Prevent Orders & Full Client Area Access Until Email Verification (Secure WHMCS Anti-Spam System)

[Abisek]

Hello everyone,

I wanted to share a simple but effective security approach I implemented in WHMCS to reduce spam registrations and fake account abuse.

The idea is straightforward: users must verify their email before they can access any part of the client area or place orders.

---

Overview

If a user has not verified their email address, they are completely restricted from using the client area.

This includes blocking access to:

$blockedPages = [
"clientarea",
"services",
"invoices",
"domains",
"tickets",
"productdetails",
"upgrade",
"addons",
"downloads",
"supporttickets",
"serverstatus"
];

 

---

Access control behavior

When a user is not verified:

• They cannot access the dashboard
• They cannot view services
• They cannot access billing or invoices
• They cannot open or view support tickets
• They cannot use upgrades or addons

The only allowed access is the email verification flow.

---

Allowed page for unverified users

Unverified users are only allowed to access:

 

/user/profile

 

From this page they can:

• Resend the verification email
• Update their email address if needed
• Complete the verification process

---

User flow

1. User registers an account
2. Verification email is sent automatically
3. User logs in
4. System checks verification status
5. If not verified, all client area access is blocked
6. User is redirected to the profile page
7. After verification, full access is restored automatically

---

Purpose

The main goal of this system is to reduce spam accounts, fake registrations, and abuse of hosting resources.

It ensures that only verified users can interact with services, which significantly improves account quality and reduces unwanted usage.

---

Result

This approach helps:

• Reduce bot registrations
• Prevent disposable email abuse
• Improve security of client accounts
• Keep hosting resources clean
• Ensure only real users access services

 

EXAMPLE BELOW THIS IS HOW IT LOOKS,    

If anyone is interested, I can share the hook code for this implementation.

 

 

 

[Humanbeing]

Nice. Thanks for sharing!