{"id":348248,"date":"2026-08-05T22:36:18","date_gmt":"2026-08-05T22:36:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/argentwolf-email-verification\/"},"modified":"2026-08-05T22:36:10","modified_gmt":"2026-08-05T22:36:10","slug":"argentwolf-email-verification","status":"publish","type":"plugin","link":"https:\/\/sa.wordpress.org\/plugins\/argentwolf-email-verification\/","author":14244010,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.0.3","requires":"6.1","requires_php":"8.4","requires_plugins":null,"header_name":"ArgentWolf Email Verification","header_author":"Alan Johnson","header_description":"Keeps newly self-registered accounts inactive until the user verifies the registered email address. Verification is processed locally through WordPress and wp_mail().","assets_banners_color":"","last_updated":"2026-08-05 22:36:10","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/github.com\/thystra\/wp-argentwolf-email-verification","header_author_uri":"https:\/\/github.com\/thystra","rating":0,"author_block_rating":0,"active_installs":0,"downloads":37,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"Thystra","date":"2026-08-05 22:36:10"}},"upgrade_notice":{"1.0.0":"<p>Initial public WordPress.org release. Existing installations retain their verification settings and user metadata.<\/p>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3635902,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3635902,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[87407,18971,603,43499],"plugin_category":[58],"plugin_contributors":[274586],"plugin_business_model":[],"class_list":["post-348248","plugin","type-plugin","status-publish","hentry","plugin_tags-account-activation","plugin_tags-email-verification","plugin_tags-registration","plugin_tags-user-verification","plugin_category-user-management","plugin_contributors-thystra","plugin_committers-thystra"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/argentwolf-email-verification\/assets\/icon-128x128.png?rev=3635902","icon_2x":"https:\/\/ps.w.org\/argentwolf-email-verification\/assets\/icon-256x256.png?rev=3635902","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>ArgentWolf Email Verification provides local, self-hosted email verification for newly registered WordPress users.<\/p>\n\n<p>The plugin does not call an external email-verification API. It creates a one-time verification link locally and sends the message through WordPress <code>wp_mail()<\/code> and the site's configured mail transport.<\/p>\n\n<p>Core behavior:<\/p>\n\n<ul>\n<li>Existing accounts are preserved as verified when the plugin is first activated.<\/li>\n<li>Accounts created deliberately by a logged-in administrator or WP-CLI are automatically verified.<\/li>\n<li>Other newly registered accounts are marked Pending.<\/li>\n<li>Pending users cannot authenticate with a normal password or an Application Password.<\/li>\n<li>WordPress's normal new-user email is suppressed while an account is pending.<\/li>\n<li>Users can request another verification message without disclosing whether an account exists.<\/li>\n<li>Administrators can view verification status, resend verification, or verify an account manually.<\/li>\n<li>Pending accounts can be removed automatically after a configurable retention period.<\/li>\n<li>Administrators and pending users who own WordPress content are not removed by cleanup.<\/li>\n<li>Ordinary <code>wp_mail()<\/code> messages to pending account addresses can be suppressed.<\/li>\n<li>Mixed-recipient messages continue to verified users and outside addresses after pending addresses are removed.<\/li>\n<li>Verification status is available to compatible plugins through a public API.<\/li>\n<\/ul>\n\n<p>The plugin does not prove that a mailbox exists without sending a message, replace SMTP service, process bounces, or guarantee inbox delivery.<\/p>\n\n<h3>Settings<\/h3>\n\n<p>The settings page is under <strong>Settings &gt; Email Verification<\/strong>.<\/p>\n\n<h4>Delete pending accounts after<\/h4>\n\n<p>Default: seven days. Enter zero to disable automatic deletion. Valid range: zero to 365 days.<\/p>\n\n<h4>Other outbound email<\/h4>\n\n<p>Enabled by default. Normal <code>wp_mail()<\/code> messages to pending account addresses are suppressed. This cannot intercept another plugin that bypasses <code>wp_mail()<\/code> and sends through its own transport or remote API.<\/p>\n\n<h4>Cleanup status<\/h4>\n\n<p>Displays the pending-account count and the next scheduled cleanup. Administrators can also run cleanup manually.<\/p>\n\n<h3>Privacy<\/h3>\n\n<p>The plugin stores verification status and limited verification-workflow metadata in WordPress user metadata.