Group
  • Security

    Verify email ownership before activating accounts

    Adds verification emails with expiring tokens and limits what unverified accounts can do.

    • Improve quality
    • Plan & validate
    • Beginner
    • General

Free Prompt

Review my signup flow and make sure accounts verify ownership of their email address before getting full access. Implement or fix: a verification email sent at signup containing a link with a single-use token that expires (24 hours is reasonable); accounts marked unverified until the link is clicked; unverified accounts blocked from anything that matters (posting content, making purchases, triggering emails to other users) but able to resend the verification email; and the resend endpoint rate limited so it can't be used to spam someone. When a user changes their email later, require verification of the new address before it takes effect. Use the email sending code already in the project. Do not block login entirely for unverified accounts unless the app genuinely requires it; degrading capabilities is friendlier and just as safe for most apps. Do not show whether an email is already registered on the signup or resend forms. Show me the flow changes. Give me a verification walkthrough: sign up with a test address, confirm the account is limited, click the link, confirm full access, and confirm the same link fails on a second use.

What This Does / How This Helps

Makes sure every account proves it owns its email address before it can do anything that matters, with expiring single-use links and a rate-limited resend. Without verification, anyone can sign up as someone else, and your app will happily email the victim receipts, notifications, and password resets for an account they never created. It's also how apps fill up with disposable spam accounts on day one. The prompt keeps it friendly: unverified users can look around but can't post, purchase, or spam others, and the walkthrough proves the whole loop including link reuse failing.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts