Practical security / A clear next step
What a confirmation link actually proves
Email verification asks someone to open a message and follow a link or enter a code. Completing that step provides evidence that they can access the mailbox at that time. It does not prove their identity, that they represent a business or that their message is a genuine sales enquiry.
A spammer can use a working mailbox. Some automated systems can complete email verification too. The value is more specific: it can filter submissions that use addresses the sender cannot access and help catch typing mistakes before the business relies on the address.
Checking that an address has a valid format or that its domain can receive mail is a different check. Neither demonstrates that the sender can read that particular inbox.
Give every enquiry a clear status
A dependable flow should let both the visitor and the business understand what happened. “Message sent” is misleading if the enquiry is still waiting for a required confirmation.
- Received, awaiting confirmation
Where appropriate, retain the enquiry securely with a pending status and a defined retention period. Tell the visitor which address to check and how to correct a mistake.
- Address confirmed
Validate the confirmation on the server, mark it as used and update the same enquiry. Repeated clicks should not create duplicate leads or notifications.
- Ready for review
Make the verified enquiry visible to its owner. Keep spam classification and business qualification as separate decisions.
Give expired links, delivery failures and pending enquiries a recovery route. If confirmation is a requirement, explain it before the visitor leaves the page. Offer another appropriate contact route for someone who cannot complete it.
Protect the verification step itself
Confirmation messages can themselves become a source of abuse if an attacker repeatedly submits someone else’s address. Limit submissions and resend requests, monitor unusual patterns and avoid copying untrusted enquiry text into outgoing confirmation emails.
Use unpredictable tokens that expire and can only be used once. Keep token values out of analytics, ordinary logs and third-party resources on the confirmation page. Do not treat a browser-side success flag as proof of confirmation.
Email-security tools may inspect links before the recipient does. Account for link scanners when choosing how confirmation completes, for example with a clear confirmation action on the destination page.
Check what happens to genuine enquiries
Before adding a mandatory step, understand the current spam problem. A layered approach using server-side validation, sensible rate limits, a honeypot and proportionate bot checks may already provide enough protection.
If verification is introduced, compare the results over a representative period. Look at confirmation completion, delivery failures, genuine enquiries left pending and the amount of unwanted mail reaching the team. Use aggregate reporting and avoid collecting more personal information than the process needs.
The aim is a manageable enquiry queue with a clear follow-up path. Fewer notifications alone do not show success if real customers are also getting lost.
This connects with Eviri’s work on websites and integrations: every step needs a clear outcome, including when something fails.