Another request for bypassing email verification

Hi jmock,

Thanks for your feedback.

(If you don’t verify email ownership you can face serious security issues.)

But I have another question in mind. How people get to generate a password in order to log into your installation?

In other words can you please describe the registration process for a new subscriber on your actual installation.

Hi rafasashi,

Our situation is a little unique… right now we have a site that is running on a multisite installation (we used to have a handful of sites but have pared it down to just one over the last few years). We currently have over 560,000 registered users on the site and with all of the WooCommerce order data, etc., our database is pretty gigantic (5+GB).

My plan is to split the sections of the site that actually need WordPress out into separate installs and use static pages for the rest of it, so we’d have 3 WP installs with smaller and more manageable databases–one under /store, one under /blog, and one under /plus and want users to be able to log into one and be logged into all 3.

As far as user registration goes, the process would be pretty standard. Right now we’re using the WP registration process with some custom tweaks, and on the new setup we’d do the same but any new user registrations or purchases (many of our user regs happen during the purchase process) through the “main” installation on /store and then sync those users with another plugin to the other two sites.

I’m far less concerned about verifying new users than I am about all of the existing users once I split them out of the existing multisite db and import them. They’ve already registered and verified their accounts so I’d love for a way to have them automatically verified upon import rather than have to manually go in there and verify everyone.

Hopefully that all makes sense ??

– Jim

Thanks for the reply.

Your plan sounds good. Its a nice implementation of the plugin.

The good new is that if you use the Core WP process for new subscriptions then you don’t have to do anything else. It is already included together with the core password generation email.

As for the current 500K users the plugin also provides a bulk validation tool in

User Synch… > User Verify

Once it is valide on one side then you don’t have to do anything else.

I have never tried it on a big DB such as yours so I don’t know if it will work properly.

Are you able to run a test on a backup DB?

Great to hear that the registration process will take care of it, however I just thought of once instance where we don’t send users an activation email, and that’s when they sign up for a subscription product. They go through the same registration process if they don’t already have an account, but we automatically activate them to make the process a little easier for them and so they can start using the product right away. Any suggestions on how to handle these?

I was also concerned about the bulk verification not working properly on a database our size. I have a local dev environment set up with the plugin working and will definitely try it there first. I’ll keep you posted. If it fails, is there an SQL query I can run from the mysql command line to bulk verify?

Thanks!

If it fails I can perhaps assist you either via mysql or improving the bulk script I don’t know yet.

About the auto validated subscribers again this plugin cannot bypass the process. If someone uses the email of another registered user somewhere in one of your installations they could take over someone else session. Another scenario would be people using the same fake email to subscribe which would grant them all the same access everywhere on your platform. And this just some example of what could possibly happen without verification.

Your paid subscribers how do they login after purchase if they dont have a password?

The users on one site wouldn’t be able to register with the same email from one of the others… all registrations would happen through the main site (with registration disabled on the other two) and users will be synced to the other sites with WPMUDev’s user sync plugin.

Paid subscribers create a password during the purchase and registration process rather than having one auto-generated for them so they’re able to log in with that password after we auto-activate them.

You have it. It is exactly the way this plugin behave.