I'm trying to think of ways to, as securely as possible, verify that a user owns a website that they claim to own.
Here are some ways I've seen:
- Upload an obscurely-named HTML file to the root directory with given contents
- Include a meta tag or other comment somewhere in the home page source
- Send an email to an address
@domainwearetryingtovalidate.tld
with a verification link - Check a CNAME or TXT record
- Check WHOIS records
- Physically validate by calling or emailing the support line, manually updating records
And here are the problems with those methods, in order:
- Some website configurations may not allow for simply uploading a file to the root
- Poor site design might allow a user of that site to add this meta tag themselves
- Websites which provide email services make this useless; take
gmail.com
for example - That's too complex for most small website owners to figure out how to do
- Those are public; anyone can claim to be whoever. Not to mention most often inaccurate.
- Huuuuge waste of time
Are there any other ways to verify that a user on your site owns a particular website? Of the methods I listed, which of these are best and worst? I ordered them from best to worst in my own opinion, but I'd like to see what others think as well.
I plan on implementing one or more of these in PHP.