WPCoreTools Email Verify

WPCoreTools Email Verify asks new customers to confirm their email address before they can order. They get an email with a link, they click it, and they are confirmed. There are no codes to type, no popups and no outside service.

You decide what an unconfirmed customer has to wait for. The recommended “Shop” setup lets them log in and browse straight away and holds back only ordering. The setup wizard also offers stricter and looser setups, each explained in plain words.

People who registered before you activated the plugin are never asked. Only new sign-ups confirm, and guest checkout is not affected.

The plugin is completely free. There is no Pro version, no paid add-on, no license key, no advertising and no tracking.

Features

• Confirmation link by email. Links are valid for 7 days by default (1 to 90). Tokens are stored hashed.
• Choose what waits for confirmation: placing orders, logging in, comments and reviews, creating an account at checkout, wp-admin, changing the email address in the profile, and selected capabilities.
• Setup wizard with ready-made setups: Shop (recommended), Strict, Community or Custom. You can run it again at any time.
• Clear notices for customers on My Account, the cart and checkout, with a resend link that counts down until a new email can be sent.
• Wrong address? Change it. A customer who mistyped their address can correct it from the notice and get a new link.
• Resend form for logged-out visitors on the login page. It is rate-limited and never reveals whether an address is registered.
• Safe against link scanners. Mail programs that open links in advance cannot confirm an account. Anyone not logged in as that customer sees a “Confirm my email” button first.
• WooCommerce support: classic checkout, the Cart and Checkout blocks, Pay for order links and HPOS. With WooCommerce 11, its own email confirmation and this plugin stay in step, so customers see one prompt.
• Admin tools: a Verified column, filter and bulk actions on the Users list, a Verified column on the Orders list, a dashboard widget, Site Health checks, CSV exports and a log of emails that could not be sent.
• Warns about a second verification plugin, which would leave customers confirmed in one and still blocked by the other.
• Plain-text email by default, or WooCommerce’s email template, editable under WooCommerce > Settings > Emails.
• Works without WooCommerce, and on Multisite.

For developers (optional)

Everything above works out of the box, with no code. The hooks below are only for developers who want to extend the plugin, for example to send confirmed customers to a page of their own, reword a notice, or tell another system about a confirmation. Each hook is explained with a copy-and-paste example on the hooks page for developers.

Filters: wpcev_is_blocked( $blocked, $user_id ) (the final word on whether a user is held back), wpcev_is_verified( $verified, $user_id ) (ask from your own code whether a user is confirmed), wpcev_skip_verification_on_register( $skip, $user_id ) (do not ask a new account, for example from single sign-on), wpcev_expiry_days( $days, $user_id ) (how long a link stays valid, 1 to 90 days), wpcev_verification_url( $url, $user_id, $token ) (the link in the email), wpcev_verification_email( $args, $token ) (subject, body, headers and recipient of the plain-text email), wpcev_notice_message( $html, $context, $user_id ) (the wording of the main notices: My Account, cart and checkout, Pay for order, the sign-up notice, the login error and the banners), wpcev_show_notice( $show, $location, $user_id ) (hide a notice on some pages), wpcev_verify_redirect_url( $url, $user_id, $result, $viewer ) (the page shown after the link worked), wpcev_verify_landing( $landing, $result ) (title and body of the result page on sites without WooCommerce), wpcev_new_email_errors( $errors, $email, $user_id ) (refuse a new address in the “Wrong address?” form), wpcev_verify_on_password_reset( $verify, $user_id ), wpcev_run_wc_account_email_checks( $run ), wpcev_sync_to_woocommerce( $sync, $user_id, $reason, $direction ), wpcev_verified_via_label( $label, $via, $user_id ), wpcev_should_purge_user( $delete, $user_id ) and wpcev_purge_reassign_to( $reassign, $user_id ) (the auto-delete of abandoned sign-ups).

Actions: wpcev_verification_sent( $user_id ) and wpcev_verification_send_failed( $user_id, $code ) (an email went out, or could not be sent), wpcev_email_confirmed( $user_id, $source ) (the customer proved the inbox), wpcev_user_verified( $user_id, $reason ) and wpcev_user_unverified( $user_id, $reason ) (the status changed, for any reason), wpcev_verify_link_failed( $user_id, $problem ) (an expired or invalid link was used) and wpcev_before_purge_user( $user_id, $reassign ) (the auto-delete is about to remove an account).

Privacy

The plugin contacts no outside service and collects no usage data. It supports WordPress’s personal data export and erase tools. The resend form’s rate limit stores only a hash of the visitor’s IP address, for one hour.

Requirements

WordPress 6.4 or later and PHP 7.4 or later. WooCommerce is optional. If you use it, WooCommerce 9.2 or later is required, which itself needs WordPress 6.5.

External services

This plugin does not use any external services.