I'm looking for a method to keep users out of the wp_users table until they have confirmed their email address.
WordPress sends new users their password by email, which is a de facto email confirmation. But whether they confirm - and even if the email is fake - they are already added to the table. You can't distinguish those who have confirmed so they fill up your user table and provide confusion if someone later tries to register with that email (if they never got the email, or never responded, or someone else used their email address, etc.). I don't want unconfirmed users/emails in my wp_users table.
I'm looking for an approach that can either
- scrub unconfirmed accounts after say 48 hours, or better yet
- put them in an intermediate table until they confirm, then register them, and scrub entries after a 48 hour timeout
No basic plugin seems to do this. One plugin adds "unconfirmed_user_" to the beginning of the username until they confirm, then removes it, but this still leaves them in the user table, and doesn't remove them after a timeout.
BuddyPress does everything I want to do, but has a great deal of bloat, and many extra tables.
What approach would seem most elegant to achieve my goals? I'm thinking it would involve (at the minimum):
- an intermediate table with the username, email, generated key, and timestamp
- hooking in to the registration function and intercepting the signup, and stashing the user in the table (EDIT: or more simply, after native registration process, delete from the wp_users table and add them to signup table). Then email a confirmation with the key appended to a wp-login.php url
- intercepting logins with valid keys and deleting the entry and programmatically registering the user (essentially reversing step 2)
- running a cron function to delete signups after 48 hours
Is there a bloat-free plugin i missed that accomplishes this, and if not, does my approach sound right? What are the key hooks involved and have I missed any "gotchas" in my process?