Verify emails on WordPress forms

Why WordPress accepts emails that bounce

WordPress core and every popular form plugin validate email with is_email(), which only checks that the string looks like an address. Nothing in the stack confirms the mailbox exists. So a spam bot or a mistyped signup sails through registration, WPForms, or Contact Form 7, and the confirmation, notification, or newsletter you send hard-bounces.

For membership sites and lead-gen forms this is a real cost: junk user accounts, unreachable leads sitting in your CRM, and a sending domain whose reputation slips every time a bounce lands. Disposable and role addresses (info@, admin@, sales@) are especially common on public WordPress forms and are exactly what you want to filter at submission time.

Verifly runs a live SMTP mailbox check and returns a deliverable / undeliverable / risky verdict with disposable, role, and catch-all flags. Since WordPress ships wp_remote_get, you can call Verifly from a single functions.php hook — no build step, no external SDK.

Add a reusable verification helper in functions.php

1. Grab a free Verifly key at verifly.email/api/v1/autonomous/register — 100 credits, no card, no captcha.
2. Define the key once (in wp-config.php as a constant so it stays out of your theme files).
3. Add a helper that calls Verifly with wp_remote_get and returns true only when the address is safe to accept.
4. Hook the helper into whichever form you use: registration_errors for native signup, wpforms_process for WPForms, or wpcf7_validate_email* for Contact Form 7.
5. Fail open on a request error so a verifier outage never breaks your forms.

// wp-config.php
define( 'VERIFLY_API_KEY', 'vf_your_api_key' );

// functions.php
function verifly_is_deliverable( $email ) {
    $res = wp_remote_get(
        add_query_arg( 'email', rawurlencode( $email ), 'https://verifly.email/api/v1/verify' ),
        array(
            'timeout' => 15,
            'headers' => array( 'Authorization' => 'Bearer ' . VERIFLY_API_KEY ),
        )
    );

    if ( is_wp_error( $res ) ) {
        return true; // fail open on a verifier outage
    }

    $data = json_decode( wp_remote_retrieve_body( $res ), true );
    if ( ! is_array( $data ) ) {
        return true;
    }

    return ! ( 'undeliverable' === ( $data['result'] ?? '' ) || ! empty( $data['disposable'] ) );
}

Gate registration and form plugins

With the helper in place, blocking a bad address is one hook per form. The registration_errors filter stops WordPress from creating the user. For WPForms and Contact Form 7 the pattern is the same idea — add a field error so the submission is refused and the visitor is asked for a real address.

// Native WordPress registration
add_filter( 'registration_errors', function ( $errors, $login, $email ) {
    if ( $email && ! verifly_is_deliverable( $email ) ) {
        $errors->add( 'verifly_email', 'Please use a real, deliverable email address.' );
    }
    return $errors;
}, 10, 3 );

// WPForms (validate the email field)
add_action( 'wpforms_process', function ( $fields, $entry, $form_data ) {
    foreach ( $fields as $id => $field ) {
        if ( 'email' === $field['type'] && ! verifly_is_deliverable( $field['value'] ) ) {
            wpforms()->process->errors[ $form_data['id'] ][ $id ] = 'Undeliverable email address.';
        }
    }
}, 10, 3 );

// Contact Form 7
add_filter( 'wpcf7_validate_email*', function ( $result, $tag ) {
    $email = isset( $_POST[ $tag->name ] ) ? sanitize_email( wp_unslash( $_POST[ $tag->name ] ) ) : '';
    if ( $email && ! verifly_is_deliverable( $email ) ) {
        $result->invalidate( $tag, 'Please enter a real, deliverable email address.' );
    }
    return $result;
}, 20, 2 );