User email verification
Provides email verification for user accounts with configurable time intervals, automatic blocking of unverified accounts, reminder notifications, and optional extended verification periods.
user_email_verification
Install
composer require 'drupal/user_email_verification:8.x-1.3'
Overview
The User email verification module provides a comprehensive solution for verifying user email addresses in Drupal. Unlike Drupal's core email verification which prevents users from logging in until verification is complete, this module allows users to log in immediately after registration while still enforcing email verification within a configurable time period.
The module creates a verification record for each user and tracks their verification status. If a user fails to verify their email within the specified time interval, their account is automatically blocked. Site administrators can configure how many reminder emails to send before blocking, and optionally enable an extended verification period that gives blocked users additional time to verify their email and reactivate their account.
The module integrates with Drupal's token system to provide verification links in email templates, supports Views for displaying verification status, provides a notification block for unverified users, and offers comprehensive integration with both Rules and ECA modules for custom workflow automation.
Features
- Allows users to enter password during registration and login immediately after registration
- Automatic email verification tracking with configurable time intervals (default 7 days)
- Automatic blocking of user accounts that fail to verify within the time limit
- Configurable reminder emails (up to 3) sent at equal intervals during the verification period
- Extended verification period option that allows blocked users additional time to verify and reactivate their account
- Role-based exemption from email verification requirements
- Extra fields on user profile showing verification status and date
- Notification block to remind logged-in users to verify their email
- Views integration for filtering and displaying user verification status
- Custom tokens [user:verify-email] and [user:verify-email-extended] for email templates
- Integration with Rules module for custom conditions and actions
- Integration with ECA module for event-driven workflows
- Cache context for proper caching of verification-dependent content
- Translatable email subjects and body text via Configuration Translation module
- Queue-based processing of blocking, reminders, and account deletion via cron
- Events for extending functionality: block account, delete account, create verification, verify email
- Auto-verification option for accounts created by administrators
- Auto-verification when administrators manually activate blocked accounts
- Configurable redirect URLs after successful verification
Use Cases
E-commerce User Registration
Allow customers to register and immediately browse products while requiring email verification before placing orders. Configure a 48-hour verification window with 2 reminders. Use the notification block in the cart region to remind unverified users to verify before checkout.
Community Forum with Spam Prevention
Prevent spam accounts by requiring email verification before users can post content. Set a short 24-hour verification period with no reminders. Unverified accounts are automatically blocked, keeping the community free of fake registrations.
Enterprise Intranet with Extended Recovery
For internal applications where account recovery is important, enable extended verification period. Users who miss the initial 7-day window still have 14 additional days to verify and recover their accounts. Administrators are notified when blocked users complete verification.
Multi-role Site with Selective Verification
Use role-based exemption to skip verification for trusted user roles like 'verified member' or 'premium subscriber' while requiring it for standard registrations.
Automated Workflow with Rules/ECA
Create custom workflows using Rules or ECA integration. For example, automatically assign a 'verified user' role when email is verified, or send a special welcome message after successful verification.
Tips
- Use the Token module to get a tree browser for available tokens when configuring email templates
- Place the notification block in a highly visible region like the header or highlighted area to ensure users see it
- Consider the user experience when setting time intervals - too short may frustrate legitimate users, too long may allow spam accounts
- Use the Views integration to create admin reports of unverified users and their verification status
- For sites with multiple languages, use Configuration Translation to translate email subjects and body texts
- The module respects the 'When cancelling a user account' setting for account deletion behavior
- Enable extended verification period for sites where user recovery is more important than strict enforcement
- Combine with Rules or ECA to create custom notification workflows or integration with CRM systems
Technical Details
Admin Pages 2
/admin/config/people/user-email-verification
Configure all aspects of email verification behavior including time intervals, reminders, extended verification period, and email templates.
/user/user-email-verification
Public form where users can request a new verification email by entering their username or email address.
Permissions 1
Hooks 8
hook_user_insert
Creates a verification record when a new user account is created.
hook_user_delete
Deletes the verification record when a user account is deleted.
hook_cron
Handles periodic tasks including sending reminders, blocking accounts, and deleting accounts.
hook_mail
Prepares email messages for verification and reminder emails.
hook_entity_extra_field_info
Provides extra fields for user entity display showing verification status and date.
hook_user_presave
Auto-verifies user when an admin activates a blocked account (if enabled in settings).
hook_condition_info_alter
Removes Rules conditions if Rules module is not enabled.
hook_user_view
Adds verification status and date to user entity display.
Troubleshooting 7
Ensure your site's email system is properly configured. Check that the [user:verify-email] token is included in the Welcome email template at /admin/config/people/accounts. Verify that the user's email address is valid and not blocked.
Check the 'Verification time interval' setting - ensure it's set to a reasonable value in seconds (604800 = 7 days). If set too low, users won't have enough time to verify.
The verification link validity is tied to the 'Verification time interval' setting. Increase this value if links are expiring before users can click them.
Check the 'Disable auto verification on account creation' setting. If enabled, admin-created accounts will also require email verification.
Enable the 'Extended verification period' feature to give blocked users additional time to verify their email and reactivate their accounts.
The Rules conditions require the Rules module to be enabled. If Rules is not installed, these conditions are automatically removed. Similarly, ECA conditions require the ECA module.
When the module is installed, all existing users are automatically marked as verified with the current timestamp. If this didn't happen, check the database table user_email_verification.
Security Notes 5
- Verification links use HMAC-based authentication with the site's hash salt for security
- Links include a timestamp to enforce expiration based on the configured time interval
- The 'manage user email verification settings' permission is marked as 'restrict access' - only grant to trusted administrators
- Consider the implications of the 'Delete user account' option - deleted accounts and their content may be permanently lost depending on cancellation method
- The module does not affect accounts with the 'administer users' permission by default