I do not want to discuss the pros and cons of email validation, but want to know if there are potential downsides (security and otherwise) to user entering his password only after he has already validated his email address (clicked the activation link)?
9
-
1This should probably be asked at security.stackexchange.com If security is your main concern.– user31143Nov 2, 2015 at 8:24
-
The UX side would be about weighing up a possibly lower conversion rate due to slowing the sign up process down, against a possibly better quality of leads.– Stephen KeableNov 2, 2015 at 8:27
-
@StephenKeable Do you think that asking just for email address before email validation is slower? I would think that more people would be willing to sign up as there is only one input field.– HawkkenNov 2, 2015 at 8:39
-
@dan1111 Thanks for the suggestion, which I followed and got some useful responses.– HawkkenNov 2, 2015 at 10:28
-
1@Hawkken They did as we found people who performed requests using our API, convert better than those who didn't. The email verification acted as a barrier to that step for some.– Stephen KeableNov 2, 2015 at 15:13
|
Show 4 more comments
2 Answers
As you have already asked about the security concerns at security.stackexchange.com, I can give my opinion about the UX perspective:
Do you know any service where you register and it requires only a valid e-mail prior to filling your username/password/other data? I've never seen something like this. If you don't run a popular website, a few people (including me) will think:
Why just my e-mail address? This site don't want me to create an user account? Maybe they just want to know my e-mail address to spam me? Is this site real or a scam?
However, if your site is trustworthy, it can be a nice way to highlight that you really want the e-mail validation before allowing access to your website. If the user doesn't want to give his e-mail, they'll leave sooner and less frustrated since they did not waste their time filling 4 or 5 input fields.
Note: Requiring the e-mail to be valid before allowing access is not user friendly. Some people hate to give the correct e-mail to avoid spam messages when they want to just take a look to your site. Consider this constraint only if you really need the e-mail account to reduce anonymity or if you sell things on your website.
Reducing the number of fields on a form typically increases conversions, however you can go too far sometimes. A user will have an expected number of fields for task, if you are asking for just an e-mail address when an user expects name, email and password. They might not be sure it's the correct form or as Zanon mentions might think it is a scam.
Also as I mentioned in my comments, we (Allies Computing) used to require users validate their email address before being able to trial our API. We tried removing this and the trial usage of the API increased, as we had separately noted that people that tried the API converted higher than those that didn't. We then found this lead to an overall increase in conversion.
We still require that the e-mail address is validated before a purchase and have a small nag message until they validate their e-mail. However by this point the user is normally ok with this, as we need a contact point should anything go wrong with their account.
So unless you absolutely need a validated email address before a user can access anything, avoid it. Perhaps allow them limited access until they validate, I think twitter only requires a valid email to post a tweet, not setup your profile (been a while since I last went through their onboarding process).
