Every open registration form eventually collects an account nobody can actually reach: a typo’d Gmail address, a disposable inbox used once and abandoned, or a script testing your form for open relays. None of that is malicious in the dramatic sense — it’s just noise. But noise in your user table has a cost. Welcome emails bounce. Password-reset requests go nowhere. On a membership site, it’s worse: you’ve handed access to gated content to an email address nobody has proven they control.
Email verification closes that gap with one rule: an account can’t log in until someone clicks a link sent to the address they typed in. It doesn’t require a human reviewer, and it doesn’t slow down a real signup by more than the time it takes to open an inbox. Here’s the thing: this is a free, built-in option in User Registration & Membership— not a paid add-on. Every competitor covered while researching this guide gates the same feature behind a paid tier.
Note: This guide assumes User Registration is already installed with a registration form built. If you’re starting from scratch, install the plugin and create your first form, then come back here.
What You’ll Need
- User Registration & Membership — free version is all you need for this
- A registration form already built and published on your site
- Access to an inbox you control, for testing the verification email
- Working outbound email on your site — if you’re not sure, see the Troubleshooting section below
Why Require Email Verification on Your Registration Form
Three symptoms usually show up together on a site without this in place:
- Spam and bot signups. Scripted registrations from junk or disposable domains that inflate your user count and, on membership sites, can be used to probe for free access.
- Bounced onboarding email. Welcome messages, receipts, and password resets that silently fail because the address was mistyped at signup — and the user has no idea why they never heard back.
- Unverifiable ownership. Anyone who can type an email address into a form can register with it. Without confirmation, you have no evidence the account holder is who they claim to be.
How to Set Up Email Verification
This is a free, built-in option — no separate plugin required. Open your registration form, go to its Form. Settings tab, and set User Approval and Login Option to Auto Approval After Email Confirmation. Here’s each step in full:
Step 1: Enable Email Confirmation on Your Registration Form (Free)
Open the form in the form builder and switch to the Form Settings tab in the right-hand panel. Find User Approval and Login Option and change it from the default (Auto approval and manual login) to Auto Approval After Email Confirmation. Save the form.
This setting lives per form, so different registration forms on the same site — a free-tier signup versus a paid-membership one, say — can use different rules.
Step 2: Customize the Verification Email
Once you’ve completed the previous step, go to Settings › Emails ›To User ›Email Address Confirmation. The subject and body are both editable, and the body ships with a working confirmation link built from smart tags — {{username}}, {{blog_info}}, and a {{email_token}} that resolves to the actual verification URL. Rewrite the copy in your own voice; the tags and the link structure stay intact as long as you don’t delete them. Use the Preview link on that screen to check it before it goes live.
Step 3: Know What Happens to Unverified Accounts
Until the link is clicked, a login attempt is rejected with: “Your account is still pending approval. Verify your email by clicking on the link sent to your email” — with a Resend Verification Link the user can click right there on the login screen. No separate plugin or custom message is needed; it’s the built-in error.
Clicking the confirmation link logs the user in automatically by default — verification is the only gate. If you also want a person to review the account after it’s confirmed, that combination exists too.
Note: Choosing Admin Approval After Email Confirmation instead adds a manual review step after the address is verified. The user sees a “waiting for admin approval” message instead of being logged in, and you get a separate notification email with one-click Approve / Deny links. This combination is in User Registration Pro.
Either way, an admin can trigger a fresh verification email for a specific person from the Resend Verification row action on the Users screen — handy for the “I never got the email” support ticket.
Step 4: Test the Full Signup, Verify, Login Flow
Register a test account with an inbox you control and confirm the email lands within a minute or two. Click the link and check you land logged in (or see the approval-pending message, if you’re using the Pro combination). Then open an incognito window and try logging into that same account before clicking the link, to confirm it’s actually blocked and the resend prompt appears. Skipping this last check is the most common reason sites discover the gate isn’t working only after a user complains.
What Happens If a User Never Verifies Their Email?
By default: nothing, indefinitely. The account sits in your Users list flagged as pending, holding a username and email address, unable to log in, until either it’s verified or an admin removes it by hand. On a site that gets steady spam signups, that list grows forever.
Auto-Expiring Unverified Accounts (Pro)
User Registration Pro can clear that list on a schedule instead. Under Settings › Advanced › Auto Delete Users, turn on the toggle and set three things: a Duration (daily, weekly, or monthly), which User Status to target (pending or denied accounts, specifically — not active members), and which User Role to limit it to. It runs as a background batch process, so it works through a large user table without timing out the page that triggered it.
It’s the same idea WooCommerce stores use to auto-cancel unpaid orders that were never completed — a self-cleaning funnel — applied to your user table instead of your order table, and built into the plugin rather than stitched together with a custom cron job.
Email Verification vs. Admin Approval: Which Should You Use?
User Registration’s User Approval and Login Option field has five values worth knowing the difference between:
| Option | What it checks | Best for |
|---|---|---|
| Auto approval and manual login | Nothing | Lowest-friction signup; default behavior |
| Auto approval and auto login | Nothing | Low-stakes communities where instant access matters more than gatekeeping |
| Admin approval | A human reviewer’s judgment | Private or invite-style communities — doesn’t catch a mistyped or fake email, since nobody verifies the address itself |
| Auto approval after email confirmation | That the address is real and reachable | Public sites fighting spam and typo signups, with no admin bottleneck |
| Admin approval after email confirmation (Pro) | Both of the above | Membership or paid communities where spam and signup quality both matter |
If manual review — with or without email confirmation on top — is what your site actually needs, that workflow is covered in full in How to Approve Users in WordPress; this guide sticks to the confirmation step itself rather than repeating that one.
Troubleshooting: Verification Emails Not Sending
Two symptoms account for most “verification isn’t working” reports, and they have different fixes.
The email never arrives. WordPress sends mail through PHP’s built-in mail() function by default, and most hosts throttle, block, or fail to authenticate it — so it’s silently dropped or filed as spam. This is almost always fixed by connecting a real SMTP or transactional email provider instead of relying on PHP mail; SmartSMTP handles that setup for you, free, right from your WordPress dashboard. User Registration also logs failed sends — look for a “wp_mail() returned false” entry in the plugin’s debug log to confirm that’s actually the issue before troubleshooting further.
The link says “Token Expired.” By design: a confirmation link is only valid for 24 hours. That’s not a bug to fix — the resolution is clicking Resend Verification Link for a fresh one, which is exactly what the error message tells the user to do.
Want the full picture before you decide between free and Pro? See what’s included in User Registration Pro — the free plan covers everything in this guide.
Frequently Asked Questions
Does email verification stop spam registrations completely?
No. It filters out mistyped addresses and one-time disposable inboxes, but a determined bot that also controls the inbox it registers with can still verify itself. Pair it with a captcha — reCAPTCHA, hCaptcha, Cloudflare Turnstile, or User Registration’s own Force Captcha setting — or a honeypot field for actual bot resistance. Email confirmation and spam-blocking solve different problems, and neither replaces the other.
Can I verify existing users retroactively?
No built-in bulk action does this. The confirmation requirement applies to registrations made after you turn it on; accounts created before that aren’t retroactively flagged as unverified. If you need to handle a handful of existing accounts as exceptions, that’s a manual, case-by-case decision rather than something to script across your whole user table.
Will unverified users count toward my user limit?
User Registration itself doesn’t cap the number of WordPress users on your site. If you’re running paid membership plans with a seat or member cap, that limit is a property of the plan, not of the verification step — check whether your plan counts pending signups the same as approved members, since that’s a membership-tier setting rather than anything email confirmation changes.
Is email verification free, or do I need User Registration Pro?
Free. Auto Approval After Email Confirmation ships in the free core plugin — no add-on required. Pro is only needed if you also want a human review step (Admin Approval After Email Confirmation) or scheduled auto-deletion of stale unverified accounts.
Can I customize the verification email design?
Yes. Settings › Emails › Email Address Confirmation gives you a full rich-text editor for both the subject and the body, with the same smart-tag system used across every other User Registration email — so you can add your logo, footer, and tone of voice without touching code.
Wrapping Up
Now you know how to require email verification before login — a five-minute setting change that cuts spam signups and typo’d addresses without adding friction for real users. It’s free in User Registration’s core plugin, with no separate add-on to buy.
Want admin review on top of email confirmation, or stale unverified accounts to clean themselves up on a schedule? Both of those live in User Registration Pro.
You might also like:
- How to Approve Users in WordPress
- How to Enable Admin Approval in WooCommerce User Registration Forms
- How to Install User Registration