WordPress Email Verification Plugin:
Block Fake Signups at Every Form
Every address a visitor types into your site gets checked against the real mailbox before WordPress stores it. Disposable domains are blocked, typos are caught and corrected on the spot, and fake registrations never become accounts. One plugin covers all 32 integrations, from WooCommerce checkout to Contact Form 7, WPForms and Gravity Forms.
An illustration of the plugin running on a WordPress registration form. It cycles through three outcomes: a mistyped address that gets a correction offered, a disposable address that is rejected, and a real mailbox that is accepted.
How the WordPress Email Verification Plugin Works
The plugin runs inside the validation pass your forms already perform. There is nothing to rebuild and no template to edit.
A visitor submits a form
Verification happens inside the validation your form already runs, whether that is a WooCommerce checkout, a Contact Form 7 submission or the stock WordPress registration screen.
The address is checked, not guessed
Syntax, MX records, disposable domain lists and your own allowlist and blocklist are evaluated on your own server first. Only what is left goes out for a live mailbox check.
The visitor gets an answer inline
A bad address fails the field with a message they can act on. A likely typo gets a one-click correction. Nothing is written until the address resolves.
Only real addresses get stored
The clean address lands in the account, the order or the list. The result is cached, so checking that same address again costs nothing.
Email Validation for Contact Form 7, WPForms and Gravity Forms
One plugin, 32 integrations. Turn on the ones you use and leave the rest off. Each integration is a toggle in settings, not a separate add-on to buy.
Contact & Form Builders
13 supportedVerification runs inside the builder’s own validation pass, so an invalid address fails the field instead of the submission.
- Contact Form 7
- WPForms
- Gravity Forms
- Ninja Forms
- Formidable Forms
- Fluent Forms
- Forminator
- WS Form
- Elementor Pro Forms
- Jetpack Forms
- Everest Forms
- Caldera Forms
- HappyForms
WooCommerce
3 supportedGuards the three places a customer can hand you an address: the checkout billing field, account creation, and the My Account email change.
- WooCommerce Checkout
- WooCommerce Registration
- WooCommerce My Account
Registration, Membership & Comments
9 supportedStops throwaway accounts at the point of signup rather than cleaning them out of your user list months later.
- WordPress Registration
- WordPress Comments
- Ultimate Member
- BuddyPress
- Profile Builder
- WP-Members
- Theme My Login
- User Registration
- MemberPress
Newsletter & List Building
3 supportedKeeps bad addresses out of the list before they are ever synced to your sending platform.
- MailPoet
- MC4WP
- Newsletter
LMS, Downloads & Donations
4 supportedCourse access, download receipts and donation confirmations all fail silently against a bad address. These integrations catch it first.
- Easy Digital Downloads
- LearnDash
- LifterLMS
- GiveWP
Running something that is not on the list?
The plugin ships an is_email() override. WordPress routes almost every address through that function, so switching the override on applies verification to forms the plugin has no dedicated integration for, including custom themes and in-house plugins.
coverage
Where Email Verification Runs on a WordPress Site
Bad addresses do not arrive through one door. These are the places a WordPress site collects them, and the plugin watches all of them at once.
User registration
Throwaway accounts get rejected at signup instead of being cleaned out of your user table months later. Works on the stock WordPress form and on Ultimate Member, Profile Builder, WP-Members, Theme My Login and MemberPress.
WooCommerce checkout
A mistyped billing address means the order confirmation, the shipping notice and the receipt all bounce. Verification runs on checkout, on account creation and on the My Account email change.
Comment forms
Comment spam almost always carries a fake or disposable address. Verifying the field turns a large share of automated comment traffic away before it reaches moderation.
Contact and lead forms
A lead you cannot reply to is not a lead. Catching the typo while the visitor is still on the page is the only chance you get to fix it.
Courses, downloads and donations
LearnDash enrolments, LifterLMS access mails, Easy Digital Downloads receipts and GiveWP donation confirmations all depend on an address that actually resolves.
