Email Verification

Mandatory verification before order/activation

What it is

Email verification ensures clients confirm their email address before they can place orders and/or before their services activate. You can require verification before ordering (blocks checkout until verified) and/or before activation (allows order and payment but delays service activation until verified).

How it works

Two admin-configurable settings control behaviour:

Setting key	Effect when enabled
`require_email_verification_before_order`	Checkout is blocked until the client has verified their email. Unverified users cannot complete an order.
`require_email_verification_before_activation`	Orders and payment can complete, but services are not activated until the client verifies their email. Uses `activation_pending_verification` status.

Both can be enabled. If before order is on, the client must verify before they can even reach checkout. If only before activation is on, they can order and pay, but services stay in a pending state until verification.

The helpers requireEmailVerificationBeforeOrder() and requireEmailVerificationBeforeActivation() (in includes/helpers/settings.php) read these settings. processGuestCheckoutOrder() in includes/helpers/checkout.php enforces the before-order check. Activation logic in orders_services.php enforces the before-activation check.

Code example (checkout enforcement)

// In checkout helper - blocks unverified users from ordering
if (requireEmailVerificationBeforeOrder()) {
    if (!$auth->isLoggedIn()) {
        throw new Exception('Please register and verify your email before placing an order.');
    }
    if (!isUserEmailVerified($userId)) {
        throw new Exception('Please verify your email before placing an order.');
    }
}

How to set up

Go to Admin → Settings → Client Registration (/admin/settings/client-registration).
Enable Require verification before ordering to block checkout until email is verified.
Enable Require verification before activation to delay service activation until verified.
Save settings.

Ensure the users table has an email_verified column (added via migration). Verification emails are sent when the client registers; they click a link to set email_verified = 1.

Was this helpful?

Tags: Security