I'm working on a site which allows users to sign up for a service. They choose a username/password, enter their personal details, etc and proceed into the site, their details being stored for future visits.

Currently, we don't ask for confirmation of the user's email address like most websites do.

The main function of the site is to process payment information for the service being offered but the client will likely want to expand the functionality of the site in the near future.

So my question is, should I be implementing an email confirmation system for new users and what are the risks to the site if I don't?

  • 6
    In addition to the answers provided, it's also handy as it stops users impersonating others to a degree (prevents them using someone else's email address)
    – fin1te
    Commented Aug 15, 2012 at 17:57
  • 4
    This has more to do with trying to prove an actual human signed up instead of web crawler. While it can be trivial to parse an email for links, bobince makes it sounds a great deal easier then it actually is, depending how complicate the formatting within the actual email is.
    – Ramhound
    Commented Aug 16, 2012 at 11:37

6 Answers 6


You will want to be sure that a user's e-mail address is correct if you intend to send mail to it that is either:

  • security-sensitive (eg forgotten password reset token), or
  • recurring/high-quantity, to avoid harassing some other person whose address has been entered.

This is typically more about weeding out incorrect addresses that have been entered by mistake than some malicious attack.

If you never intend to send mail to the address, you're only really using it as a fixed-format username and there is no particular need to validate it. But I would imagine that's an option you probably want to keep open.

E-mail validation is not about rate-limiting sign-ups. It's totally ineffective at this for anything but low-motivation/untargeted attacks, because there is no scarcity factor on e-mail addresses. It's trivial for an attacker to register some domains, use unlimited random e-mail addresses on them, and validate using an automated tool reading their inboxes.

  • Typically email resets come from pages where the user enters the email for which they need a reset. So if a user used a wrong email (maybe a typo) when signing up, they'd just get "No account for this email" on the password reset page, right? So where would the security risk be.
    – Garrett
    Commented Dec 12, 2020 at 21:30
  • @Garrett If a password reset page is developed securely, it should always reply with something like, "An email has been sent to this address. Please check your inbox for further instructions." Otherwise, it is possible to enumerate user accounts based on the form's response. This can also have privacy implications depending on the context. Troy Hunt has a good guide about this if you want further information: troyhunt.com/everything-you-ever-wanted-to-know
    – jsaigle
    Commented Jul 9, 2021 at 17:21
  • I can avoid confirming email address usage on the Reset Password page, but not sure how much good that does considering on the Signup page, I believe I have no choice but to confirm if the email is a user or not.
    – Garrett
    Commented Jul 9, 2021 at 19:39
  • Here's more on the topic of confirming emails.
    – Garrett
    Commented Oct 22, 2021 at 2:48

If you plan on sending email to that address then you need to verify to avoid being identified as a spammer.

If you ask the user to agree to a contract and you can't verify identity based on some other information like a CC#, then you need to verify. If not, then if you ever need to go to court for breach of contract, you have no evidence that the person you're suing was the one who used the service.

If you are legally required to limit access to your site (for example, to people of a certain age), then not taking common steps like verifying email could be used against you as evidence that you're not serious about filtering your clientele, even if you have other methods to filter.


You should implement e-mail confirmation for new users, if for nothing else than 'security theater,' users expect that once they sign up for a service using an e-mail as an identifier they expect verification.

Taking your question in a vacuum without making further assumptions, the risk to your users or really potential users is relatively low. The risk to your infrastructure could be significant, once your man-hours to fix and vet user ids has surpassed the amount of time it would have taken to standup a system to verify e-mail addresses.


Email confirmation will help you determine that the person who says their email is [email protected] actually has control of this email.

The benefits of forcing them to confirm their email are:

  • You verify that the email address exists and mails can be sent to it
  • You verify that they actually have access to the inbox

should I be implementing an email confirmation system for new users and what are the risks to the site if I don't?

If you intend on sending mail for any reason, it's really a good idea to confirm the email address.

If you don't confirm the users email then you risk:

  • sending email to somebody that doesn't want it
  • the email bouncing back because it doesn't exist
  • sending sensitive information to the wrong address (this could be intentional by the user, or they could have mistyped their email)

Because chances are you will attract spammers that create thousands of account an hour. With registering an email address you reduce this number significantly.

  • the rate limiting aspect of this is a large part of why you might consider it.
    – Bill
    Commented Aug 15, 2012 at 16:31
  • 3
    How does this effectively rate limit? If someone has a domain then they have a virtually unlimited number of domains, and writing something that scans mail and GETs URLs in them is trivial. Commented Aug 16, 2012 at 6:32
  • 2
    @MikeSamuel, it does work in practice because most Spammer don't care at the moment. Commented Aug 16, 2012 at 9:14
  • 1
    A domain is a lot more simple to block and delete than when an open registry system is used Commented Aug 16, 2012 at 16:36
  • 1
    @MikeSamuel "It doesn't make sense to say that something works when it's likely to stop working as soon as it matters" Sadly, many anti-spam methods have this property (see grey listing).
    – curiousguy
    Commented Aug 16, 2012 at 16:38

In addition to what others have said, there might be an opportunity for phishing depending on the features of the web app.

For example, if the website <domain>.com allows me to register myself using the email admin@<domain>.com without requiring any proof that I own that email, I may be able to trick other users into divulging sensitive information to me. This could happen in the context of a messaging feature where users are identified to each other using email addresses only.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .