UserCheck

0.3.2

Changed
– Tested with WordPress 7.0 and 7.1.

0.3.1

Fixed
– Updating from an older version could silently enable the fallback check for unsupported plugins, spending metered API requests outside signup flows — on user logins and outgoing email. This update turns the fallback off on all sites; if you rely on it, re-enable it under Settings → UserCheck → Coverage.
– Addresses on the site’s own domain — including its parent domains when WordPress runs on a subdomain — are never checked anymore, so outbound mail (SMTP plugins validating the From address on every message sent) no longer spends API requests.

Changed
– The fallback check is now off by default and must be explicitly enabled.
– When enabled, the fallback runs only during POST submissions, skips addresses that belong to existing users, and no longer duplicates checks for plugins that already have a native integration (e.g. WooCommerce, Contact Form 7).
– The fallback ignores login and password-reset flows entirely — a failed login attempt with an unknown address no longer spends an API request.

0.3.0

Added
– Cache successful UserCheck API responses for 1 hour. Repeat lookups for the same email (or domain, in domain mode) skip the network call. Drops API traffic by orders of magnitude on busy sites.
– “Clear cache” button under Settings → UserCheck → Cache for manual invalidation between TTLs.

0.2.1

Added
– The HTTP User-Agent on UserCheck API requests now includes an integration=<slug> token identifying which signup surface triggered the check (e.g. wp_registration, wc_checkout, pb_registration, fallback_is_email). Lets the UserCheck team see traffic-mix per integration. No end-user data is added to the UA. See Privacy Policy.
– When the is_email() fallback fires, the UA reports the unsupported plugin that called is_email() as integration=fallback_is_email/<plugin-slug> — helps prioritize which plugins need native integrations next. Plain fallback_is_email is reported when no plugin caller can be identified (themes, mu-plugins, WP core, custom code). Disable the fallback under Settings → UserCheck → Coverage to opt out.
– evaluate_email() gained an optional second argument $source for third-party callers that want their integration attributed in the UA. Calls using the prior single-argument shape are unchanged.

0.2.0

Changed
– Replaced the global is_email filter with surface-specific hooks. The plugin now only checks emails when users submit them (registration, comments, WooCommerce checkout/account creation) and no longer re-validates existing users or orders. Fixes 502 errors on order pages caused by repeated synchronous API calls.
– Reduced API request timeout from the WordPress default (5s) to 2s.

Added
– Settings to choose which signals block sign-ups (invalid MX, disposable, public email providers, relay/forwarding, spam).
– Domains on your custom UserCheck blocklist are always blocked when present — no opt-in needed.
– Settings to choose whether to send the full email (more accurate) or just the domain (cheaper). New installs default to full-email; upgrades from 0.1.x keep domain-only.
– WooCommerce integrations (auto-enabled when WooCommerce is active): classic checkout (woocommerce_after_checkout_validation), Cart/Checkout Block (woocommerce_store_api_checkout_order_processed), account registration, and Edit-account email change (woocommerce_save_account_details_errors).
– Profile Builder (free + Pro) registration integration (auto-enabled when Profile Builder is active).
– Multisite signup integration.
– Contact Form 7 integration (auto-enabled when CF7 is active). Hooks wpcf7_validate_email and wpcf7_validate_email*.
– WPForms integration (auto-enabled when WPForms is active). Hooks wpforms_process_validate_email.
– Elementor Pro Forms integration (auto-enabled when Elementor Pro is active). Hooks elementor_pro/forms/validation/email.
– Gravity Forms integration (auto-enabled when GF is active). Hooks gform_field_validation for email-type fields.
– Fluent Forms integration (auto-enabled when Fluent is active). Hooks fluentform/validate_input_item_input_email.
– Ninja Forms integration (auto-enabled when NF is active). Hooks ninja_forms_submit_data and walks email-type fields.
– Formidable Forms integration (auto-enabled when Formidable is active). Hooks frm_validate_field_entry (covers fields inside repeater rows).
– MailPoet integration (auto-enabled when MailPoet is active). Hooks mailpoet_subscription_before_subscribe.
– Public extension API: developers can call UserCheck::instance()->evaluate_email( $email ) from any hook to integrate UserCheck with plugins that don’t have a built-in or aren’t covered by the is_email() fallback. Returns array{action, reason, message} with action being allow or block.
– usercheck_block_message filter so developers can override the user-facing block message per signal. See the FAQ for a usage example.
– is_email() fallback for plugins without a native integration (Settings → UserCheck → Coverage). On by default — preserves the unconditional is_email coverage that existed pre-0.2.0; opt out from the Coverage section. Covers front-end submissions including AJAX (wpDiscuz, AJAX-submitted CF7/Elementor) and REST; admin page-loads, cron, and WP-CLI are excluded so the v0.1 502 regression on WC order pages stays fixed.
– WP profile email-change coverage (user_profile_update_errors) and REST comment submission coverage (rest_pre_insert_comment).
– Per-request deduplication: the same email evaluated multiple times in one request now triggers a single API call.
– Existing API keys are migrated automatically to the new settings format.

0.1.1

Fixed
– Skip validation for WordPress system emails