I notice that I can signup for site membership without actually owning the email address provided. While a confirmation email is sent, clicking the link in the email does not confirm the address. You can simply sign into the site as soon as you are approved.
I can't find a way to require email verification. Am I missing something here?
I am trying to build a private site that has private info on it. If someone knows an email address of someone who is likely to be approved, they can simply gain access to the site with that email. This is highly insecure.
Am I missing something here?
It seems that the only solution is that the admin must manually contact each applicant by email to confirm the address.