← NCB Email Verification

NCB Email Verification — Documentation

Stop fake and disposable email addresses. Visitors must prove they own their address before a form, registration or WooCommerce checkout goes through.

Description

The problem

Anyone can type any email address into your forms. Nothing stops them.

So your CRM fills up with asdf@asdf.com. Your WooCommerce store creates accounts nobody can log into. Order confirmations bounce, and support has to chase customers who mistyped their own address. Spam bots register hundreds of throwaway accounts from ten-minute-mail domains. Your mailing list quietly rots, your sender reputation drops, and your real emails start landing in spam.

Every one of those problems has the same root cause: nobody ever proved the address was real.

The solution

NCB Email Verification puts a gate in front of your forms. When a visitor types an email address, the submit button locks. They receive a message containing a one-click link and a 6-digit code. The moment they prove the address is theirs, the form unlocks — and not before.

The gate is enforced on the server, not just in the browser. Disable JavaScript, script the request, submit from Postman: it makes no difference. If the address has no valid verification on record, the submission is rejected.

What you get

  • Fewer fake registrations. An address nobody controls can never complete signup.
  • Cleaner WooCommerce orders. Confirmation emails reach a real inbox — every time.
  • Less spam. Bots do not open inboxes and click links.
  • No disposable addresses. Over 450 throwaway domains blocked out of the box.
  • Better data quality. Typos are caught before they enter your database ("did you mean gmail.com?").
  • A healthier mailing list. Every subscriber is a confirmed, reachable human.

Works with your existing forms

Free:

  • Forminator
  • Contact Form 7
  • Fluent Forms
  • WPForms
  • Elementor Forms
  • Ninja Forms

Pro:

  • WooCommerce (registration, classic checkout, block checkout, My Account)
  • Gravity Forms
  • JetFormBuilder

Enable them one by one — each adapter only runs when its plugin is active.

Free vs Pro

Everything you need to stop fake and disposable addresses on your contact forms is free, with no usage limits and no verification quota:

  • Real server-side gate on six form builders
  • Verification link and 6-digit code
  • DNS / MX checks, 450+ disposable domains, typo suggestions
  • Rate limiting, logs, statistics dashboard, CSV export
  • Trust score on every address
  • The full SMTP Diagnostic Centre

Pro adds the things a store or an agency needs:

  • WooCommerce, Gravity Forms and JetFormBuilder
  • Verify once forever, or re-verify after 30/90/180/365 days
  • Reject addresses below a trust score you choose
  • White label: brand name, colours, custom success and failure pages
  • REST API
  • Excel (.xlsx) and PDF export
  • Country and device metadata

Verification modes

  • Every submission — the strictest option.
  • Once, forever — verify a customer once and never ask again.
  • Re-verify after 30 / 90 / 180 / 365 days — a middle ground for returning customers.

Trust Score

Every address gets a 0–100 quality score before an email is even sent, based on signals your own server can check: does the domain resolve, does it have MX records, is there an SPF record, is there a DMARC policy, is it disposable, is it a role-based mailbox, has it failed here before. Set a minimum score and low-quality addresses are rejected immediately. No external service is called and no visitor data leaves your site.

SMTP Diagnostic Centre

Verification is worthless if your emails do not arrive. The built-in diagnostic sends a real message, captures the entire SMTP conversation, and tells you in plain language what went wrong: connection refused, authentication rejected, SSL/TLS handshake failed, DNS not resolving, sender not authorised, or rate limited. A clear ✔ SMTP Working or ✖ SMTP Failed verdict, with the fix.

Statistics, export and REST API

  • Dashboard with daily / weekly / monthly graphs: sent, verified, failed, expired, blocked, disposable, invalid domains, average trust score, average time to verify.
  • Export the log to CSV, Excel (.xlsx) or PDF, filtered by date range, email, domain, event or integration.
  • A full REST API (ncbev/v1) for creating, confirming, checking, revoking and consuming verifications — protected by an API key and disabled by default.

White label

Brand name, logo, colours, button colour, sender name and address, subject line, email footer, and the success and failure pages are all yours. Or redirect to your own page entirely.

Privacy first

IP addresses are anonymized by default and can be switched off completely. Country and device data come from your own server, never a third-party API. Logs are purged automatically on a schedule you set. Uninstall removes everything — but only if you tell it to.