<\/p>\n\n<p>Raw verification tokens are not stored. The plugin stores a keyed token hash, expiration time, message-request time, and limited registration-workflow state.<\/p>\n\n<p>The plugin includes suggested privacy-policy text and WordPress personal-data exporter and eraser integration. Token and message metadata can be erased, but verification status is retained because removing it could alter account-access security.<\/p>\n\n<h3>Security<\/h3>\n\n<ul>\n<li>Verification tokens contain 256 bits of cryptographically secure randomness.<\/li>\n<li>Only an HMAC-SHA256 token hash is stored.<\/li>\n<li>Verification links expire after 48 hours by default.<\/li>\n<li>Requesting a new link invalidates the previous link.<\/li>\n<li>Public resend requests are throttled.<\/li>\n<li>Public responses do not disclose whether an account exists.<\/li>\n<li>Administrators are protected from accidental lockout.<\/li>\n<li>Accounts without an explicit Pending marker are treated as verified to preserve established access during upgrades or temporary interruptions.<\/li>\n<\/ul>\n\n<h3>Developer API<\/h3>\n\n<p>Canonical filters and actions use the <code>argentwolf_email_verification_<\/code> prefix. Selected legacy <code>wrav_ev_*<\/code> aliases remain for compatibility.<\/p>\n\n<p>Important filters:<\/p>\n\n<ul>\n<li><code>argentwolf_email_verification_link_lifetime<\/code><\/li>\n<li><code>argentwolf_email_verification_resend_cooldown<\/code><\/li>\n<li><code>argentwolf_email_verification_cleanup_batch_size<\/code><\/li>\n<li><code>argentwolf_email_verification_auto_verify_new_user<\/code><\/li>\n<li><code>argentwolf_email_verification_email_subject<\/code><\/li>\n<li><code>argentwolf_email_verification_email_message<\/code><\/li>\n<li><code>argentwolf_email_verification_after_verification_url<\/code><\/li>\n<li><code>argentwolf_email_verification_should_delete_pending_user<\/code><\/li>\n<\/ul>\n\n<p>Important actions:<\/p>\n\n<ul>\n<li><code>argentwolf_email_verification_user_verified<\/code><\/li>\n<li><code>argentwolf_email_verification_pending_user_deleted<\/code><\/li>\n<li><code>argentwolf_email_verification_pending_user_cleanup_skipped<\/code><\/li>\n<li><code>argentwolf_email_verification_mail_suppressed<\/code><\/li>\n<li><code>argentwolf_email_verification_error<\/code><\/li>\n<\/ul>\n\n<p>The error action receives a stable error code and a context array. It lets a logging or monitoring integration record operational failures without the plugin writing directly to the PHP error log.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>argentwolf-email-verification<\/code> directory to <code>\/wp-content\/plugins\/<\/code>, or install the release ZIP through the WordPress Plugins screen.<\/li>\n<li>Activate <strong>ArgentWolf Email Verification<\/strong>.<\/li>\n<li>Open <strong>Settings &gt; Email Verification<\/strong>.<\/li>\n<li>Review pending-account retention and outbound-email suppression.<\/li>\n<li>Test registration and verification using an address you control.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20the%20plugin%20use%20an%20external%20verification%20service%3F\"><h3>Does the plugin use an external verification service?<\/h3><\/dt>\n<dd><p>No. Token creation and verification are processed locally by WordPress. Messages are sent through <code>wp_mail()<\/code>.<\/p><\/dd>\n<dt id=\"which%20users%20become%20pending%3F\"><h3>Which users become pending?<\/h3><\/dt>\n<dd><p>New self-registrations become pending. Accounts created by WP-CLI, administrators, or a logged-in user who can create users are trusted and automatically verified.<\/p><\/dd>\n<dt id=\"what%20happens%20before%20verification%3F\"><h3>What happens before verification?<\/h3><\/dt>\n<dd><p>The account cannot authenticate with a normal password or an Application Password. Ordinary outbound messages to the pending address are suppressed by default.<\/p><\/dd>\n<dt id=\"can%20an%20administrator%20verify%20a%20user%20manually%3F\"><h3>Can an administrator verify a user manually?<\/h3><\/dt>\n<dd><p>Yes. Pending users have Verify and Resend actions on the WordPress Users screen.<\/p><\/dd>\n<dt id=\"can%20pending%20accounts%20be%20deleted%20automatically%3F\"><h3>Can pending accounts be deleted automatically?<\/h3><\/dt>\n<dd><p>Yes. Cleanup runs daily through WP-Cron. The default retention is seven days and can be changed from zero to 365 days. Setting it to zero disables deletion.<\/p>\n\n<p>Cleanup skips administrators, users who own WordPress content, and users excluded by the cleanup filter.<\/p><\/dd>\n<dt id=\"does%20a%20successful%20wp_mail%28%29%20result%20prove%20delivery%3F\"><h3>Does a successful wp_mail() result prove delivery?<\/h3><\/dt>\n<dd><p>No. It only means WordPress handed the message to the configured mailer without an immediate error.