Title: ArgentWolf Email Verification Author: Alan Johnson Published: August 5, 2026 Last modified: August 5, 2026 --- Search plugins ![](https://ps.w.org/argentwolf-email-verification/assets/icon-256x256.png?rev=3635902) # ArgentWolf Email Verification By [Alan Johnson](https://profiles.wordpress.org/thystra/) [Download](https://downloads.wordpress.org/plugin/argentwolf-email-verification.1.0.0.zip) * [Details](https://mri.wordpress.org/plugins/argentwolf-email-verification/#description) * [Reviews](https://mri.wordpress.org/plugins/argentwolf-email-verification/#reviews) * [Installation](https://mri.wordpress.org/plugins/argentwolf-email-verification/#installation) * [Development](https://mri.wordpress.org/plugins/argentwolf-email-verification/#developers) [Support](https://wordpress.org/support/plugin/argentwolf-email-verification/) ## Description ArgentWolf Email Verification provides local, self-hosted email verification for newly registered WordPress users. The plugin does not call an external email-verification API. It creates a one-time verification link locally and sends the message through WordPress `wp_mail()` and the site’s configured mail transport. Core behavior: * Existing accounts are preserved as verified when the plugin is first activated. * Accounts created deliberately by a logged-in administrator or WP-CLI are automatically verified. * Other newly registered accounts are marked Pending. * Pending users cannot authenticate with a normal password or an Application Password. * WordPress’s normal new-user email is suppressed while an account is pending. * Users can request another verification message without disclosing whether an account exists. * Administrators can view verification status, resend verification, or verify an account manually. * Pending accounts can be removed automatically after a configurable retention period. * Administrators and pending users who own WordPress content are not removed by cleanup. * Ordinary `wp_mail()` messages to pending account addresses can be suppressed. * Mixed-recipient messages continue to verified users and outside addresses after pending addresses are removed. * Verification status is available to compatible plugins through a public API. The plugin does not prove that a mailbox exists without sending a message, replace SMTP service, process bounces, or guarantee inbox delivery. ### Settings The settings page is under **Settings > Email Verification**. #### Delete pending accounts after Default: seven days. Enter zero to disable automatic deletion. Valid range: zero to 365 days. #### Other outbound email Enabled by default. Normal `wp_mail()` messages to pending account addresses are suppressed. This cannot intercept another plugin that bypasses `wp_mail()` and sends through its own transport or remote API. #### Cleanup status Displays the pending-account count and the next scheduled cleanup. Administrators can also run cleanup manually. ### Privacy The plugin stores verification status and limited verification-workflow metadata in WordPress user metadata. Raw verification tokens are not stored. The plugin stores a keyed token hash, expiration time, message-request time, and limited registration-workflow state. The plugin includes suggested privacy-policy text and WordPress personal-data exporter and eraser integration. Token and message metadata can be erased, but verification status is retained because removing it could alter account-access security. ### Security * Verification tokens contain 256 bits of cryptographically secure randomness. * Only an HMAC-SHA256 token hash is stored. * Verification links expire after 48 hours by default. * Requesting a new link invalidates the previous link. * Public resend requests are throttled. * Public responses do not disclose whether an account exists. * Administrators are protected from accidental lockout. * Accounts without an explicit Pending marker are treated as verified to preserve established access during upgrades or temporary interruptions. ### Developer API Canonical filters and actions use the `argentwolf_email_verification_` prefix. Selected legacy `wrav_ev_*` aliases remain for compatibility. Important filters: * `argentwolf_email_verification_link_lifetime` * `argentwolf_email_verification_resend_cooldown` * `argentwolf_email_verification_cleanup_batch_size` * `argentwolf_email_verification_auto_verify_new_user` * `argentwolf_email_verification_email_subject` * `argentwolf_email_verification_email_message` * `argentwolf_email_verification_after_verification_url` * `argentwolf_email_verification_should_delete_pending_user` Important actions: * `argentwolf_email_verification_user_verified` * `argentwolf_email_verification_pending_user_deleted` * `argentwolf_email_verification_pending_user_cleanup_skipped` * `argentwolf_email_verification_mail_suppressed` * `argentwolf_email_verification_error` The error action receives a stable error code and a context array. It lets a logging or monitoring integration record operational failures without the plugin writing directly to the PHP error log. ## Installation 1. Upload the `argentwolf-email-verification` directory to `/wp-content/plugins/`, or install the release ZIP through the WordPress Plugins screen. 2. Activate **ArgentWolf Email Verification**. 3. Open **Settings > Email Verification**. 4. Review pending-account retention and outbound-email suppression. 