I am launching a new site soon and in my previous experience I know many bots will create accounts, I'm trying to avoid this so before a user can sign in they need to verify their email address. If they email address doesn't get verified within X amount of time should I automatically remove the account? What's best practice in this area?

  • 1
    What can a user with an unverified account do on your site? Usually users can't do much of anything until they have created and verified an account. That leaves little difference between an unverified account and a deleted account. – Stephen Ostermiller Jun 23 at 11:18
  • I voted to close as opinion based. The answer really depends on why people are signing up, where you are - which influences data retention laws etc. My opinion is get rid of the data. – davidgo Jun 23 at 19:15
  • 1
    @davidgo I think there's some value in the above question, though. For one thing, it's not something people inquire about every day, so existing resources may be limited. For another, it touches on best practices for account creation flow. There may be more than one answer that makes sense, but the OP's considerations are a very real topic for marketers and web managers. – Henry Visotski Jun 23 at 19:59
  • I doubt there is "best practice" - you can make your own. "This link will be valid for x days after which the account will be deleted if not verified" – Steve Jun 23 at 22:00

To add to Stephen's comment, it's unlikely that absolutely nothing goes into any database at the point of unverified account creation. Therefore, the question is what you want to do with the information you do have. Leaving the inactive info in there indefinitely will not do any immediate harm, but it will create noise in your data and add unnecessary weight to your tables.

If the user's email and whatever other information is saved somewhere, but the user doesn't take the final step to verify, you may want to send a reminder email the next day. You may want to follow up in a week or so with a second reminder, as people get busy, forget, or procrastinate.

If they don't verify after a couple of weeks, I'd delete the info to keep your data tables clean. You can play with the timeframes in which you do all this, but that's the general approach I'd recommend.

  • Many thanks for clarifying what I was thinking. I'll go down the step of a follow up email a day and one a week later and if no response remove the account. Thanks – JTheBiker Jun 24 at 16:23
  • @JTheBiker You're welcome - glad it was helpful! – Henry Visotski Jun 24 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.