I need to know if it is safe to use user_activation_key (from WP_User) for other purpose like email verification (a functionality that I would be creating that would send an email verification first before activating the account created)?

So here's how things will work. A user will register using my custom registration form which will be available only on front-end. Upon successful registration, the user will be notified via email that the account has been created along the activation link that is created upon registration using the following convention:


Do you think this will be safe?

2 Answers 2


Do you think this will be safe?

Maybe. Two issues.

You also need to make sure the key isn't guessable. No incrementing numbers. You can use something like wp_generate_password to get some psuedo random characters. Use a random "salt" plus the user's email and sign up time or uniqid and you stand a pretty good chance of ensuring uniqueness (see below) and creating a non-guessable key.

$user_email = some_function_to_get_user_email();
$salt = wp_generate_password(20); // 20 character "random" string
$key = sha1($salt . $user_email . uniqid(time(), true));

You'll also need to ensure the uniqueness of the key: there's shouldn't be any collisions.

There's no constraints on on the user_activation_key column in the database that ensure uniqueness, so it's up to your app (eg. WordPress and the PHP side of things) to make sure it is. In other words, either before or after you generate the key make sure it doesn't exist already in the database. Simple, untested example:

$key = some_function_that_generates_a_key();
$res = $wpdb->get_col($wpdb->prepare("SELECT EXISTS(SELECT 1 FROM {$wpdb->users} WHERE user_activation_key = %s)", $key));
if ($res) {
    // the key exists, try again!
} else {
    // good to go.

If you need a guide, trying looking at how WordPress does password reset emails. The process is the same: generate a non-guessable key, make sure it's unique, insert into the database with the corresponding user, then send them an email with a link to reset the password.

  • Thank you for that wonderful answer. (I know the reply was late haha! But this one is really useful.)
    – mcometa
    Sep 18, 2013 at 9:14
  • Or if you don't want to bother about collision simply pass the user id in the verification request as well
    – Tofandel
    Feb 24, 2019 at 16:03

No it is not safe, because anyone use this. but if you can you give your email id then it is refer you to a specific activation key or number then it is safe

  • Hi @Ajay, I edited my question for more complete details. Please check again as I didn't understand what you meant by "anyone use this".
    – mcometa
    Oct 28, 2012 at 9:05
  • I think what he means is it needs to be made more specific to the user whose activation key it is. This will stop individuals using brute force methods to gain access to someone else's account.
    – Ollie
    Oct 28, 2012 at 12:20
  • @Ollie I made it sure that the activation key is sent to the email address of the user trying to register. Also the activation key contains hashed value of the username, password and timestamp. Am I doing the right thing? Kind of new to these stuff with Wordpress.
    – mcometa
    Oct 28, 2012 at 13:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.