內容簡介
ArgentWolf Email Verification 外掛提供本地自我託管的電子郵件驗證功能，專為新註冊的 WordPress 使用者設計。此外掛不依賴外部驗證 API，而是生成一次性驗證連結並透過 WordPress 的 wp_mail() 發送郵件，確保使用者帳號的安全性與驗證過程的私密性。
【主要功能】
• 本地驗證連結生成
• 自動驗證管理員創建的帳號
• 待驗證帳號無法登入
• 管理員可手動驗證帳號
• 可配置的自動清理過期帳號
• 支援開發者 API 與過濾器
外掛標籤
開發者團隊
② 後台搜尋「ArgentWolf Email Verification」→ 直接安裝（推薦）
原文外掛簡介
ArgentWolf Email Verification provides local, self-hosted email verification for newly registered WordPress users.
The plugin does not call an external email-verification API. It creates a one-time verification link locally and sends the message through WordPress wp_mail() and the site’s configured mail transport.
Core behavior:
Existing accounts are preserved as verified when the plugin is first activated.
Accounts created deliberately by a logged-in administrator or WP-CLI are automatically verified.
Other newly registered accounts are marked Pending.
Pending users cannot authenticate with a normal password or an Application Password.
WordPress’s normal new-user email is suppressed while an account is pending.
Users can request another verification message without disclosing whether an account exists.
Administrators can view verification status, resend verification, or verify an account manually.
Pending accounts can be removed automatically after a configurable retention period.
Administrators and pending users who own WordPress content are not removed by cleanup.
Ordinary wp_mail() messages to pending account addresses can be suppressed.
Mixed-recipient messages continue to verified users and outside addresses after pending addresses are removed.
Verification status is available to compatible plugins through a public API.
The plugin does not prove that a mailbox exists without sending a message, replace SMTP service, process bounces, or guarantee inbox delivery.
Settings
The settings page is under Settings > Email Verification.
Delete pending accounts after
Default: seven days. Enter zero to disable automatic deletion. Valid range: zero to 365 days.
Other outbound email
Enabled by default. Normal wp_mail() messages to pending account addresses are suppressed. This cannot intercept another plugin that bypasses wp_mail() and sends through its own transport or remote API.
Cleanup status
Displays the pending-account count and the next scheduled cleanup. Administrators can also run cleanup manually.
Privacy
The plugin stores verification status and limited verification-workflow metadata in WordPress user metadata.
Raw verification tokens are not stored. The plugin stores a keyed token hash, expiration time, message-request time, and limited registration-workflow state.
The plugin includes suggested privacy-policy text and WordPress personal-data exporter and eraser integration. Token and message metadata can be erased, but verification status is retained because removing it could alter account-access security.
Security
Verification tokens contain 256 bits of cryptographically secure randomness.
Only an HMAC-SHA256 token hash is stored.
Verification links expire after 48 hours by default.
Requesting a new link invalidates the previous link.
Public resend requests are throttled.
Public responses do not disclose whether an account exists.
Administrators are protected from accidental lockout.
Accounts without an explicit Pending marker are treated as verified to preserve established access during upgrades or temporary interruptions.
Developer API
Canonical filters and actions use the argentwolf_email_verification_ prefix. Selected legacy wrav_ev_* aliases remain for compatibility.
Important filters:
argentwolf_email_verification_link_lifetime
argentwolf_email_verification_resend_cooldown
argentwolf_email_verification_cleanup_batch_size
argentwolf_email_verification_auto_verify_new_user
argentwolf_email_verification_email_subject
argentwolf_email_verification_email_message
argentwolf_email_verification_after_verification_url
argentwolf_email_verification_should_delete_pending_user
Important actions:
argentwolf_email_verification_user_verified
argentwolf_email_verification_pending_user_deleted
argentwolf_email_verification_pending_user_cleanup_skipped
argentwolf_email_verification_mail_suppressed
argentwolf_email_verification_error
The error action receives a stable error code and a context array. It lets a logging or monitoring integration record operational failures without the plugin writing directly to the PHP error log.
