Suppose my site needs to register for a member account with email, and the email needs to be verified and activated. I forbid users to register with same email twice. When it does, should I remind the user to activate the email? Or just display the message 'This email has been used',same as trying to register with already activated email?

3 Answers 3


You should never reveal on the website, whether a specific e-mail address has been used to register. This allows a user enumeration attack and may likely be a privacy issue for your users.

Instead, in your case, send an informational e-mail to the address in question.

  • "send an informational e-mail to the address in question" might allow to spam emails and get your website SMTP to be blacklisted
    – Xenos
    Commented Jun 19, 2018 at 15:15
  • @Xenos Since the e-email is already registered, I would not consider this e-mail as spam. And an offending entity would like to send their message anyways, not a generic text.
    – Marcel
    Commented Jun 19, 2018 at 21:40
  • 1
    IMO, offending entity can be willing to make your website SMTP be blacklisted, and one way would be to make it send emails in loop to users. So I would still add a check to not send a "account locked" email twice per a day to the same email address, and I would eventually monitor the number of send emails per hour too.
    – Xenos
    Commented Jun 20, 2018 at 8:12

The user may have failed to click the activation link in the first email for a reason. Maybe the email didn't reach him. Maybe it got stuck in a spam filter. Maybe it was accidentally deleted. If a user requests a new activation email, it is probably because they want a new activation email. So give them one.

However, you should not have two activation tokens active for the same email at the same time. Before sending the new email, deactivate all old activation tokens for that email.

Also, as Marcel points out, depending on your users privacy needs you may want to think about user enumeration attacks here.


There's a possibility that someone has tried to register using someone else's email address. In such case all the other information possibly including the username is incorrect.

I'd remove the former unactivated account during this process, or automatically if it hasn't been activated within reasonable time. If the database doesn't require unique email addresses, I'd remove former extra accounts at least when another account finally gets activated.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .