WooCommerce – Customer Email Verification 3.0.5

Improved

• Tested with WooCommerce 11.1.2
• Tested with WordPress 7.1.2

Fixed

• Smart Form registration now runs WooCommerce's own registration checks before the verification code is sent, so problems such as an email address already being in use are reported immediately instead of after the customer has entered their code.
• Custom fields added to the Smart Form registration are now available to WooCommerce and other plugins while the account is being created, so values such as phone or company are stored against the new account correctly.
• Customers are now returned to the page they originally requested after signing in or registering through the Smart Form, instead of always being sent to the account page.
• Checkout verification now re-checks the live cart when the order is submitted, so items added after a code was verified are taken into account.
• The email-change verification on the Edit Account page now uses its own dedicated code, so it can only be completed with a code issued for that change.
• Customers who use up their login verification attempts are still required to verify before they can reach the rest of their account pages.
• Signing in with an emailed or texted code now also asks for the Authenticator App code when two-factor authentication is enabled on the account.

Improved

• Replaced deprecated WooCommerce cart properties with their supported accessors, preserving tax-inclusive subtotals on tax-enabled stores.
• Corrected the registration type of three hooks (pre_get_users, block_categories_all, woocommerce_form_field) to match WordPress and WooCommerce.
• Resolved all findings from the WooCommerce marketplace static-analysis (Quality Insights) audit.
• Tested with WooCommerce 11.0.1
• Tested with WordPress 7.1

Fixed

• Store staff are no longer blocked at checkout. Administrators, editors and shop managers are now exempt from checkout email verification, so they can place test orders without being held behind the verification popup.
• The [cev_smart_form] shortcode no longer renders the login/register form to visitors who are already signed in.
• Corrected the template path used by the front-end popup preview, which stopped the preview from loading.
• Removed a duplicate key in the checkout script data that could override the resend countdown text.

New

• Added AI detection of disposable/throwaway email addresses. Beyond the built-in domain list, it flags brand-new temp-mail domains and abusive patterns (random mailboxes, plus-address abuse) and lets you review and add them to your block list in one click, so spam protection stays current automatically.
• Added bot-cluster detection. When many signups arrive in a short burst sharing the same device fingerprint and network, the Unverified Users screen flags the cluster and lets you block and delete the whole group in one click — stopping coordinated bot attacks that per-user rules miss.
• Added AI risk scoring for registrations and guest checkout. Each signup/order is scored from multiple signals (disposable/gibberish email patterns, IP/ASN reputation, signup velocity, device reuse) and the merchant chooses what happens at each risk level — allow, require a one-time code, or block — with a Low/Balanced/Strict sensitivity. A new Risk column on the Unverified Users screen shows the score and reasons.
• Added a "Require OTP on every login" option in Login Authentication.

Improved

• Tested with WooCommerce 11.0.1
• Tested with WordPress 7.0.4

New

• Login method now supports multiple sign-in options at once. Enable any combination of Password, Email OTP, and Phone OTP on the Smart Form login (single-select is no longer required).
• Added a password strength setting for the Smart Form registration. Choose to require a strong password (upper and lower case, a number, and a symbol) or a simpler minimum-length rule, with a configurable minimum length.

Improved

• Redesigned all customer-facing verification popups with a unified, professional design. Registration, login, account verification, checkout, edit-account and 2FA screens now share one modern visual language, with popup customizer settings applying consistently across every surface plus new Border Radius, Elevation, Accent Color, Font Family and Overlay Opacity options.
• Added the missing "Lost your password?" link to the Smart Form login (password sign-in method).
• Tested with WooCommerce 10.9.4
• Tested with WordPress 7.0.2

New

• Added Paid-Order Gatekeeping option. When enabled, verified users remain in a restricted "pending paid order" state until their first WooCommerce order completes — preventing welcome-coupon abuse and stopping bot accounts from receiving promotional emails before they've bought anything. Includes new Verified column state, admin bulk override, and analytics tracking.
• Added "Force re-verify all customers" admin tool to mark every existing unverified user as unverified in a single action. Combined with the Login Authentication popup, this lets stores clean up legacy accounts after a spam attack or post-install. Available as a Tools-page button and as a WP Users list bulk action. Background-batched via Action Scheduler for large sites.
• Added Cart-Total Threshold Verification. Merchants can now configure OTP verification to trigger only when the cart subtotal or total exceeds a specified amount. Combines with Category-Specific Verification via OR logic. Multi-currency stores are normalised to the store base currency for comparison.
• Added Polylang compatibility alongside existing WPML support. All verification emails, popup messages, and admin notices are now translatable via Polylang's String Translations panel and delivered in the customer's preferred language.
• Added Smart Form — a unified, brand-customizable login/register form for the My Account page and any post or page via the [cev_smart_form] shortcode, with brand title, color, and panel customization.
• Added 4 ready-made Smart Form template layouts. Switch between layouts from the admin without touching code; each layout is fully responsive and inherits the customizer brand settings.
• Added flexible login + registration modes to Smart Form. Switch login between password and email OTP, and let customers register with either email or phone — all with built-in OTP verification.
• Added optional My Account takeover. When enabled, Smart Form replaces WooCommerce's default form-login.php on /my-account/ so the same branded login/register experience runs across the storefront.

Improved

• Redesigned the entire admin experience with the new Zorem UI design system (ZUI). Every screen — Settings, Unverified Users, Maintenance, Analytics, the Email Customizer, and the 2FA setup card — now shares a unified visual language: consistent typography, cards, sidebar navigation, table cells with avatars, snackbar toasts, confirmation modals, and inline tooltips. The same design language is shared across the wider Zorem plugin family for a familiar, polished merchant experience.
• Tested with WooCommerce 10.8.1
• Tested with WordPress 7.0