Anti-Fraud & Email Verification For WHMCS

About The Module

Anti-Fraud & Email Verification For WHMCS allows you to require email address verification during checkout or before a client can access the Client Area.
The module can deliver a clickable verification link or a code that the client enters manually, while the verification form may be displayed directly on the page or in a modal window.
Configurable token validity, reminders and account lifecycle actions help you handle clients who do not complete verification. CAPTCHA protection, rate limiting, automatic bans and a blocklist for email addresses, domains and IP addresses add another layer of protection against automated and fraudulent activity.

Installation And Configuration

Installation

1. Extract the module package into the main WHMCS directory. The files in the package will be uploaded to their corresponding WHMCS locations.

2. Log in to your WHMCS admin area and go to System Settings → Addon Modules. Find Anti-Fraud & Email Verification on the list and press Activate.

3. Configure access permissions and provide the module license key if requested. Save the addon configuration and open the module through Addons → Anti-Fraud & Email Verification.

Initial Configuration

Before enabling verification for production use, we recommend completing the following steps:

1. Select the required Verification Mode.
2. Choose how verification data will be delivered and displayed.
3. Set the appropriate validity periods and reminder rules.
4. Review all account lifecycle options carefully, especially those that may remove client data.
5. Configure rate limiting and automatic bans.
6. Enable and configure CAPTCHA protection if required.
7. Save the settings and test the complete verification process using a test client account.

Management

Dashboard

The Dashboard provides an overview of verification activity recorded during the last 30 days. The Verifications Over Time chart compares successfully Verified records with Unverified attempts, helping you quickly review recent activity and trends.

File:Anti-Fraud And Email Verification For WHMCS 1.png

Verifications

The Verifications section contains all email verification records created by the module. The summary tiles show the number of records with each status: Pending – the verification has been initiated but has not yet been completed. Verified – the email address has been successfully verified. Rejected – the verification attempt has been rejected. Expired – the verification link or code is no longer valid. Total – the total number of verification records. Press Show on a tile to filter the table by the selected status.

File:Anti-Fraud And Email Verification For WHMCS 2.png

The table includes the following information:

• Email – the email address used for verification.
• Mode – indicates whether the record was created in Checkout or All Pages mode.
• Status – the current verification status.
• Created At – the date and time when the verification was initiated.
• Verified At – the date and time when the verification was completed; Never is shown if it has not been completed.
• Expires At – the date and time when the link or code expires.

Use the search field to locate a record by its available data. The action icons allow you to mark a record as unverified or delete it.

Mark As Unverified

Press the Mark As Unverified icon next to a record to return it to the Pending status. Confirm the action in the modal window. Important: This action changes the verification status only. It does not undo any order or account operation already completed while the email address was considered verified.

File:Anti-Fraud And Email Verification For WHMCS 3.png

Delete Verification Record

Press the trash bin icon to permanently remove a verification record. Deleting the record does not affect the related WHMCS client account or order, if any. This action cannot be undone.

File:Anti-Fraud And Email Verification For WHMCS 4.png

Blocklist

The Blocklist allows you to prevent selected email addresses, IP addresses and complete email domains from using the verification process. Entries may be added manually by an administrator or created automatically after the configured number of failed attempts is reached.

File:Anti-Fraud And Email Verification For WHMCS 5.png

The table contains:

• Type – email address, IP address or email domain.
• Value – the blocked value.
• Source – Manual or Automatic.
• Reason – an optional internal explanation for the entry.
• Expires At – the expiration date; Never indicates a permanent entry.
• Created At – the date and time when the entry was created.

If a reason is too long to fit in the table, use the eye icon to view its complete content. Press the trash bin icon to delete an entry from the blocklist.

Add Blocked Entry

Press Add Blocked Entry and configure the following options: Type – choose what should be blocked: Email – a specific email address. IP Address – a specific IP address. Email Domain – every email address belonging to the specified domain. Value – enter a value matching the selected type. Reason (Optional) – add an internal note explaining why the entry was created. Expires At (Optional) – select when the entry should expire; leave the field empty to create a permanent block. Press Confirm to add the entry.

File:Anti-Fraud And Email Verification For WHMCS 6.png

Settings

The Settings section controls the verification workflow, reminders, lifecycle automation and anti-fraud protection. Configure the options described below and press Submit to save the changes.

File:Anti-Fraud And Email Verification For WHMCS 7.png

Verification Mode

• Verification Mode – choose where email verification is required:
  • All Pages – prevents an unverified client from accessing the Client Area until verification is completed.
  • Checkout – prevents an unverified client from placing an order.
• Verification Delivery – choose what the client receives by email:
  • Clickable Link – the client completes verification by opening the link included in the email.
  • Code to Type In – the client enters the code received by email into the verification form.
• Verification Display – choose how the verification form is presented:
  • Inline Form – displays the form directly on the page.
  • Modal Popup – displays a button that opens the form in a modal window.
• Checkout Token Validity (Days) – define how many days a verification link or code generated in Checkout mode remains valid.
• All Pages Token Validity (Days) – define how many days a verification link or code generated in All Pages mode remains valid.

Reminders

• Checkout Reminder After (Days) – send a reminder this many days after an unverified checkout attempt; enter 0 to disable reminders.
• All Pages Reminder After (Days) – send a reminder this many days after registration if the client remains unverified; enter 0 to disable reminders.
• Resend Cooldown (Minutes) – define the minimum time a client must wait before requesting another verification email.

