Active installs
400+
Subscription includes
Support
From OTP verification to 2FA, disposable email blocking to DNS validation — the complete email security toolkit for WooCommerce.
Send a one-time password to the customer’s email at every critical touchpoint — signup, checkout, login from new device, or after inactivity. Real emails verified; bots and fakes blocked at the door.
Replace WooCommerce’s default login and registration form with a fully-branded Smart Form. Pick from four ready-made layouts, let customers register with email or phone, and offer password or OTP-based login. Place it on My Account or any page via shortcode.
Verify customers via SMS OTP as an alternative to email verification. Customers can register and verify with their phone number using MSG91, Twilio, Vonage, or WhatsApp as the SMS gateway.
Add Google Authenticator, Authy, or Microsoft Authenticator as a second layer of security for customer logins. Block credential-stuffing attacks even when passwords are compromised in data breaches.
Enforce verification rules per user role. Require 2FA only for administrators and shop managers. Skip verification for trusted VIP customers. Tailor security to your store’s operational structure.
Prevent free product and coupon abusers by delaying customer activation until their first paid order is completed. Accounts created via $0 or zero-total checkout orders will remain in “pending paid order” status and won’t have customer access until a genuine payment is confirmed.
Know exactly how CEV PRO is protecting your store. The new Analytics tab shows signups, verification rate, blocked spam totals, average time-to-verify, top blocked disposable domains, and a signup-to-verify funnel chart.
Block signups from temporary email providers (Mailinator, GuerrillaMail, 10MinuteMail, and 3,000+ more). Bundled blocklist updates regularly. Add your own custom-blocked domains and customize the rejection message.
Before sending an OTP, CEV PRO validates that the email domain actually has working mail servers (MX records). Catches typos, fake domains, and non-existent providers — saves you SMS costs and reduces bounces.
Run a B2B store or restricted-access community? Allow only specific domains to register (e.g., partner.com, customer.org). Or block specific email addresses that have abused your store before.
Daily cron jobs automatically remove stale unverified records and auto-delete unverified WP user accounts — with safeguards. Never pay for storage or send emails to unreal customers again.
Take control during security incidents or system updates. Instantly flip all verified customer accounts back to unverified status in bulk. Upon their next login, customers will be prompted to verify their access via email or SMS OTP. Safe background batching protects your server from timeout errors.
Don’t lose lapsed signups. Automatically email unverified users at 1-hour, 24-hour, 3-day, and 7-day intervals with a one-click verification link. Fully customizable via the email customizer.
Match your brand identity. Customize the verification popup layout, colors, text, and branding so verification feels native — not bolted on.
Scores every signup, catches brand-new throwaway domains before blacklists update, and halts coordinated bot clusters before they touch your store database.
One number, built from four signals, with you deciding what happens at each level.
A blocklist can only answer yes or no. Risk scoring gives every registration and guest checkout a score from 0 to 100, built from several weak signals that are only alarming together — a random-looking mailbox, an unfamiliar domain, a plus-address pattern, a run of signups from one IP address. You choose what happens in each band: let it through, ask for a one-time code, or block it outright. Low, Balanced, and Strict move the cutoffs without you having to think in numbers.
New throwaway services appear faster than blocklists can be updated.
The built-in list covers 430 known disposable providers. The new pattern matcher goes further: it reads the shape of a domain instead of looking it up, so a temp-mail service registered this morning is rejected the first time someone tries it on your store. Mainstream mailbox providers are never touched, and your own excluded domains always win — so a false positive is one line to fix, not a support ticket.
Some attacks only look wrong when you see them together.
One registration from a bot run looks unremarkable. Twenty of them inside ten minutes do not. Cluster detection watches for the shapes a coordinated attack makes — many addresses from one network sharing a browser fingerprint, sequential addresses on one domain, a sudden flood on a single domain — and blocks further signups once a burst crosses your threshold. It’s the layer that catches what per-signup rules are designed to let through.
For stores that would rather not decide which logins look risky.
Login Authentication normally challenges only unfamiliar sign-ins. Switch this on and every customer gets a one-time code at every login — useful straight after a spam attack, or on a wholesale store where protecting account access matters more than streamlining it. Administrators, editors, and shop managers are never prompted, so you can’t lock yourself out of your own store.
Built for store owners who take security, deliverability, and clean data seriously.
Bot signups blocked at the door.
3,000+ temporary email providers rejected automatically.
Authenticator app protection for sensitive accounts.
Enforce 2FA per user role, not site-wide.
Reject fake domains before sending OTPs.
Daily cron removes stale unverified accounts.
Recover lapsed signups with reminder emails.
See exactly what spam you’re blocking.
Only approved domains can register.
Verified addresses = lower bounces.
Built for modern WooCommerce.
Regular updates and dedicated support.
Email verification ensures that only genuine users can register, place orders, and access accounts, reducing fraud, spam, and fake orders while improving store security and customer trust.
If a user does not complete the verification, their account remains uncreated, and they cannot log in or place orders.
Yes, the plugin requires guest users to verify their email before completing checkout, ensuring only legitimate customers place orders.
Yes, you can choose to require email verification specifically for free orders, preventing users from exploiting free product promotions with fake email addresses.
Yes. If a user logs in from a new device, browser, or after a period of inactivity, they must verify their email using an OTP.
Yes. Customers receive an email notification whenever they log in, including details like device and location, so they can take action if the login is unauthorized.
Yes, you can fully customize the email content, branding, and styling to match your store’s identity.
Yes, the popup’s layout, colors, and text are customizable to ensure a seamless user experience.
No, the plugin is user-friendly and easy to set up without any coding knowledge.
Yes, regular updates ensure compatibility with the latest WooCommerce versions and security improvements.
Categories
Extension information
Compatibility
Countries
