Do you want users to verify email addresses before submitting a WordPress form? Do you want email verification without user registration?
Email verification during user registration
It is essential to ensure form submissions come from legitimate users. In most cases this is easy.
Email verification can be triggered automatically when a new user is registered on your WordPress site. If you create user accounts with your WordPress forms, you can block other forms from logged-out users. Quick and simple.
Verify email address without registration
Did you know that you can check if email is valid without registering users? In this short tutorial I'll guide you through the process of setting up a WordPress form that can only be completed after an email address has been verified.
Step one - Create the email verification form
First, create a form to request the user's email address. This form can be short and sweet, without extra details. My form asks for an email address with a confirmation field. That's it.
This initial form displays a success message to instruct the user to check their inbox and confirm the email address.
Step two - Use a View to hide Form B unless email is verified
Form B should only be visible to users who have verified their email address via Form A. To achieve this, place the shortcode for form B inside a View. Use filtering to hide it from non-verified users.
- Set the View to show a "Single Entry" from Form A.
- I'll keep it simple, with only the shortcode for Form B in the Content box.
- Add two filters so the View Content (Form B) will only be visible if both the Entry Key and Email Address match an entry in Form A. Add default=1 to the filters so if the url is tampered with, that filter will not be ignored.
If the page is loaded directly without clicking on the link in the email, these filters will return "No Entries" and hide the form. The security of this system is greatly increased by combining the random (and not publicly visible) entry key with the email address.
Modify the default "No Entries" message to include the shortcode for Form A or a link to it. This tells visitors who may arrive at the page directly, that they must confirm their email address before proceeding.
Step three - Add a verification link in the email message
When an email address is submitted in Form A, the verification email is triggered. The email message needs to contain a link to the View created in step 2.
I'm going to create this link using the guide to create a custom search. Pass both the entry key and email address to match the filters included in the View. You can use any form values you'd like as long as you add matching filters in the View.
When the link in the verification email is clicked, the View matches the data in the URL to an entry in Form A. When it finds a match, the form is visible!
So that's it! Three simple steps to create a form that can only be completed after email verification.
Have you used similar methods to verify users who aren't logged in?