Customer Email Verification Pro includes several independent layers of spam protection that run before the OTP is sent — disposable email blocking (with optional AI pattern matching), MX record validation, a B2B allowlist, a custom blocked-emails list, AI risk scoring, and bot-cluster detection. Each layer is a separate toggle, so you can enable only the ones you need.
How to Block Disposable / Temporary Emails?
The plugin ships with a built-in list of ~3,000 known disposable email providers (Mailinator, 10MinuteMail, GuerrillaMail, etc.). When this rule is on, sign-ups from any of those domains are rejected before an OTP is sent.
- Go to Settings → Spam Protection.
- Enable the toggle Block disposable / temporary emails.
- (Optional) Add extra domains to Additional blocked domains — one per line.
- (Optional) Add domains to Excluded domains to whitelist them even if they’re on the built-in list.
- Customize the rejection message shown to users.
- Click Save.
How to Catch Unknown Disposable Domains (AI Pattern Match)?
New temp-mail services appear faster than any static list can keep up with. The AI pattern match option sits inside the disposable block and inspects the shape of the domain instead of looking it up, so brand-new throwaway domains that aren’t on any list yet are still rejected — for example tempmail-new.xyz, trashbox24.info, or temp-box.io.
- Go to Settings → Spam Protection.
- Make sure Block disposable / temporary emails is ON — the pattern matcher lives inside that block.
- Enable the toggle Also catch unknown disposable domains (AI pattern match).
- Click Save.
The pattern matcher uses the same Disposable rejection message as the built-in list, so there is nothing extra to configure. Mainstream mailbox providers (Gmail, Outlook, Yahoo, iCloud, Proton, Zoho, and similar) are never flagged, and anything in your Excluded domains list always wins.
How to Validate MX Records?
The MX check confirms the email’s domain has a working mail server. This catches typos like @gmial.com, fake domains like @example.test, and dead inboxes — before sending an OTP that would never be delivered.
- Go to Settings → Spam Protection.
- Enable the toggle Validate email domain (MX check).
- Customize the MX rejection message if needed.
- Click Save.
How to Restrict Sign-ups to Specific Domains (B2B Mode)?
For B2B / corporate stores that should only accept sign-ups from approved company domains.
- Go to Settings → Spam Protection.
- Enable the toggle Restrict signups to specific domains (B2B mode).
- In Allowed domains, add the domains that are permitted to register — one per line. Wildcards supported (e.g. acme.com, *.partner.com).
- Customize the Allowlist rejection message.
- Click Save.
How to Block Specific Email Addresses?
For blocking individual bad actors by their exact email.
- Go to Settings → Spam Protection.
- Enable the toggle Block specific email addresses.
- Add full email addresses to Blocked email addresses — one per line, exact match (no wildcards).
- Customize the Blocked email rejection message.
- Click Save.
@spam.com), use the Additional blocked domains field inside the disposable section instead — it supports domain matching.
How to Enable AI Risk Scoring for Signups and Guest Checkout?
The rules above are yes/no gates: one bad trait and the sign-up is rejected. AI risk scoring works differently — it gives every registration and guest-checkout email a single score from 0 to 100, built from several weaker signals, and you decide what happens at each risk level. Because the signals are combined, no single ordinary trait can block a real customer — a block needs a genuinely risky combination.
Scoring runs entirely on your own server. There is no external service to sign up for, no API key, and no customer data ever leaves your site.
What the score is built from
| Signal | What it looks for |
|---|---|
| Random-looking mailbox | Keyboard-mash / machine-generated local parts such as xk29fjq8a@… |
| Unusual domain | A non-mainstream domain whose name looks randomly generated or throwaway-shaped |
| Role / plus address | Role mailboxes and plus-address abuse (admin+1@, info+promo@ and similar) |
| Many signups from one IP | Sign-up velocity — several different addresses submitted from the same IP in a short period |
Sensitivity and risk bands
Sensitivity sets the two score cutoffs that separate low, medium and high risk:
| Sensitivity | Medium risk from | High risk from |
|---|---|---|
| Low — only clearly risky signups | 55 | 85 |
| Balanced (recommended) | 40 | 70 |
| Strict — act on weaker combinations | 30 | 55 |
For each band you choose one of three actions: Allow, Require a one-time code, or Block. The defaults are a one-time code at medium risk and a block at high risk. Anything below the medium cutoff is always allowed through untouched.
- Go to Settings → Spam Protection.
- Enable the toggle AI spam & fraud risk scoring.
- Choose a Risk sensitivity — Low, Balanced (recommended), or Strict.
- Set At medium risk — Allow, Require a one-time code (default), or Block.
- Set At high risk — Allow, Require a one-time code, or Block (default).
- Customize the Risk block rejection message shown when a sign-up is blocked.
- Click Save.
Once scoring is on, the Risk column on Settings → Unverified Users → User List shows each entry’s score and the reasons behind it, and the Analytics tab gains an AI risk scoring card with the average score, how many sign-ups were scored, how many were blocked, and the top risk reasons for the period.
How to Enable Bot-Cluster Detection?
Risk scoring judges one email at a time. Bot-cluster detection looks at sign-ups as a group and spots the shape of a coordinated bot run — a burst of registrations that only looks suspicious when you see them together. Once a burst crosses the cluster size for your sensitivity, further sign-ups matching that cluster are blocked.
What counts as a cluster
| Pattern | What it looks for |
|---|---|
| Network + fingerprint flood | Many different emails from the same network block sharing an identical browser fingerprint — bots rotate IPs within a subnet but keep the same browser signature |
| Address enumeration | Sequential addresses on the same domain: john1@, john2@, john3@ and so on |
| Domain flood | A burst of sign-ups all landing on the same non-mainstream domain |
Sensitivity
Sensitivity decides how many matching sign-ups form a cluster before new ones are blocked. All counts are measured over a rolling ten-minute window:
| Sensitivity | Network + fingerprint | Address enumeration | Domain flood |
|---|---|---|---|
| Low — only large, obvious bursts | 8 | 5 | 10 |
| Balanced (recommended) | 5 | 4 | 6 |
| Strict — block on smaller clusters | 3 | 3 | 4 |
- Go to Settings → Spam Protection.
- Enable the toggle Bot signup-cluster detection.
- Choose a Cluster sensitivity — Low, Balanced (recommended), or Strict.
- Customize the Cluster block rejection message.
- Click Save.