15 seconds". Automation also shows in what is missing: an account that "continually sends messages without triggering the typing indicator" can be banned on that alone.
Unsaved recipients. Every first message to someone who does not have you in their contacts arrives with a prompt to block or report you. The paper says a new account messaging "dozens of recipients who do not have the sender’s account in their contacts" is weighed against its registration history, and that when someone reports "the first message they receive from an unknown number, we have higher confidence that the report is legitimate." A cold list is a list of unsaved recipients.
Together they are the shape of every bulk blast: many messages, fast, to strangers, with almost no replies. The plan below breaks that shape.
Related: How WhatsApp spam scoring works
Industry rules of thumb (estimates, not WhatsApp rules)
WhatsApp publishes no cutoffs. What exists is experience: a 2026 guide from a company that manages large numbers of business WhatsApp numbers publishes figures gathered from its customers and says plainly that they are community-tested estimates, not WhatsApp rules. Treat every figure below that way.
- How many people you message an hour: under 30 is reported as safe, and above 60 the risk rises sharply. During a big send, about one message a minute; even a brief burst to five a minute is reported to be enough to draw attention.
- How many a day: under 200 messages a day from one number until it has about three weeks of history, and 20 to 50 a day on a brand-new number.
- When: keep sending inside roughly an eight-hour stretch of the day. Messages going out around the clock is the pattern of a machine, not a person.
- The gap between messages: a fixed gap, such as the half-second pause most sending scripts default to, is a known giveaway of automation. The gaps have to vary.
- New people versus existing chats: 500 messages into conversations you already have are judged very differently from 500 messages to people you have never messaged, because WhatsApp already knows who you talk to. Keep a small daily allowance for first-time chats; a list of people who opted in but have never heard from this number still counts as new.
- Replies: aim for more than 30 replies per 100 messages, and 50 is described as comfortable. Since 2026 the same people also describe WhatsApp keeping a running 30-day count of messages nobody answered within 48 hours, which opting in does not cancel out, so removing people who never reply is weekly work.
- The shape of the message: WhatsApp cannot read your text, but 200 messages of nearly the same length, with the same kind of attachment, the same link and the same photo file, sent in a short window, look like a broadcast anyway. The reported flag point is about 15 near-identical messages an hour. Vary the wording and length, keep to one link per message on a website that has existed for a while, and do not send the exact same photo file to everyone.
- Checking numbers counts too. The same guide’s line is that "checking 100,000 numbers without sending a message is still activity," so check which numbers on a list are on WhatsApp in small batches over time, not all at once.
- Several numbers: the same guide suggests spreading daily volume across several numbers. For a small business that means running separate lines for separate audiences or regions so no single number carries everything, a decision you make rather than something a tool does for you.
Why Chrome-extension senders get numbers banned
The extensions are cheap and they work, once. Three things are the problem.
- Metronome timing. Most send every few seconds exactly. A perfectly regular interval is itself a signal, and none of these tools produces a typing indicator.
- Unsaved lists. Paste numbers, press go. Nobody on the list saved you, and each sees the block-or-report prompt on the first message: the exact profile WhatsApp gives "higher confidence" to when a report arrives.
- No opt-out handling. The extension does not read replies. Someone answers "stop", and the next campaign hits them again. WhatsApp’s rule is that when a contact asks you to stop, you remove them and never contact them again.
The phone’s own forward-to-many does the same; the worked example below shows what it cost one business.
A realistic sending plan
This is what sending to a few thousand people who know you looks like when it is done to survive. The figures are rules of thumb; WhatsApp publishes no daily cap.
- 1
Segment before you send
Split by relationship: customers who bought this year, leads who messaged you, people who only ever received. Warmest segment first.
- 2
Filter to people who know you
Saved contacts only, or people who messaged you in the last 30 or 90 days. Drop anyone who never talked to you, and numbers that are not on WhatsApp.
- 3
Pace with random gaps
Somewhere between eight and thirty seconds between messages, never the same gap twice. At that pace 300 messages take well over an hour, which is the point. People who run many business numbers go slower still, about one a minute during a big send.
- 4
Keep to working hours
Nothing between 22:00 and 08:00. A promotion at three in the morning is the easiest report a recipient will ever file.
