=== WPCoreTools Email Verify ===
Contributors: wpcoretools
Tags: email verification, woocommerce, checkout, anti spam, account confirmation
Requires at least: 6.4
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.0.7
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Simple email verification for WordPress and WooCommerce. Click-a-link confirmation — no OTP, no popup, no third-party API.

== Description ==

**WPCoreTools Email Verify** asks new customers to confirm their email address before they can order. They get an email with a link, they click it, and they are confirmed. There are no codes to type, no popups and no outside service.

You decide what an unconfirmed customer has to wait for. The recommended "Shop" setup lets them log in and browse straight away and holds back only ordering. The setup wizard also offers stricter and looser setups, each explained in plain words.

People who registered before you activated the plugin are never asked. Only new sign-ups confirm, and guest checkout is not affected.

The plugin is completely free. There is no Pro version, no paid add-on, no license key, no advertising and no tracking.

= Features =

* **Confirmation link by email.** Links are valid for 7 days by default (1 to 90). Tokens are stored hashed.
* **Choose what waits for confirmation:** placing orders, logging in, comments and reviews, creating an account at checkout, wp-admin, changing the email address in the profile, and selected capabilities.
* **Setup wizard** with ready-made setups: Shop (recommended), Strict, Community or Custom. You can run it again at any time.
* **Clear notices for customers** on My Account, the cart and checkout, with a resend link that counts down until a new email can be sent.
* **Wrong address? Change it.** A customer who mistyped their address can correct it from the notice and get a new link.
* **Resend form for logged-out visitors** on the login page. It is rate-limited and never reveals whether an address is registered.
* **Safe against link scanners.** Mail programs that open links in advance cannot confirm an account. Anyone not logged in as that customer sees a "Confirm my email" button first.
* **WooCommerce support:** classic checkout, the Cart and Checkout blocks, Pay for order links and HPOS. With WooCommerce 11, its own email confirmation and this plugin stay in step, so customers see one prompt.
* **Admin tools:** a Verified column, filter and bulk actions on the Users list, a Verified column on the Orders list, a dashboard widget, Site Health checks, CSV exports and a log of emails that could not be sent.
* **Warns about a second verification plugin**, which would leave customers confirmed in one and still blocked by the other.
* **Plain-text email by default**, or WooCommerce's email template, editable under WooCommerce > Settings > Emails.
* Works without WooCommerce, and on Multisite.

= Privacy =

The plugin contacts no outside service and collects no usage data. It supports WordPress's personal data export and erase tools. The resend form's rate limit stores only a hash of the visitor's IP address, for one hour.

= Requirements =

WordPress 6.4 or later and PHP 7.4 or later. WooCommerce is optional. If you use it, WooCommerce 9.2 or later is required, which itself needs WordPress 6.5.

= External services =

This plugin does not use any external services.

== Installation ==

1. In wp-admin go to Plugins > Add New Plugin, search for "WPCoreTools Email Verify", then install and activate it. You can also upload the plugin folder to `wp-content/plugins/`.
2. The setup wizard opens after activation. Pick a setup, or skip it and keep the defaults.
3. Change anything later under Settings > Email Verify, where you can also start the wizard again.
4. From then on, new registrations are asked to confirm their email address.

== Frequently Asked Questions ==

= Will this lock out my existing customers? =

No. Only accounts created after activation are asked to confirm. Existing accounts are treated as confirmed.

= Does it affect guest checkout? =

No. Every restriction applies only to logged-in customers, so guests check out and comment as before.

= Does it work with the Cart and Checkout blocks? =

Yes. It covers the blocks, the classic checkout and Pay for order links. Unconfirmed customers see why they cannot order yet, with a resend link.

= Can a new customer create an account at checkout and order right away? =

By default, yes: the account is created while that first order is placed, so there is nothing to confirm yet. After that the customer must confirm before ordering again. To make the first order wait as well, turn on "Block signup at checkout" in Settings > Email Verify.

= A customer did not get the email. What now? =

They can use the resend link in the notice, or the "Resend verification email" link on the login page, which also works while logged out. Admins can resend from the Users list or the user's profile. If no emails arrive at all, check the "Failed sends" tab and the Site Health screen.

= WooCommerce 11 has its own email confirmation. Will customers see two prompts? =

No. While this plugin is enabled it hides WooCommerce's prompt (WooCommerce 11.1 and later). Confirming in either place counts in both, and marking a customer verified or unverified as an admin is passed on to WooCommerce. Existing customers can be synced once from the Tools tab, in the background and without sending any email.

= What happens when a customer changes their email address? =

The new address has to be confirmed. The customer gets a link at the new address and waits for confirmation again. Staff in the exempt roles keep their status. You can also refuse email changes until the first address is confirmed.

= Can admins confirm or unconfirm a user by hand? =

Yes, on the Users list (row and bulk actions), on the user's profile, and with WP-CLI: `wp wpcev status|verify|unverify|resend <user>`.

= Does it block disposable email addresses? =

No. That is the job of our separate free plugin, WPCoreTools Disposable Email Guard. The two work together.

= Why does it look at other plugins' code? =

To warn you about a second email verification plugin. It reads the code that other plugins hook into registration, login and checkout, and, only when an admin presses "Scan the code now", the code of active plugins, mu-plugins and the theme. Everything stays on your server: nothing is sent anywhere and nothing is changed.

= Does it work on Multisite? =

Yes, including network activation. People who sign up through WordPress's multisite activation link are not asked to confirm a second time.

= Are there hooks for developers? =

Yes. The main ones are the filters `wpcev_is_blocked( $blocked, $user_id )`, `wpcev_is_verified( $verified, $user_id )` (ask whether a user is confirmed), `wpcev_skip_verification_on_register( $skip, $user_id )` (for example for single sign-on accounts) and `wpcev_verification_url( $url, $user_id, $token )`, and the actions `wpcev_user_verified( $user_id, $reason )` and `wpcev_user_unverified( $user_id, $reason )`.

== Screenshots ==

1. The setup wizard: ready-made setups (Shop, Strict, Community, Custom), each listing what it does for customers.
2. The settings page.
3. The notice an unconfirmed customer sees on My Account, with the resend link and the "Wrong address?" form.
4. Checkout for an unconfirmed customer: why ordering waits, with a resend link.
5. The Users list with the Verified column, the status filter and bulk actions.
6. The dashboard widget with verified and pending counts.

== Changelog ==

= 1.0.7 =

* First public release.

The full development history is in changelog.txt in the plugin folder.
