WhatsApp bot banned or not working: risks and prevention

Anyone who runs a WhatsApp bot long enough sees the same scene: the bot stops replying and the question comes up, "did I get banned?" Sometimes, yes. Often, the session just dropped. Mixing the two up wastes your time or, worse, leads you to keep reconnecting a number that was already under suspicion.

No practice makes a number immune to bans. What you can do is diagnose correctly and lower the risk.

Is the bot banned or just disconnected?#

Before you conclude it is a ban, check why the connection closed. The symptoms look alike, the causes do not.

With Baileys, the connection.update event tells you why the connection closed. This code tells a logout from a dropped connection:

import makeWASocket, { DisconnectReason, useMultiFileAuthState } from "@whiskeysockets/baileys";
import QRCode from "qrcode";

async function start() {
  const { state, saveCreds } = await useMultiFileAuthState("auth");
  const sock = makeWASocket({ auth: state });

  sock.ev.on("creds.update", saveCreds);
  sock.ev.on("connection.update", async ({ connection, lastDisconnect, qr }) => {
    if (qr) console.log(await QRCode.toString(qr, { type: "terminal", small: true }));
    if (connection !== "close") return;
    const code = lastDisconnect?.error?.output?.statusCode;
    if (code === DisconnectReason.loggedOut) {
      console.error("Logged out. Delete the auth folder and pair again.");
    } else {
      console.error("Connection dropped (code %s). Reconnecting.", code);
      start();
    }
  });
}

start();

The code uses Baileys 7 (npm install @whiskeysockets/baileys qrcode), which only works as an ES module: your package.json needs "type": "module". The printQRInTerminal option from older versions is deprecated, so the QR comes from the qr field of connection.update. If you are migrating from version 6, check the Baileys repository.

If the log shows a logout and the phone app opens normally, the number was probably not banned: only the session dropped. If the WhatsApp app itself shows a restricted or banned account notice, that is a ban.

Why does WhatsApp ban bots?#

WhatsApp's Terms of Service list, among prohibited uses, sending impermissible communications such as "bulk messaging, auto-messaging, auto-dialing" and creating accounts through unauthorized or automated means. They also forbid reverse engineering the services and creating software that functions substantially the same as them. WhatsApp states it may suspend or terminate access at any time.

Libraries like Baileys and whatsapp-web.js work by imitating the official client. The Baileys README says the project is not affiliated with WhatsApp and that the maintainers do not condone use that violates the terms, such as spam. In other words, the library itself tells you the risk is yours.

In practice, these weigh the most:

1. Messaging people who did not ask. Bought lists, people added to groups, cold outreach.
2. Reports and blocks. Every "block" or "report" counts against the number.
3. Volume and pace. Hundreds of identical messages in a few minutes, no pause or variation.
4. A new number doing too much. A freshly activated SIM that blasts on day one.
5. Duplicate sessions. The same number connected in two places at once.

WhatsApp does not publish exact thresholds, so any "safe messages per hour" figure you read online is a guess. Items 3 to 5 also reflect common operator experience, not documented rules.

Does the official API protect you from bans?#

It removes the risk of using an unauthorized client, not the risk of behaving badly. The WhatsApp Business policy says you may only contact people who gave you their contact details and agreed to receive your messages (opt-in). Users can block and report businesses, and WhatsApp may limit your message volume based on that feedback. In serious cases access can be restricted or removed, and terminated accounts may be barred from WhatsApp products in the future.

The Cloud API also has a technical rule that looks like a "broken bot" if you do not know it: the customer service window. According to Meta's documentation, the 24-hour window starts when the user messages or calls you, and once it closes you can only send pre-approved template messages. If your bot "stopped replying" a day after the customer's last message, that may be all there is to it.

For a detailed comparison of the three options, see Baileys, whatsapp-web.js or the official API.

How do you lower the risk of a ban?#

• Use a number dedicated to the bot, never your personal or main business number.
• Only message people who asked. Record the opt-in and give a clear way to leave.
• Reply, do not blast. Bots that answer incoming messages have a very different profile from broadcast bots.
• Spread and vary sending. Random intervals, non-identical text, no bursts.
• Treat "stop" as a command. People who ask to leave and keep receiving messages tend to report.
• Keep a single instance per number, with a persistent auth folder.
• Update the library. Outdated protocol versions disconnect often.
• For commercial volume, move to the Cloud API, the route intended for businesses. See also how to make a WhatsApp bot.

What should you do if the number is banned?#

1. Stop the bot. Reconnecting in a loop only makes it worse.
2. Open the WhatsApp app on the phone and read the exact message it shows.
3. For a business account, look for the appeal route in the Help Center and the WhatsApp Business policy pages.
4. Fix the cause (list, volume, reports) before putting a new number online, or it is likely to end the same way.

Be wary of anyone selling an "unban service": WhatsApp does not point to resellers for that.

How to do this on Square Cloud#

Hosting does not protect your number from bans or expose it to them: that depends on your behavior and your library. What hosting solves is stability, and that prevents many false ban scares. See also how to host a WhatsApp bot 24/7.

On Square Cloud, the container is always on, with automatic restart (on by default for dashboard deploys) when the process exits with an error. The auth folder lives on the application's disk, so the session stays connected after a restart without asking for the QR code again. You follow logs in real time in the dashboard, the CLI, VS Code or the mobile app, and see why each disconnect happened. Baileys, WPPConnect, whatsapp-web.js and the official Cloud API are all supported.

A small bot fits the Hobby plan (R$12.49 per month, 1 GB of RAM), with a minimum of 256 MB per background application. Details are on the WhatsApp bots page.