Installation

  1. Install and activate the plugin.
  2. Go to Email Verification → Integrations and switch on the form plugins you use.
  3. Run Email Verification → SMTP Diagnostics to confirm your site can actually send mail.
  4. Pick a verification mode under Settings and adjust the branding.

Frequently Asked Questions

Can someone bypass this by disabling JavaScript?

No. Locking the submit button is only the visible part. Every submission is independently re-checked on the server against the database. Without a valid verification record, the submission is rejected regardless of what the browser did.

Does it work with page caching?

Yes. Verification state is stored in the database and keyed to a hash of the email address — not to a cookie or session — so full-page caches and object caches cannot break it. The 6-digit code path works even on a fully cached page with a stale nonce.

What if the visitor opens the email on their phone?

Either they click the link (the form still open on their computer polls and unlocks within seconds) or they type the 6-digit code into the form. Both paths work across devices.

Will my logged-in WooCommerce customers have to verify at every checkout?

No. A logged-in customer using their own account email is trusted automatically. You can change that with the ncbevtrustloggedinemail filter.

Does it call any external API?

No. DNS checks, trust scoring, geolocation and device detection all run on your own server. Nothing about your visitors is sent anywhere.

Will it work with my SMTP plugin?

Yes. Mail is sent through wp_mail(), so WP Mail SMTP, FluentSMTP, Post SMTP and others are used automatically. The diagnostic screen detects which one you have.

Is the free version limited in how many emails it can verify?

No. There is no quota and no cap. A verification gate that stops working after N submissions would either break your forms or let unverified addresses through — neither is acceptable in a security plugin. The free version is limited by which form builders it supports, never by usage.

Can I add a form plugin that is not on the list?

Yes. Register an adapter through the ncbev_integrations filter — a working example is in docs/DOCUMENTATION.md.

Screenshots

  1. Dashboard with daily, weekly and monthly statistics.
  2. The verification widget inside a form.
  3. SMTP Diagnostic Centre.
  4. Verification modes and trust score settings.
  5. Logs with trust score, country and device, plus CSV/Excel/PDF export.

Changelog

3.0.9

  • Security: the paid integrations were checking the licence at boot, before Freemius had finished loading. The licence read as inactive, the WooCommerce adapter silently registered no hooks, and nothing was gated — while the admin screens, rendering later, correctly showed the licence as active. The plugin now boots after its dependencies have settled, and every paid gate re-checks the licence at the moment it runs rather than trusting boot-time state.

3.0.8

  • Improved: WooCommerce forms are now detected by their hidden nonce fields rather than by CSS class names, so the verification widget appears inside theme and page-builder account modals (Blocksy and others) that render their own markup.

3.0.7

  • Security: the registration guard exempted anything running under isadmin(), which is also true inside admin-ajax.php — the exact path front-end account modals use. AJAX registrations are now checked; only genuine admin screens, WP-CLI, cron and users with the createusers capability are exempt.

3.0.6

  • Security: registration is now gated at the WordPress core level, not only on WooCommerce's own hooks. Themes and page builders that register users through their own AJAX handlers (Blocksy's account modal, and others) previously bypassed the check entirely.
  • Security: added a final guard inside wpinsertuser(), so an account cannot be created with an unverified address even by a handler that skips every validation hook.
  • Improved: the verification widget now attaches to theme account modals as well as WooCommerce's own templates.

3.0.5

  • Fixed: a successful SMTP diagnostic could report a bogus SSL/TLS failure, because the failure patterns were matched against a healthy SMTP transcript (which naturally mentions STARTTLS). Failure analysis now runs only when the send actually failed.

3.0.4

  • Fixed: SMTP Diagnostics reported "handed to the mail server without a reported error" even when the send had clearly failed.
  • Fixed: the diagnostic now reports the sender address actually used, instead of the one from the settings — the two differ precisely when the sender is what's broken.
  • New: recognises an invalid sender address (the wordpress@localhost problem on local and staging sites) and a disabled PHP mail(), and explains both.

3.0.3

  • Renamed the Freemius accessor to ncbev_fs() so every global the plugin declares carries the plugin's own prefix.