Account Lifecycle

The account lifecycle settings automate actions against client accounts that remain unverified.
Values for Checkout and All Pages modes can be configured separately.

• Checkout Auto-Inactivate After (Days) – set the client account to Inactive after this many unverified days following a checkout attempt; enter 0 to disable the action.
• All Pages Auto-Inactivate After (Days) – set the client account to Inactive after this many unverified days following registration; enter 0 to disable the action.
• Checkout Auto-Terminate After (Days) – define when the client account and all of its WHMCS data should be permanently removed after an unverified checkout attempt; enter 0 to disable the action.
• All Pages Auto-Terminate After (Days) – define when the client account and all of its WHMCS data should be permanently removed after registration without verification; enter 0 to disable the action.
• Auto-Delete Unverified Accounts – enable additional automatic cleanup for unverified accounts without active orders.
• Auto-Delete After (Days) – define how many days after the Auto-Terminate stage an eligible unverified account should be closed. This option is applied only when Auto-Delete Unverified Accounts is enabled.

Important: Auto-Terminate actions are permanent and irreversible and may remove the client account together with all related WHMCS data. Carefully verify these settings before enabling them in a production environment.

Rate Limiting & Anti-Fraud

• Rate Limit: Max Attempts – define the maximum number of verification attempts allowed within the configured time window.
• Rate Limit: Window (Minutes) – define the rolling period used to count verification attempts.
• Auto-Ban After Failed Attempts – automatically block the email address and IP address after this number of failed attempts; enter 0 to disable automatic bans.
• Auto-Ban Window (Minutes) – define the rolling period used to count failed attempts for automatic bans.

Once the rate limit is reached, additional verification attempts are temporarily rejected. When the automatic ban threshold is reached, the related email address and IP address are added to the blocklist.

CAPTCHA

• CAPTCHA Enabled – require an additional CAPTCHA challenge on the verification and resend forms.
• CAPTCHA Provider – select one of the supported protection methods:
  • Built-in (arithmetic challenge) – uses a simple arithmetic question and requires no external account.
  • reCAPTCHA v3 – uses Google reCAPTCHA v3 and requires a site key and secret key.
  • Cloudflare Turnstile – uses Cloudflare Turnstile and requires a site key and secret key.

Additional fields appear after selecting an external provider:

• reCAPTCHA Site Key – the public key generated in the Google reCAPTCHA administration panel.
• reCAPTCHA Secret Key – the corresponding private key; it is not shared with the browser.
• reCAPTCHA Minimum Score – set a value between 0 and 1; lower scores indicate traffic that is more likely to be automated.
• Turnstile Site Key – the public key generated in the Cloudflare Turnstile dashboard.
• Turnstile Secret Key – the corresponding private key; it is not shared with the browser.

Logs

The Logs section records important operations performed by the module, including verification activity, email delivery, token generation, warnings and lifecycle cron execution.
Use the available search and status filters to locate an entry. Depending on the available action icons, you can view entry details or delete selected records.

Client Area

When verification is required, the client sees the Email Verification page with the address associated with the account. The exact form depends on the selected delivery and display settings. In the presented example, the module informs the client that a verification link has been sent and provides a Resend button if the message was not received or the previous link expired.

File:Anti-Fraud And Email Verification For WHMCS 8.png

The available verification flows are:

• Clickable Link – the client opens the link received by email to confirm the address.
• Code to Type In – the client enters the email address and verification code in the provided form.
• Inline Form – the required form is displayed directly on the verification page.
• Modal Popup – the client opens the required form in a modal window.

If CAPTCHA is enabled, the selected challenge is also displayed on the verification or resend form. After successful verification, the client may continue to the previously restricted Client Area page or complete the checkout process.

Tips

1. Test every enabled verification flow with a test client before applying restrictions to all clients.

2. Set a resend cooldown and reasonable rate limits to prevent repeated email requests without blocking legitimate clients too aggressively.

3. Review the Blocklist and Logs regularly to identify repeated failed attempts and remove entries that are no longer required.

4. Use account lifecycle automation cautiously. Begin with reminders and account inactivation before enabling permanent deletion.

Common Problems

Problem	Possible Cause	Solution
The client does not receive the verification email.	The WHMCS mail configuration is incorrect, the message was filtered as spam, or the resend cooldown is still active.	Check the module logs and WHMCS mail logs, confirm the mail configuration, ask the client to check the spam folder, and wait until the resend cooldown ends before trying again.
The verification link or code is rejected.	The verification data has expired, has already been used, or does not match the pending record.	Request a new verification email and make sure that the newest link or code is used before its configured validity period ends.
The client cannot request another verification email.	The configured resend cooldown or rate limit has been reached.	Wait for the configured time window to end or review the relevant limits in the module settings.
A legitimate client cannot complete verification.	The client's email address, email domain or IP address may be present on the blocklist, or an automatic ban may have been created.	Review the Blocklist and Logs. Remove the relevant entry only after confirming that the request is legitimate.
External CAPTCHA verification fails.	The site key, secret key or provider configuration is invalid.	Verify the credentials configured for the selected CAPTCHA provider and confirm that they are assigned to the correct WHMCS domain.