The module can deliver a clickable verification link or a code for the client to enter manually, while the verification form may be displayed directly on the page or in a modal window.
Configurable validity periods, reminders, account lifecycle actions, CAPTCHA protection, rate limiting and blocklist management give you greater control over client verification and help reduce fraudulent activity.

We will guide you step by step through the whole installation and configuration process.

The content of the package to upload should look like this.

The file is located in 'modules/addons/EmailVerificationAntiFraud/license_RENAME.php'. Rename it from 'license_RENAME.php' to 'license.php'.

Enter your license key between quotation marks, as shown on the following screen. You can find the license key in our client area under 'My Products'.

Go to 'System Settings' → 'Addon Modules'. Find 'Anti-Fraud & Email Verification' and press 'Activate'.

Press 'Configure', select the required administrator roles under 'Access Control', and press 'Save Changes'.

You can access the module under 'Addons' → 'Anti-Fraud & Email Verification'.

In this guide, we will walk you through every section and option of the module in detail.

It compares successfully 'Verified' records with 'Unverified' attempts, helping you quickly review recent activity and trends.

Five counters provide a quick overview:

• Pending - verification has been initiated but not yet completed.
• Verified - the email address has been successfully verified.
• Rejected - the verification attempt has been rejected.
• Expired - the verification link or code is no longer valid.
• Total - the total number of verification records.

Press 'Show' on a counter to filter the table by the selected status.

• Email - the email address used for verification.
• Mode - 'Checkout' or 'All Pages'.
• Status - 'Pending', 'Verified', 'Rejected' or 'Expired'.
• Created At - when the verification was initiated.
• Verified At - when the email address was verified; 'Never' is shown if verification has not been completed.
• Expires At - when the verification link or code expires.

Use the search field to find a record. The row actions allow you to mark it as unverified or delete it.

Important: This changes the verification status only. It does not undo any order or account action already taken while the address was considered verified.

The related WHMCS client account and order, if any, remain unaffected. This action cannot be undone.

Entries may be added manually or created automatically after the configured number of failed attempts is reached.

• Type - email address, IP address or email domain.
• Value - the blocked value.
• Source - 'Manual' or 'Automatic'.
• Reason - an optional internal explanation.
• Expires At - the expiration date; 'Never' indicates a permanent block.
• Created At - when the entry was created.

Press the eye icon to view the complete reason when it is shortened in the table. Use the trash bin icon to delete an entry.

• Type - select 'Email', 'IP Address' or 'Email Domain'.
• Value - enter a value matching the selected type.
• Reason (Optional) - enter an internal note explaining the entry.
• Expires At (Optional) - select an expiration date or leave the field empty to create a permanent block.

Press 'Confirm' to add the entry.

The options are divided into five panels. Press 'Submit' to save the configuration.

• Verification Mode - choose where verification is required:
  • All Pages - locks the entire client area until verification is completed.
  • Checkout - prevents an unverified client from placing an order.
• Verification Delivery - choose 'Clickable Link' or 'Code To Type In'.
• Verification Display - show the form as an 'Inline Form' or through a 'Modal Popup'.
• Checkout Token Validity (Days) - how long a link or code created in 'Checkout' mode remains valid.
• All Pages Token Validity (Days) - how long a link or code created in 'All Pages' mode remains valid.

• Checkout Reminder After (Days) - send a reminder this many days after an unverified checkout attempt. Enter 0 to disable it.
• All Pages Reminder After (Days) - send a reminder this many days after registration if still unverified. Enter 0 to disable it.
• Resend Cooldown (Minutes) - the minimum wait before another verification email can be requested.

• Checkout Auto-Inactivate After (Days) - set the account to 'Inactive' after this many unverified days following checkout. Enter 0 to disable it.
• All Pages Auto-Inactivate After (Days) - set the account to 'Inactive' after this many unverified days following registration. Enter 0 to disable it.
• Checkout Auto-Terminate After (Days) - permanently remove the client and all WHMCS data after this many unverified days following checkout. Enter 0 to disable it.
• All Pages Auto-Terminate After (Days) - permanently remove the client and all WHMCS data after this many unverified days following registration. Enter 0 to disable it.
• Auto-Delete Unverified Accounts - enable automatic cleanup of unverified accounts without active orders.
• Auto-Delete After (Days) - define the delay after Auto-Terminate before an eligible account is closed.
  
  

Important: Auto-Terminate actions are permanent and irreversible and may remove the client account together with all related WHMCS data. Review these settings carefully before enabling them in production.

• Rate Limit: Max Attempts - the maximum attempts allowed within the configured window.
• Rate Limit: Window (Minutes) - the rolling period used to count verification attempts.
• Auto-Ban After Failed Attempts - automatically block the related email address and IP address after this many failures. Enter 0 to disable it.
• Auto-Ban Window (Minutes) - the rolling period used to count failed attempts for automatic bans.

• CAPTCHA Enabled - require a CAPTCHA challenge on verification and resend forms.
• CAPTCHA Provider - choose:
  • Built-In (Arithmetic Challenge) - requires no external account.
  • reCAPTCHA V3 - requires a Google site key and secret key.
  • Cloudflare Turnstile - requires a Cloudflare site key and secret key.

When an external provider is selected, configure the corresponding 'Site Key' and 'Secret Key'. For reCAPTCHA V3, also set the 'Minimum Score' between 0 and 1; lower scores indicate traffic more likely to be automated.

The exact form depends on the selected delivery and display options. In the example below, a verification link has already been sent and the client can press 'Resend' if it did not arrive or expired.

• Clickable Link - open the link received by email.
• Code To Type In - enter the email address and code in the verification form.
• Inline Form - display the form directly on the page.
• Modal Popup - open the form in a modal window.

If CAPTCHA is enabled, the selected challenge is also shown. After successful verification, the client can continue to the restricted page or complete checkout.

For detailed guidance, check its dedicated article, available here.

Use a test account to check the selected delivery method, display mode, email and redirect behavior.

This gives legitimate clients additional time to complete verification and reduces the risk of unintended data loss.

These measures reduce repeated email requests while allowing legitimate clients to try again after a short wait.

Check automatically created entries and repeated failures before removing a block or changing the anti-fraud thresholds.

Follow every step carefully to prevent data loss or other unexpected issues.

Choose the Open Source version of Anti-Fraud & Email Verification For WHMCS to receive these benefits together with prioritized support services.

Press 'Get Source Code' or 'Upgrade To Lifetime' on the product page in our client area to complete the upgrade, with a dedicated discount already applied.
Follow the comprehensive guide for the complete transition process.

Check the module and WHMCS mail logs, verify the mail configuration and ask the client to check the spam folder. Wait until the 'Resend Cooldown' ends before trying again.

The verification details may have expired, already been used or may not match the pending record. Request a new message and use the newest link or code within its validity period.

The resend cooldown or rate limit may have been reached. Wait until the relevant window ends or review the limits under 'Settings'.

The client's email address, domain or IP address may be on the blocklist. Review 'Blocklist' and 'Logs', then remove the entry only after confirming the request is legitimate.

Confirm that the site and secret keys are correct and assigned to the WHMCS domain. For reCAPTCHA V3, also review the minimum score.