Does WordPress verify email ownership by default?

No. WordPress checks the email value during registration and sends a new-user notification, but ordinary WordPress registration does not require the person to click a confirmation link before the account is created. You need custom development or a verification plugin to create a token flow, confirm the address, and decide what unverified users may do.

Is WooCommerce’s built-in email confirmation enough to block fake orders?

Usually not. WooCommerce’s customer email confirmation confirms ownership of an existing account and can link matching guest orders after confirmation. It is different from requiring verification during registration or before checkout, so a store that must block fake accounts and orders generally needs an additional checkout verification solution or custom development.

Can I add email verification with a code snippet?

Yes, but a safe implementation needs more than one snippet. You must generate and expire a one-time token, send it, handle the verification request, store the verified state, limit resends, and enforce that state during login or checkout. The standard registration hooks may also be bypassed by custom forms or membership plugins.

Why are verification emails not arriving?

The most common cause is email delivery rather than the verification logic. WordPress mail may be affected by hosting restrictions, unauthenticated SMTP, sender-domain mismatches, or missing SPF, DKIM, and DMARC records. Configure authenticated delivery, use a sender on your site’s domain, check mail logs, and test the message with more than one inbox before blaming the verification feature.

Should verification happen before or after account creation?

That depends on the required security boundary. Creating a pending account and restricting access until the link is clicked is easier to support, while verifying before account creation reduces unverified records but requires the form to hold registration data safely. For checkout, enforce verification immediately before the order is accepted, otherwise customers may still submit fake or unreachable addresses.

How to verify customer email addresses in WordPress

Security Time About 30 minutes with a plugin, or several hours for custom development 6 steps Updated 3 Sep 2026

The short answer

WordPress does not require customers to prove they control an email address during registration, so a true verification gate needs custom development or a plugin. WooCommerce has a separate account-confirmation feature, but a plugin is the faster route for blocking fake registrations and orders.

The route

01Define what must be verified
02Check the native WordPress options
03Build the custom route carefully
04Fix email delivery before launch
05Test every customer path
06Use the fast route when needed

What you need

Administrator access to WordPress
A working registration or WooCommerce checkout form
A reliable email delivery method
A staging site or recent backup

Define what must be verified

Decide whether verification applies to WordPress registration, WooCommerce checkout, guest orders, account email changes, or all of them. These are separate flows, and verifying an account after registration is not the same as stopping an order before payment.

Also decide whether an unverified customer may log in, browse, place an order, or only receive limited access. Write this down before configuring anything, because many verification tools send a confirmation message without blocking every action by default.

Check the native WordPress options

WordPress core validates that a registration email has an acceptable format and sends a new-user notification, but it does not provide a general click-to-confirm ownership step for ordinary registrations. The registration_errors filter can add validation before a user is saved, while user_register runs after the account has been created.

For a WooCommerce store running a version that includes customer email confirmation, check WooCommerce > Settings > Accounts & Privacy. That flow confirms an existing account email and can link matching guest orders, but it is not a complete registration-and-checkout block.

Build the custom route carefully

A manual implementation needs more than sending a link. Create a one-time, expiring token; store only what is necessary; send the link through WordPress mail; process the callback safely; mark the address as verified; and provide a resend path with rate limits.

Use registration_errors to stop the standard registration when appropriate, and use user_register to start a verification process after account creation. Custom registration forms, membership plugins, page builders, and checkout blocks may use their own submission logic, so a hook that works for the default WordPress form may not affect another form.

For checkout, connect the same verified-state check to the actual checkout validation and order flow. If you only display a notice, customers may still place orders with unverified addresses.

Fix email delivery before launch

Send a test verification message to several providers, including Gmail and an address on your site’s domain. Check the inbox, spam folder, link expiry, resend behaviour, and what happens when the customer enters an old or already-used link.

WordPress mail can fail because of hosting configuration, SMTP settings, or missing sender authentication. Use an authenticated mail service where possible, send from an address on your site’s domain, and check SPF, DKIM, and DMARC records. A verification system cannot work if the message never reaches the customer.

Test every customer path

Test a new registration, an existing customer, a guest checkout, a customer who changes their email, an expired link, a mistyped code, a resend request, and a second attempt to use the same link. Confirm that unverified users are blocked exactly where you intended and that verified users are not repeatedly challenged.

Pay particular attention to checkout blocks, cached pages, payment links, and forms supplied by third-party plugins. If one path bypasses the verification check, fake orders can still get through even though the main registration form appears protected.

Use the fast route when needed

For most sites, the quickest practical option is the Customer Email Verification plugin. Install and activate it, then configure verification for registration and, where required, WooCommerce checkout. Set the verification message, expiry or resend behaviour, and the action taken when a customer has not confirmed the address.

This is the better fit when you need registration and checkout verification without maintaining token handling, account states, resend limits, and compatibility code yourself. It is also preferable when your site uses several form or membership systems. Treat the plugin as the fast route, not as a substitute for testing mail delivery and every checkout path.

The fast route

Let Customer Email Verification do it

Registration and checkout email verification with customizable messages and resend options; best for blocking fake accounts and orders.

Get Customer Email Verification

Sources

developer.wordpress.org /reference/hooks/registration_errors/?utm_source=openai
woocommerce.com /document/the-my-account-page/customer-email-confirmation/?u…
wordpress.org /support/topic/confirmation-emails-not-being-recieved/?utm_s…
developer.wordpress.org /reference/functions/wp_new_user_notification/?utm_source=op…

Questions

Does WordPress verify email ownership by default?: No. WordPress checks the email value during registration and sends a new-user notification, but ordinary WordPress registration does not require the person to click a confirmation link before the account is created. You need custom development or a verification plugin to create a token flow, confirm the address, and decide what unverified users may do.
Is WooCommerce’s built-in email confirmation enough to block fake orders?: Usually not. WooCommerce’s customer email confirmation confirms ownership of an existing account and can link matching guest orders after confirmation. It is different from requiring verification during registration or before checkout, so a store that must block fake accounts and orders generally needs an additional checkout verification solution or custom development.
Can I add email verification with a code snippet?: Yes, but a safe implementation needs more than one snippet. You must generate and expire a one-time token, send it, handle the verification request, store the verified state, limit resends, and enforce that state during login or checkout. The standard registration hooks may also be bypassed by custom forms or membership plugins.
Why are verification emails not arriving?: The most common cause is email delivery rather than the verification logic. WordPress mail may be affected by hosting restrictions, unauthenticated SMTP, sender-domain mismatches, or missing SPF, DKIM, and DMARC records. Configure authenticated delivery, use a sender on your site’s domain, check mail logs, and test the message with more than one inbox before blaming the verification feature.
Should verification happen before or after account creation?: That depends on the required security boundary. Creating a pending account and restricting access until the link is clicked is easier to support, while verifying before account creation reduces unverified records but requires the form to hold registration data safely. For checkout, enforce verification immediately before the order is accepted, otherwise customers may still submit fake or unreachable addresses.