PHP Email Activation: Verify Addresses with Expiring Tokens

Email activation can confirm that a person can receive mail at an address, but it does not prove a legal identity. Treat the activation link as a temporary credential and make the verification state explicit in the account model.

Create a time-limited token

Generate an unpredictable token using a cryptographically secure source. Store a verifier rather than a reusable plaintext token, associate it with the pending account and set a clear expiry. Send the link only to the submitted address and use HTTPS for the activation page.

Keep tokens out of application logs, analytics and external resources loaded by the activation page. Invalidate the record after successful use. Reissuing a link should replace or revoke the previous token, not create an unlimited set of active links.

Control registration and resend behavior

Rate-limit registration and resend requests to reduce abuse. Use responses that do not disclose more account information than necessary. If the address belongs to an existing account, direct the user through the established sign-in or recovery flow without exposing private profile data.

Verify the state at every sensitive action

Do not rely only on a hidden form field saying “verified.” Enforce the account's verification state on the server before allowing actions that require a confirmed address. Protect the activation endpoint against token guessing and record only the audit details needed to investigate problems.

Test valid, expired, reused and malformed links, as well as resend and address-change flows. If the email changes later, require a new verification for the new address and preserve a recovery route for the account owner.