Enable verification for a publisher
- Complete the Version 2.4.1 database upgrade before using these controls.
- Open Publisher Administration → Email Verification.
- Enable Require email verification for authors, Require email verification for reviewers and authors expressing reviewer interest, or both.
- Save the policy. Existing and newly created unverified accounts are subject to it immediately on their next journal request.
Both options default to disabled. Verification proves ownership of the current platform account address and is shared across journals. Enforcement applies only to journals under the selected publisher. Platform Administrators and the assigned Publisher Administrators retain their administrative access. An editorial account that also has an enforced author/reviewer role must verify that address.
User access and verification
An unverified user authenticates with their password and any configured authenticator first. When verification is required, the journal routes them to a verification screen instead of its dashboard. The restriction also covers submissions, reviews, files, profile actions and background saves. Where no other mandatory check applies, a publisher with optional verification disabled remains accessible according to normal role permissions. An unverified reviewer with an active editor-issued invitation is always required to confirm their email before accessing the journal dashboard and private review materials.
New self-registrations receive a verification email if the selected publisher policy applies. Existing users and invited reviewers can use Resend verification email after signing in. Enabling the policy does not trigger a bulk email to existing users.
- Choose Resend verification email to send a fresh link to the current or pending address.
- Open the latest email link and press Confirm email address. Merely opening the URL does not consume it; this avoids confirmation by automated email scanners.
- Sign in again when prompted. Email confirmation never signs in an account automatically or bypasses two-factor authentication.
Links expire after 60 minutes and can be used once. A newer request revokes older links. Resends are limited to one every two minutes and eight per hour per account, with additional IP and destination limits. Failed sends consume the request allowance to prevent repeated delivery abuse.
Change an email address
On My Account → Profile Details, both verified and unverified email addresses display the small Change Email ID button at the right side of the Email ID section. An unverified address displays an amber Not Verified badge and a Verify Email text link. A verified address displays a green Verified badge but no Verify Email link. The secure email-change form remains available on the separate email-verification page when explicitly opened. Enter the proposed address, current password and authenticator code when enabled. The new address remains pending and is not used for sign-in until verified. The current address receives a security notice.
After the new address is confirmed, the account email changes, the new address is marked verified, and existing sessions and password-reset links are invalidated. Use the new email and existing password to sign in. Cancel pending requests from the same screen. If a link expires, request another. Password changes and account deactivation invalidate outstanding confirmations.
Platform-initiated email edits also remain pending until the recipient confirms; administrators cannot silently mark a replacement address verified. Changes affect the shared identity across all journals. When the current address is already verified, an unconfirmed replacement does not remove normal access through the current address.
Journal templates and available syntax
Open Journal Settings → Templates → Email & Editorial Letter Templates. The verification templates use the existing journal email frame, including its header, footer and branding.
| Template key | Purpose |
|---|---|
| email_verification | Verify the current address. |
| email_change_verification | Confirm a proposed replacement address. |
| email_change_notice | Notify the current/previous address of a requested or completed change. |
| Placeholder | Meaning |
|---|---|
| {{user_name}}, {{author_name}}, {{reviewer_name}} | The account holder’s full name. |
| {{email}} | The address being verified, or the proposed/new address in a change notice. |
| {{current_email}} | The current/previous account address. |
| {{verification_link}} | The expiring confirmation URL; required in both verification bodies. |
| {{expiry_minutes}} | Link lifetime: 60 minutes. |
| {{journal_name}}, {{publisher_name}}, {{contact_email}} | Journal/publisher identity and support contact. |
| {{login_link}} | Journal sign-in link. |
| {{message}} | Security notice text; available for email_change_notice. |
The rich-text link tool accepts {{verification_link}} directly. Do not remove it from verification templates. The email frame supports {{content}} (required), {{journal_name}}, {{publisher_name}} and {{contact_email}}. Frame syntax and body syntax have different purposes. Profile changes without any journal membership use the platform’s default verification messages.
Email delivery and spam filtering
Application messages include a plain-text alternative, HTML content, UTF-8 transfer encoding, a Date and unique Message-ID, validated sender/recipient headers and an aligned envelope sender. Journal messages retain the configured platform or publisher sending identity; the journal contact is used as Reply-To.
- Use authenticated SMTP with TLS or SSL and an authorized From address. Unencrypted authenticated SMTP is rejected.
- Configure SPF for the actual sending service and enable DKIM signing in the hosting provider or email service.
- Publish DMARC with appropriate domain alignment, reviewing reports before moving to an enforcement policy.
- Have the hosting provider check forward/reverse DNS and sending-IP reputation. Monitor bounces and delivery failures.
- Test real deliveries to Gmail, Outlook and your institutional domain. Inspect Authentication-Results headers to confirm SPF/DKIM/DMARC pass.
PHP cannot guarantee inbox placement, generate valid DNS authorization without your domain settings, or override recipient spam filters. These are transactional messages; fabricated authentication headers are not added. Failed-message logs omit bodies and verification/reset links.
References: Google email sender guidelines and OWASP email verification guidance.
Country codes and phone fields
Registration, the shared profile, Platform Administration add/edit user screens, and Journal Administration user profiles offer a searchable country dropdown with local flag images, country names and calling codes. A native select remains available without JavaScript.
Select a country calling code and enter the national number. A complete international number beginning with + is accepted if its calling code matches the selected country. Keep significant leading zeros such as Italy’s. Saved numbers use an international +code format; the selected region is stored separately so shared codes can be displayed correctly. Existing unclassified phone values remain unchanged unless edited.
Number checks validate format and length, not whether a phone is active or can receive SMS. No SMS verification service is included. The PHP package has no npm, Python or remote flag-service dependency.
Upgrade and operation
Back up the database, configuration and uploads; upload the package preserving app/config.php and storage/; sign in as Platform Administrator; run /upgrade-v2.4.1.php; then delete that script from the server. Keep write traffic paused until the upgrade completes. The daily reminder task removes expired verification records after a short retention period.