- 5
Put an opt-out line in the message
One sentence: reply STOP and we will not message you again. Then remove anyone who does.
- 6
Spread it over several days
A list of 2,000 becomes four or five days of a few hundred each, a different segment each day, so the account looks busy rather than spiking. Answer every reply as it arrives.
- 7
Do not repeat within a week
The same people, the same offer, seven days apart is where "frequent use" turns into reports. Once a week to a segment is the outer edge, as a rule of thumb.
How this plan runs in Spun
Every step above is a setting rather than a discipline when the campaign runs through Spun, which connects to your existing number as a linked device, like WhatsApp Web.
- Pace presets with a random gap per message (Conservative 15 to 30 seconds, Normal 8 to 15, Aggressive 3 to 8 with a warning) and a server cap of 8 a minute by default. The pace you choose is a request, not a guarantee; presets faster than the line is allowed show as restricted, and group sends are floored at 8 to 12 seconds.
- Quiet hours from 22:00 to 08:00 by default with a send window per campaign; "Saved contacts only" and activity filters; a pre-send check that refuses numbers not on WhatsApp.
- Opt-out words in 11 languages apply a DONOTSEND label enforced everywhere, a warning fires before a campaign overlaps the last 7 days of sends, and replies land in a shared team inbox.
It reduces the risk; it cannot make an unwanted message wanted.
Related: How Spun paces a broadcast campaign
A worked example: the blast, and what it should have been
A coaching business with an established number wanted to announce a new programme. One morning the owner used the phone’s forward-to-many: the same voice note to 61 people, the same Drive link to 30 people, 16 of whom had never messaged the account. About 540 messages left the number in three minutes, to 206 unique recipients that day. Three days later the number was disconnected.
Score it against the two signals. Velocity: 180 messages a minute, close to WhatsApp’s "100 messages in 15 seconds" example. Unsaved recipients: at least 16 people got a link from an account they had never spoken to. Identical content to 61 people and again to 30. No opt-out line.
The same announcement, done to survive: 206 recipients in two segments, current clients first. Random gaps of 15 to 30 seconds, so each day’s batch of around 100 takes roughly 40 minutes. The 16 strangers removed, or messaged one by one with a personal opener. The link sent only to people who replied. An opt-out line at the end. Two days instead of three minutes.
The problems behind bulk sending, and how Spun handles each one
- 1
You have one big list and one afternoon
A few thousand messages in one sitting is a spike from a number that normally sends dozens, and a spike is what WhatsApp’s velocity scoring reads. Spun builds campaigns from labels and segments, runs them under a server cap on the pace (8 a minute by default), and shows how long the run will take before you press send, so a big list becomes several days by design; who belongs on the list is still your call.
- 2
Half the list had never saved your number
A first message to someone who does not know you carries the block-or-report prompt and the extra report weight WhatsApp describes. The "Saved contacts only" filter and the activity filter (last 7, 30 or 90 days) keep a campaign to people who know you, and a pre-send check refuses numbers that are not on WhatsApp; the consent half is yours.
- 3
Your sender fired a message every few seconds, exactly
A fixed gap is a known giveaway of automation, and 100 messages in 15 seconds is WhatsApp’s own example of certain abuse. Spun’s pace presets put a random gap between messages (Conservative 15 to 30 seconds, Normal 8 to 15, Aggressive 3 to 8 with a warning), the server caps the pace at 8 a minute, and the optional "Slight text variations" checkbox plus random silence padding on voice notes keep 200 sends from being identical; it reduces the risk, no tool can promise immunity.
- 4
Your campaign ran overnight at machine speed
A message at three in the morning is the easiest report a recipient will ever file, and round-the-clock sending is the pattern of a machine. Spun holds sends during quiet hours, 22:00 to 08:00 by default, and each campaign has its own send window, so an evening run stops at ten and resumes in the morning.
- 5
A customer said stop and got three more messages
Messaging someone after they asked you to stop is the reply that turns into a report, and WhatsApp bans accounts reported multiple times. Spun detects "stop", "unsubscribe", "remove me" and their equivalents in 11 languages, applies the DONOTSEND label everywhere, and warns before you create a campaign that overlaps the last 7 days of sends; between campaigns, Keep In Touch keeps the number in normal two-way use so the next send is a bump, not a spike.