<\/p><\/dd>\n<dt id=\"does%20the%20plugin%20support%20another%20plugin%20checking%20verification%20status%3F\"><h3>Does the plugin support another plugin checking verification status?<\/h3><\/dt>\n<dd><p>Yes. Use the public functions:<\/p>\n\n<pre><code>argentwolf_email_verification_is_user_verified( int $user_id ): bool\n\nargentwolf_email_verification_get_user_verification_status( int $user_id ): string\n<\/code><\/pre>\n\n<p>The status function returns <code>verified<\/code>, <code>pending<\/code>, or <code>unknown<\/code>.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial public release on the WordPress.org Plugin Directory.<\/li>\n<li>Promoted the reviewed 0.3.4 codebase to semantic version 1.0.0 without changing verification behavior or stored data.<\/li>\n<li>Requires WordPress 6.1 or later and PHP 8.4 or later.<\/li>\n<li>Includes public verification APIs, privacy integration, configurable cleanup, pending-recipient mail suppression, and administrator controls.<\/li>\n<\/ul>\n\n<h4>0.3.4<\/h4>\n\n<ul>\n<li>Raised the minimum supported PHP version to 8.4.<\/li>\n<li>Added WordPress integration coverage for the public verification API.<\/li>\n<li>Tested verified, pending, missing-meta, unknown, deleted, and administrator users.<\/li>\n<li>Tested the canonical successful-verification action.<\/li>\n<li>Added Composer-based PHP validation and a GitHub Actions test matrix.<\/li>\n<li>Documented the legacy public-hook deprecation and compatibility policy.<\/li>\n<li>Synchronized the plugin version and WordPress.org Stable Tag.<\/li>\n<\/ul>\n\n<h4>0.3.3<\/h4>\n\n<ul>\n<li>Changed the WordPress.org contributor username to <code>thystra<\/code>.<\/li>\n<li>Changed the plugin author name to Alan Johnson.<\/li>\n<li>Retained the GitHub profile as the Author URI.<\/li>\n<li>No runtime behavior, settings, verification state, or data storage changed.<\/li>\n<\/ul>\n\n<h4>0.3.2<\/h4>\n\n<ul>\n<li>Documented and narrowly suppressed two intentional Plugin Check slow-query warnings.<\/li>\n<li>The affected queries remain bounded and are used only for daily pending-account cleanup and the administrative pending-account count.<\/li>\n<li>No verification, login, email, cleanup, settings, or data-storage behavior changed.<\/li>\n<\/ul>\n\n<h4>0.3.1<\/h4>\n\n<ul>\n<li>Added the missing translator explanation for the verification greeting placeholder.<\/li>\n<li>Replaced direct PHP error-log writes with an integration action for operational errors.<\/li>\n<li>Replaced direct database queries with WordPress user and post query APIs.<\/li>\n<li>Corrected WordPress.org readme branding, version, and public documentation.<\/li>\n<li>Preserved existing verification settings, user metadata, hooks, and behavior.<\/li>\n<\/ul>\n\n<h4>0.3.0<\/h4>\n\n<ul>\n<li>Standardized the public name, slug, text domain, main file, and integration API as ArgentWolf Email Verification.<\/li>\n<li>Added public verification-status functions for companion plugins.<\/li>\n<li>Added canonical lifecycle actions while retaining selected legacy aliases.<\/li>\n<li>Added WordPress privacy-policy, exporter, and eraser integration.<\/li>\n<li>Added repository documentation, validation tooling, and deterministic release packaging.<\/li>\n<li>Added a support-development link to the settings page and plugin action row.<\/li>\n<li>Preserved existing <code>wrav_ev_*<\/code> settings and user metadata for upgrade compatibility.<\/li>\n<\/ul>\n\n<h4>0.2.0<\/h4>\n\n<ul>\n<li>Added configurable deletion of stale pending accounts.<\/li>\n<li>Added daily WP-Cron cleanup and a manual cleanup action.<\/li>\n<li>Added settings for retention and pending-recipient mail suppression.<\/li>\n<li>Added mixed-recipient filtering and cleanup safety exclusions.<\/li>\n<\/ul>\n\n<h4>0.1.0<\/h4>\n\n<ul>\n<li>Initial test release.<\/li>\n<\/ul>","raw_excerpt":"Keeps newly self-registered WordPress accounts inactive until the owner verifies the registered email address.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/348248","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=348248"}],"author":[{"embeddable":true,"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/thystra"}],"wp:attachment":[{"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=348248"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=348248"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=348248"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=348248"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=348248"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/sa.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=348248"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}