3.0.2

  • Fixed: moved the uninstall routine off uninstall.php and onto Freemius' after_uninstall hook, so deleting the plugin correctly releases the licence.

3.0.1

  • Added the WordPress.org gatekeeper key required by Freemius to generate the free build.

3.0.0

  • New: free and Pro editions. The free plugin is fully functional on six form builders with no limits or quotas.
  • New: Pro adds WooCommerce, Gravity Forms, JetFormBuilder, verification modes, trust-score blocking, white label, REST API and Excel/PDF export.
  • New: Freemius integration for licensing, updates and a 14-day trial with no card required.
  • Improved: a lapsed licence can no longer leave a paid feature quietly enforcing — every paid setting is re-checked on read.

2.0.6

  • Scoped two PHPCS re-enable directives that were unintentionally lifting the documented exclusions for the plugin's own custom tables. Plugin Check now reports zero errors and zero warnings.

2.0.5

  • Moved DOCUMENTATION.md to the docs/ folder so the plugin root contains only the files WordPress expects. Plugin Check now reports zero issues.

2.0.4

  • Restored the documented WPCS exclusions for direct queries against the plugin's own custom tables, which core caching APIs do not cover.

2.0.3

  • Security hardening: every database query now uses $wpdb->prepare() with the %i identifier placeholder for table names — no SQL string is built by concatenation anywhere in the plugin.
  • Rewrote the log search, export and verification-mode queries as fully static prepared statements with bound, self-short-circuiting filters.
  • Removed all blanket PHPCS suppressions. The warnings are fixed at the source rather than silenced.

2.0.2

  • Fixed: removed the "Tested up to" plugin header so it can no longer contradict readme.txt.
  • Fixed: PHPCS suppressions for the plugin's own custom tables are now written as line annotations, so tooling reads them correctly.
  • Fixed: Gravity Forms adapter now unslashes input before sanitizing it.

2.0.1

  • Fixed: Plugin Check compliance — translator comments for placeholder strings, no direct filesystem calls in the exporter (CSV is now built in memory, XLSX is read through WP_Filesystem), "Tested up to" updated.
  • Improved: translations now load just-in-time via the Domain Path header instead of the discouraged loadplugintextdomain().
  • Improved: documented and scoped the PHPCS suppressions for the plugin's own custom tables — every request-supplied value still goes through $wpdb->prepare().

2.0.0

  • New: WooCommerce integration — registration, classic checkout, block checkout, My Account, optional login gate.
  • New: adapters for Contact Form 7, Gravity Forms, Fluent Forms, WPForms, Elementor Forms, Ninja Forms and JetFormBuilder.
  • New: verification modes — every submission, once forever, or re-verify after 30/90/180/365 days.
  • New: Email Trust Score (0–100) from MX, SPF, DMARC, disposable, role-based and local-history signals, with an optional minimum threshold.
  • New: SMTP Diagnostic Centre with plain-language failure analysis.
  • New: geolocation and device metadata (country, browser, OS, device type) computed locally.
  • New: REST API (ncbev/v1) with API-key authentication, disabled by default.
  • New: export to CSV, Excel (.xlsx) and PDF, with date/email/domain/event/integration filters.
  • New: white label — brand name, button colour, success and failure pages, optional redirect.
  • New: dashboard statistics with daily, weekly and monthly graphs.
  • Improved: frontend widget attaches to every supported builder, not just Forminator.

1.0.0

  • Initial release with Forminator support, verification link and 6-digit code, DNS/MX and disposable checks, rate limiting, logging and admin dashboard.

Upgrade Notice

3.0.0

Introduces the free and Pro editions. Existing installs keep every free feature; paid features require a licence.

2.0.6

Housekeeping only. No behaviour changes.

2.0.5

Housekeeping only. No behaviour changes.

2.0.4

Tooling compliance only. No behaviour changes.

2.0.3

Hardens every database query with prepared statements. Recommended for all users.

2.0.2

Plugin Check compliance fixes. No behaviour changes.

2.0.1

Plugin Check compliance fixes. No behaviour changes.

2.0.0

Major release: WooCommerce plus eight more form builders, trust scoring, SMTP diagnostics, REST API and multi-format export. Database tables are upgraded automatically on activation.