What Call Now Button does on your site
Call Now Button adds a floating call button to every public page. On a phone, one tap starts the call; on a computer, the button is a standard tel: link that the computer opens in its calling app (Teams, a softphone, Phone Link on Windows or Handoff on a Mac). Only the phone number is required; everything else is optional: button text, button and icon colors, position, size, target devices and the pages where it appears.
Without an account, your own site renders the button: a small stylesheet and a link added at the bottom of the page, with no cookies and no requests to an outside service. Connecting the plugin to a free NowButtons account unlocks other actions (SMS, email, maps, WhatsApp, Messenger, Telegram...), several buttons and finer display rules; your configuration is then stored by the vendor and served from its content delivery network.
The plugin is one of the oldest of its kind on wordpress.org. The NowButtons service is run by StudioStacks B.V., based in the Netherlands. It follows a freemium model: the plugin on its own is free, so is the Starter account, and the Pro plan is a per-website subscription with a 14-day free trial.
Which sites Call Now Button is a good fit for
Call Now Button has one simple job: turning a mobile visit into a phone call, without making the visitor hunt for your contact page.
- Trades and emergency services: plumbers, locksmiths and electricians whose customers call in a hurry from their phones.
- Local shops and services: restaurants, taxis, clinics, salons and agencies, where a call beats a contact form.
- Google Ads campaigns built around calls: a click on the button can count as a conversion, with no code to add to your theme.
- Privacy-conscious sites (GDPR): without an account, no visitor data reaches the vendor and the plugin sets no cookies.
It is not the best pick if you mainly want to be reached on WhatsApp or several messaging apps without signing up with a third party: Joinchat or Click to Chat handle that from your own site. Nor is it the right tool if you cannot pick up the phone during the hours the button shows, because time-based scheduling requires the Pro plan.
Call Now Button strengths and limitations
Strengths
- Ready in a minute. A toggle and a phone number are all it takes, with no account and no code to paste.
- Self-contained without an account. Your site renders the button, with no cookies and no external requests.
- Free tracking. A click event sent to Google Analytics 4 and Google Ads conversion tracking come with the free version.
- Flexible placement. Eight preset positions, a full-width bar at the top or bottom, and a choice of mobile, desktop or both.
Limitations
- A single call button without an account. WhatsApp, SMS, email and the other actions require a NowButtons account, which then hosts your configuration.
- Targeting by ID only. Without an account, you include or exclude the button by post and page IDs, not by category or content type.
- Advanced features cost a subscription. The scheduler, multiple buttons per page, country targeting and appear-after-scrolling require Pro, billed per website.
- English-only settings. The button settings screens and the plugin menus stay in English whatever language WordPress uses.
The Call Now Button settings we recommend
These settings apply to the plugin without an account. You configure the button under Call Now Button > My button, and tracking and general options under Call Now Button > Settings.
| Setting | Recommended value | Why |
|---|---|---|
| Phone number My button > Basics tab | International format, with the + sign and country code (+1...) | The vendor recommends the +: it works everywhere, including for visitors abroad. |
| Button status My button > Basics tab | Active, once the number has been tested | It is the first thing to check when the button does not show up. |
| Button text My button > Basics tab | Empty, or a short, clear label (“Call us”) | Left empty, the button stays a discreet round icon; the field takes 30 characters at most. |
| Display on My button > Presentation tab | “Mobile only” (the default), or “All screens” if your customers call from their computers | On a computer, the link only works if a calling app is installed. |
| Limit appearance My button > Presentation tab | Empty, or the IDs of pages to exclude with “Exclude these posts and pages” | Keep the button off pages where it gets in the way, such as a checkout flow; a forgotten entry here often explains a missing button. |
| Order Settings > Button display | All the way right (“Front”, the default) | Move it back one step at a time only if a cookie banner or chat window needs to sit in front. |
| Click tracking Settings > Tracking | Enabled if Google Analytics 4 (gtag.js) is already on the site | The plugin sends the event but does not install the tag; with Google Tag Manager, set up tracking in GTM. |
| Google Ads Settings > Tracking | “Off”, unless the Google Ads event snippet is on your pages | Without that snippet, the conversion cannot be recorded. |
| Errors and usage Settings > Miscellaneous | “Not sharing” (the default) | The anonymous reports only help the vendor; there is no need to send them from a live site. |
- Clear your caching plugin or host cache after every change: the vendor notes that a cached page will not show the button.
- Open the site on a phone, tap the button and check that the right number comes up.
- Make sure the button does not cover the cookie banner, a checkout button or a chat window.
Call Now Button security: mostly access control flaws
The Patchstack database lists five vulnerabilities, all patched. The two most recent target the code that links the site to the NowButtons service and only require a Subscriber account, the lowest WordPress role:
- CVE-2025-11587, versions up to 1.5.3: on an install never linked to an account, a subscriber could connect the plugin to their own NowButtons account and add malicious buttons to the site. Patchstack lists a fix in 1.5.4.
- CVE-2025-11632, versions up to 1.5.4: a subscriber could generate links to the billing portal and view or change the billing details there. Patchstack lists a fix in 1.5.5.
- CVE-2025-24738, versions up to 1.4.13: a CSRF vulnerability, fixed in 1.4.14.
- CVE-2024-2908, fixed in 1.4.7 and CVE-2022-1455, fixed in 1.1.2: two XSS flaws, one stored by an administrator, the other reflected when premium mode was enabled.
If your site allows user registration, these subscriber-level flaws matter: turn on automatic updates for Call Now Button (see our guide to automatic plugin updates) and keep an eye on plugin vulnerability alerts. The plugin also adds a signed HTML comment with its version number to every page, even when the button is hidden. WP Masquerade Pro removes that comment and renames the call-now-button folder in file addresses and the IDs of its files, but the call-now-button and cnb-* classes stay visible. That makes the plugin harder for bots targeting these flaws to spot, without replacing the update.
What WP Masquerade hides for Call Now Button
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Call Now Button: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- signed HTML comments
- folder name
- tag IDs
Still visible
- CSS classes
call-now-button, cnb-*
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
Call Now Button FAQ
Do I need an account to use Call Now Button?
No. Without an account you get a complete call button, with colors, positions, page targeting and Google tracking. The free NowButtons account only matters for other actions (WhatsApp, SMS, email...) or several buttons.
How much does the Pro plan cost?
The NowButtons pricing page lists Pro at $7.99 (or €7.99) per website per month, or $49.90 (or €49.90) per year. A Pro Account at $499 per year covers 20 websites, for agencies. A 14-day free trial is available.
Why doesn’t the button show up on my site?
First check that Button status is active, then that the Limit appearance field is empty. Next, clear the cache: a cached page was generated before the button was added. Finally, in “Mobile only” mode, the button does not show on desktop.