Member Avatar for ironmodulus

Hello everyone,

I'm new to this forum and I thought I should just introduce myself before I ask my real question. I started web programming almost 10 years ago and now I want to start back up and make web programs.. The only problem is, I'm about 10 years out of the loop. I'm still adjusting to how current websites are made.. so cut me some slack ;)

Anyway, I'm working on a site that requires creating an account. I'm wondering if account activation through email or whatever is outdated. Weren't those originally created to stop bots from creating accounts? And, if so, bots seem to be advanced enough to be able to get past that type of thing, rendering email account verification sort of useless.

Is there an alternative or are they just a waste of time, now? Thanks!

  • 4 Contributors
  • 3 Replies
  • 195 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by rocco88

Dani AI

Generated

Welcome back . Short answer: email activation is not obsolete. It still proves a user controls the address and helps keep your contact list clean, which matters for password recovery, billing, and notifications. As and observed, that is the core benefit, and as hinted, hosting/providers can affect how you deliver verification mail — so treat deliverability as part of the design.

Email verification should be a measured part of your flow, not the only defense. Require verification when the email is critical (payments, account recovery, posting privileges), or use soft verification: create the account immediately but mark it unverified and restrict sensitive features until confirmation. That reduces abandonment while still protecting important actions.

Complement email checks with other, low-friction anti-abuse measures: MX/SMTP existence checks and disposable-email detection to catch throwaway addresses; a hidden honeypot field and rate limits to foil bulk scripts; behavior- or risk-based CAPTCHAs for suspicious signups. For higher assurance, add SMS/phone verification or 2FA, or gate certain actions behind social-login with additional checks — each has cost and UX trade-offs.

Implementation and UX tips: send a single-use, cryptographically random token with a reasonable expiry (24–72 hours), provide a visible but rate-limited “resend verification” action, log a verified_at timestamp, and handle hard bounces by flagging or disabling the address. Avoid revealing whether an email exists in recovery flows to prevent enumeration. Double opt-in can help mailing-list deliverability and consent tracking. In short: keep verification, but pair it with other defenses and clear UX so you balance security and conversion.

Recommended Answers

All 3 Replies

Member Avatar for twiss

I think they're meant to make sure the user provides his or her email address.

Member Avatar for CheekyCheeks

Webs.com is still using accounts stuff but ya need 2 pay 4 yo own email adresses

Member Avatar for rocco88

I think it is still a good way as it will allow you to make sure the email is valid.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.