Answers.Body: <p>Your question is rather complex, so this answer only addresses the registration issue. It might be better to start a new question for the other issues you face.</p>
  
  <p>You can use <a href="https://wordpress.org/plugins/buddypress/" rel="nofollow noreferrer">BuddyPress</a> for user registration - in conjunction with <a href="https://wordpress.org/plugins/bp-xprofile-wp-user-sync/" rel="nofollow noreferrer">BP XProfile WordPress User Sync</a> and <a href="https://wordpress.org/plugins/civicrm-wp-profile-sync/" rel="nofollow noreferrer">CiviCRM WordPress Profile Sync</a>. The registration form will have "First Name" and "Last Name" fields which will be synced to both WordPress and CiviCRM.</p>
  
  <p>I'd recommend using the GitHub version of BP XProfile WordPress User Sync because there are limitations in BuddyPress which make auto-updating problematic. You'll find the relevant info on the plugin's page.</p>
  
  <p>In order to capture additional data, you can use BuddyPress xProfile fields for this. There are hooks in both plugins which will allow you to sync the content of a BuddyPress field to the appropriate CiviCRM field.</p>
  
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-03T17:42:40.403Z
Answers.Text: This stuff is interesting, passed it on to our other people so they can see it, too. But this doesn't seem to fix my fundamental problem - I don't want people to be able to do anything until they *prove* they own the mailbox they're using to register. The environment we work in will always have some degree of trolling, being able to sign up any email and start doing stuff would quickly be found and abused.
Answers.UserDisplayName: Ray
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-04T09:57:34.703Z
Answers.Text: BuddyPress Registration Options https://wordpress.org/plugins/bp-registration-options/ holds new signups for moderation.
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-04T14:49:09.313Z
Answers.Text: Not sure if useful, but maybe there is a way an extension could validate that there is a valid SPF record for the domain that is being added. Still might not help deal with troll accounts, but even using one of those email validator services (they check that a box actually exists, not just that format if valid) might be helpful. Something like http://verifalia.com/validate-email (not a recommendation, just a quick google search result). Still, anyone can create a real gmail account for trolling purposes. So, just some thoughts, but not really a solution I guess.
Answers.UserDisplayName: Randy Tobias
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-04T17:20:41.923Z
Answers.Text: Reading about BuddyPress has been helpful - have an associate who has used it, we're debating if it fits in what we're doing. The troll account problem is this: both completely fake registrations for non-existent emails, and unvalidated registrations for people who do not wish to participate. We know how rough political advocacy & campaigns get, we're trying to solve for that before we add our first live users.
Answers.UserDisplayName: Ray
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-04T18:12:50.257Z
Answers.Text: regarding: BP XProfile WordPress User Sync - we don't care if people use aliases, I think that's something we'd actually encourage. This plugin looks like it adds some admin overhead. Is there any reason I shouldn't just ignore this and stick to BuddyPress/BP XProfile WordPress User Sync?
Answers.UserDisplayName: Ray
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-05T11:02:31.820Z
Answers.Text: Not knowing your precise circumstances makes it hard to offer more advice. It sounds like you need to test the various options in your particular scenario. Good luck!
Answers.UserDisplayName: Christian Wach
Answers.ContentLicense: CC BY-SA 3.0
Answers.CreationDate: 2017-05-03T09:57:04.783Z
Answers.LastActivityDate: 2017-05-03T09:57:04.783Z
Answers.UserDisplayName: Christian Wach
Body: <p>We are offering CiviCRM to Indivisible working groups and we have a concern that the unauthenticated registrations are going to be a problem. We're pretty sure that the ability to create an account without responding to an opt-in email will get targeted by trolls, since this movement is focused on very contentious political issues.</p>
  
  <p>Our platform is cPanel/WHM, Wordpress, and CiviCRM. We're pretty familiar with Wordpress and want it for the public dialog features it offers. We would not consider a switch to Drupal. We own the cloud provider we use, we're familiar with DNS, email, Linux, MySQL administration, PHP development, etc.</p>
  
  <p>We have tried Wordpress registration that triggers a Civi Contact creation and this does work, but it's terribly clumsy. The only benefit is that this does require email opt-in.</p>
  
  <p>We are told that the right way to do things would be something like this:</p>
  
  <ol>
  <li><p>accept sign ups, collect some additional custom data, and include a radio button choice - such as male/female/other.</p></li>
  <li><p>Use a cron job to sweep all males, females, and others into a group that requires email opt-in.</p></li>
  </ol>
  
