Home/ Questions/Q 390831
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T16:00:10+00:00

I’ve gotten into a habit of using the standard register->send activation email->activate account process

  • 0

I’ve gotten into a habit of using the standard register->send activation email->activate account process for every site that supports user authentication and free registration without questioning if I really need this.

What are your thoughts on this? If I have captcha on the registration form is the email confirmation process really necessary?

EDIT:

OK, so the general consensus seems to be that by getting the users to confirm the email they entered I’ll keep them away from putting someone else’s email in there.
What about when I let users edit their profile/settings and they enter another email?
If I need to keep them away from entering other people’s addresses then I’d need to confirm that email address (by temporarily deactivating their accoun)t every time they change it.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Captcha+activation prevents bots AND spoofed people

    Well basically it is since each part prevents one problematic scenario:

    • Captcha prevents (if you use strong captcha like reCaptcha) bots from registering new users
    • Email activation prevents people from registering other people (by their email address)

    I guess this is a valid everyday pattern for registration that’s widely acknowledged by IT community.

    EDIT
    Yes. When you want to prevent users from changing their email address, you’d have to repeat email activation procedure to make it robust.
    But you don’t have to deactivate their account while doing it. All you have to do is having a pending email-change email activation active. If it gets activated, you change email address at that point (not when they change it), otherwise the old one is still used.

    • 0