5. Test registration and verification using an address you control. ## FAQ ### Does the plugin use an external verification service? No. Token creation and verification are processed locally by WordPress. Messages are sent through `wp_mail()`. ### Which users become pending? New self-registrations become pending. Accounts created by WP-CLI, administrators, or a logged-in user who can create users are trusted and automatically verified. ### What happens before verification? The account cannot authenticate with a normal password or an Application Password. Ordinary outbound messages to the pending address are suppressed by default. ### Can an administrator verify a user manually? Yes. Pending users have Verify and Resend actions on the WordPress Users screen. ### Can pending accounts be deleted automatically? Yes. Cleanup runs daily through WP-Cron. The default retention is seven days and can be changed from zero to 365 days. Setting it to zero disables deletion. Cleanup skips administrators, users who own WordPress content, and users excluded by the cleanup filter. ### Does a successful wp_mail() result prove delivery? No. It only means WordPress handed the message to the configured mailer without an immediate error. ### Does the plugin support another plugin checking verification status? Yes. Use the public functions: ``` argentwolf_email_verification_is_user_verified( int $user_id ): bool argentwolf_email_verification_get_user_verification_status( int $user_id ): string ``` The status function returns `verified`, `pending`, or `unknown`. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “ArgentWolf Email Verification” is open source software. The following people have contributed to this plugin. Contributors * [ Alan Johnson ](https://profiles.wordpress.org/thystra/) [Translate “ArgentWolf Email Verification” into your language.](https://translate.wordpress.org/projects/wp-plugins/argentwolf-email-verification) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/argentwolf-email-verification/), check out the [SVN repository](https://plugins.svn.wordpress.org/argentwolf-email-verification/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/argentwolf-email-verification/) by [RSS](https://plugins.trac.wordpress.org/log/argentwolf-email-verification/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * Initial public release on the WordPress.org Plugin Directory. * Promoted the reviewed 0.3.4 codebase to semantic version 1.0.0 without changing verification behavior or stored data. * Requires WordPress 6.1 or later and PHP 8.4 or later. * Includes public verification APIs, privacy integration, configurable cleanup, pending-recipient mail suppression, and administrator controls. #### 0.3.4 * Raised the minimum supported PHP version to 8.4. * Added WordPress integration coverage for the public verification API. * Tested verified, pending, missing-meta, unknown, deleted, and administrator users. * Tested the canonical successful-verification action. * Added Composer-based PHP validation and a GitHub Actions test matrix. * Documented the legacy public-hook deprecation and compatibility policy. * Synchronized the plugin version and WordPress.org Stable Tag. #### 0.3.3 * Changed the WordPress.org contributor username to `thystra`. * Changed the plugin author name to Alan Johnson. * Retained the GitHub profile as the Author URI. * No runtime behavior, settings, verification state, or data storage changed. #### 0.3.2 * Documented and narrowly suppressed two intentional Plugin Check slow-query warnings. * The affected queries remain bounded and are used only for daily pending-account cleanup and the administrative pending-account count. * No verification, login, email, cleanup, settings, or data-storage behavior changed. #### 0.3.1 * Added the missing translator explanation for the verification greeting placeholder. * Replaced direct PHP error-log writes with an integration action for operational errors. * Replaced direct database queries with WordPress user and post query APIs. * Corrected WordPress.org readme branding, version, and public documentation. * Preserved existing verification settings, user metadata, hooks, and behavior. #### 0.3.0 * Standardized the public name, slug, text domain, main file, and integration API as ArgentWolf Email Verification. * Added public verification-status functions for companion plugins. * Added canonical lifecycle actions while retaining selected legacy aliases. * Added WordPress privacy-policy, exporter, and eraser integration. * Added repository documentation, validation tooling, and deterministic release packaging. * Added a support-development link to the settings page and plugin action row. * Preserved existing `wrav_ev_*` settings and user metadata for upgrade compatibility. #### 0.2.0 * Added configurable deletion of stale pending accounts. * Added daily WP-Cron cleanup and a manual cleanup action. * Added settings for retention and pending-recipient mail suppression. * Added mixed-recipient filtering and cleanup safety exclusions. #### 0.1.0 * Initial test release. ## Meta * Version **1.0.0** * Last updated **12 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.1 or higher ** * Tested up to **7.0.2** * PHP version ** 8.4 or higher ** * Language * [English (US)](https://wordpress.org/plugins/argentwolf-email-verification/) * Tags * [account activation](https://mri.wordpress.org/plugins/tags/account-activation/) [email verification](https://mri.wordpress.org/plugins/tags/email-verification/) [registration](https://mri.wordpress.org/plugins/tags/registration/)[User verification](https://mri.wordpress.org/plugins/tags/user-verification/) * [Advanced View](https://mri.wordpress.org/plugins/argentwolf-email-verification/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/argentwolf-email-verification/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/argentwolf-email-verification/reviews/) ## Contributors * [ Alan Johnson ](https://profiles.wordpress.org/thystra/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/argentwolf-email-verification/)