Newsletter opt-ins
MailPoet, MC4WP and Newsletter subscribers are verified before the record is written, so bad addresses never sync to your sending platform and never count against your plan.
Every Check That Runs Before an Address Is Accepted
A format check tells you an address is shaped correctly. It cannot tell you anybody is behind it. These are the checks that answer the second question.
Syntax and format
Proper parsing rather than a loose pattern match. Catches malformed local parts, invalid domains and the characters that quietly break systems further down the line.
MX records
Confirms the domain actually publishes mail servers. A domain with no MX record cannot receive anything you send it, no matter how well formed the address looks.
Disposable and temporary domains
Mailinator, temp-mail, burner services and the thousands of rotating domains that sit behind them. Blocked before the submission is accepted.
Live mailbox check
An SMTP conversation with the receiving server establishes whether that specific mailbox exists, not merely whether the domain does. This is the check that separates real from plausible.
Typo detection
gmial.com, hotmial.com, yaho.com. The plugin offers the correction instead of silently rejecting a real person who fat-fingered one key.
Catch-all detection
Flags domains that accept mail to any address, so you can decide whether they count as verified. Allowed by default and configurable per rejection rule.
Role accounts
info@, admin@, sales@, postmaster@. Worth flagging on a newsletter form, usually fine on a contact form. You decide which.
Your allowlist and blocklist
Exact addresses or whole domains, evaluated on your own server before anything leaves it. These rules never touch the API and never cost a credit.
MX enrichment
Returns the mail provider, ISP and geolocation behind the domain and stores it alongside the verdict, so the activity log tells you who you are actually collecting.
Built for Site Owners, Not Only Developers
Everything is configured from the WordPress admin. There is no code to write, no snippet to paste into functions.php and no separate dashboard to learn.
Analytics dashboard
Verification volume, pass and fail rates and trend charts over time, so you can see exactly what the plugin is turning away.
Activity log with CSV export
Every check with its verdict and MX detail, filterable in the admin and exportable when you need it outside WordPress.
Smart result caching
Configurable time to live. A repeat address returns its cached verdict instantly and costs zero credits, which matters on high-traffic forms.
Bulk scan of existing users
Point the scanner at the accounts you already have and find the dead addresses that have been sitting in your database since before the plugin was installed.
Quick Verify tool
Check any single address from the WordPress admin without leaving the site or opening a second tab.
Allowlist and blocklist manager
Maintain exact addresses or entire domains in the admin. Both lists are applied locally, before any request is made.
Configurable rejection rules
Choose per result type whether to block the submission, warn the visitor or let it through. Catch-all addresses are allowed by default.
Multisite network support
Network activate once and share a single API key across every site on the network, with per-site overrides where a site needs different rules.
Free Without an API Key. Complete With One.
The plugin is free and stays free. Some checks can be answered on your own server and some have to ask the receiving mail server. Here is exactly where the line falls.
Working the moment you activate it
These checks run entirely inside your own WordPress install. Nothing leaves your server and nothing costs anything.
- Email syntax and format validation
- Your allowlist and blocklist, exact addresses or whole domains
- Cached results from every address checked before
- All 32 integrations and the
is_email()override - Rejection rules, activity log, CSV export and multisite support
Free plugin, GPLv2 licensed. No account needed to install it.
Adds the live mailbox check
The checks that have to talk to the receiving mail server. This is the difference between an address that looks real and one that is.
- Real-time SMTP mailbox verification
- Disposable and temporary domain detection
- Catch-all and role account detection
- Typo detection with a correction offered to the visitor
- MX enrichment with mail provider, ISP and geolocation
- Bulk scan of the WordPress users you already have
No credit card required. Credits never expire. One credit per unique address, and a cached result costs nothing.
Installing the Plugin
Five steps, and only the last one is optional. Most sites are protected inside two minutes.
-
Install the plugin
Search for Bulk Email Checker under Plugins › Add New, or upload the plugin folder to
/wp-content/plugins/yourself. -
Activate it
Activate through the WordPress Plugins menu. On a network, network activate it once to cover every site.
-
Enable the integrations you use
Every integration is a toggle. Turn on WooCommerce, your form builder and your registration flow, and leave the rest off.
-
Configure your rejection rules
Decide what happens to each result type: block the submission, warn the visitor or allow it through. Catch-all addresses are allowed by default.
-
Add an API key when you want the live check
Optional. Paste a key from your account into settings to switch on real-time mailbox verification, disposable detection and the bulk user scan.
- Version
- 1.0.1
- Requires WordPress
- 6.5 or higher
- Requires PHP
- 7.4 or higher
- License
- GPLv2 or later
- Integrations
- 32
- Price
- Free
Privacy, GDPR and What Leaves Your Server
Verification means an address is checked somewhere. It is reasonable to want to know exactly where, and what is kept afterwards.
Privacy mode
Switch it on and the plugin stores SHA-256 hashes in place of plaintext addresses, so the log stays useful without holding the addresses themselves.
Local checks stay local
Syntax validation, your allowlist, your blocklist and every cached result are resolved inside your own install. Those addresses never leave your server.
GDPR ready
Privacy mode, a configurable retention window on the activity log and CSV export together cover the access and erasure requests you are obliged to answer.
Your log, your call
The activity log lives in your database, not ours. Export it, prune it or turn it off. See the privacy policy for how the API handles a verification request.
WordPress Email Verification Plugin FAQ
The things people ask before they install it.
Do I need an API key to use the plugin?
Not for the checks that run on your own server. Email syntax validation, your allowlist and blocklist, and cached results all work without one. Real-time mailbox verification and the bulk user scan are the parts that need a key.
How many credits does a verification use?
One credit per unique address. A cached result uses zero, so a form that sees the same address twice only ever pays once. Credits never expire.
Will it slow down my forms?
A live verification typically takes one to three seconds. Syntax, list rules and cached results resolve immediately without leaving your server, so on a busy form most submissions never reach the network at all.
Does it work with WooCommerce?
Yes, on all three surfaces where a customer can hand you an address: the checkout billing field, account registration, and the email change on the My Account page.
What happens to catch-all domains?
A catch-all domain accepts mail to any address, so no verifier can confirm one specific mailbox behind it. The plugin flags them and allows them by default. If you would rather reject them, change the rule in settings.
My form plugin is not on the list. Can I still use it?
Yes. Enable the is_email() override. Nearly every address in WordPress passes through that function, so the override reaches forms with no dedicated integration, including custom themes and in-house plugins.
Is it GDPR compliant?
Privacy mode stores SHA-256 hashes rather than plaintext addresses, and the activity log stays in your own database where you can export or prune it. See the privacy policy for how a verification request itself is handled.
Does it work on multisite?
Network activate the plugin to share a single API key across every site on the network. Individual sites can override the settings where they need different rules.
Can I check the users I already have?
Yes. The bulk scan runs against your existing WordPress users and reports which addresses have gone dead since they registered. It needs an API key, since every address is a live check.
What does the plugin cost?
The plugin is free and GPLv2 licensed. Credits for live verification are pay as you go and never expire. Full detail on the pricing page.
The Same Engine, Everywhere Else You Collect Addresses
The plugin calls the same verification engine that runs behind the API and the bulk verifier. If your addresses arrive somewhere other than WordPress, these are the other ways in.
Real-Time Email Verification API
The same check the plugin makes, called directly from your own signup flow, checkout or CRM.
Explore the APIBulk Email Verification
Upload a CSV of the list you already have and get it back with the dead addresses removed.
Clean a listCredits and Pricing
Pay as you go, from $0.0001 per email. Credits are a one-time purchase and never expire.
See pricingVerify every address
before WordPress stores it.
Install the plugin free from WordPress.org, then add an API key when you want the live mailbox check. Both take about a minute.