  <p>We've got a CiviTeacher subscription, we've gone through a bunch of the material, but it isn't at all clear how we'd automate this. Do we need some sort of cron job to sweep the new registrations into a group?</p>
  
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-04-27T08:50:20.873Z
Comments.Text: Can you clarify how WordPress registration is "clumsy"?
Comments.UserDisplayName: Christian Wach
Comments.ContentLicense: CC BY-SA 3.0
Comments.CreationDate: 2017-04-28T18:16:24.037Z
Comments.Text: WP reg only gets a user ID and email. We want to capture names, maybe cell phone number, etc. It's just not the appropriate path to populating contact records.
Comments.UserDisplayName: Ray
Tags: <wordpress><user-account><validation>
Title: Validating emails of new CiviCRM accounts?
ThreadText: # Validating emails of new CiviCRM accounts?
  
  (Asked by: username_0 on 2017-04-26)
  
  We are offering CiviCRM to Indivisible working groups and we have a concern that the unauthenticated registrations are going to be a problem. We're pretty sure that the ability to create an account without responding to an opt-in email will get targeted by trolls, since this movement is focused on very contentious political issues.
  
  Our platform is cPanel/WHM, Wordpress, and CiviCRM. We're pretty familiar with Wordpress and want it for the public dialog features it offers. We would not consider a switch to Drupal. We own the cloud provider we use, we're familiar with DNS, email, Linux, MySQL administration, PHP development, etc.
  
  We have tried Wordpress registration that triggers a Civi Contact creation and this does work, but it's terribly clumsy. The only benefit is that this does require email opt-in.
  
  We are told that the right way to do things would be something like this:
  
  1. accept sign ups, collect some additional custom data, and include a radio button choice - such as male/female/other.
  2. Use a cron job to sweep all males, females, and others into a group that requires email opt-in.
  
  We've got a CiviTeacher subscription, we've gone through a bunch of the material, but it isn't at all clear how we'd automate this. Do we need some sort of cron job to sweep the new registrations into a group?
  
  **Tags:** wordpress, user-account, validation
  
  > **Comments:**
  > **username_1**: Can you clarify how WordPress registration is "clumsy"?  
  > **username_0**: WP reg only gets a user ID and email. We want to capture names, maybe cell phone number, etc. It's just not the appropriate path to populating contact records.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-05-03. Score: 2
  
  Your question is rather complex, so this answer only addresses the registration issue. It might be better to start a new question for the other issues you face.
  
  You can use [BuddyPress](https://wordpress.org/plugins/buddypress/) for user registration - in conjunction with [BP XProfile WordPress User Sync](https://wordpress.org/plugins/bp-xprofile-wp-user-sync/) and [CiviCRM WordPress Profile Sync](https://wordpress.org/plugins/civicrm-wp-profile-sync/). The registration form will have "First Name" and "Last Name" fields which will be synced to both WordPress and CiviCRM.
  
  I'd recommend using the GitHub version of BP XProfile WordPress User Sync because there are limitations in BuddyPress which make auto-updating problematic. You'll find the relevant info on the plugin's page.
  
  In order to capture additional data, you can use BuddyPress xProfile fields for this. There are hooks in both plugins which will allow you to sync the content of a BuddyPress field to the appropriate CiviCRM field.
  
  > **Comments:**
  > **username_0**: This stuff is interesting, passed it on to our other people so they can see it, too. But this doesn't seem to fix my fundamental problem - I don't want people to be able to do anything until they *prove* they own the mailbox they're using to register. The environment we work in will always have some degree of trolling, being able to sign up any email and start doing stuff would quickly be found and abused.  
  > **username_1**: BuddyPress Registration Options https://wordpress.org/plugins/bp-registration-options/ holds new signups for moderation.  
  > **username_2**: Not sure if useful, but maybe there is a way an extension could validate that there is a valid SPF record for the domain that is being added. Still might not help deal with troll accounts, but even using one of those email validator services (they check that a box actually exists, not just that format if valid) might be helpful. Something like http://verifalia.com/validate-email (not a recommendation, just a quick google search result). Still, anyone can create a real gmail account for trolling purposes. So, just some thoughts, but not really a solution I guess.  
  > **username_0**: Reading about BuddyPress has been helpful - have an associate who has used it, we're debating if it fits in what we're doing. The troll account problem is this: both completely fake registrations for non-existent emails, and unvalidated registrations for people who do not wish to participate. We know how rough political advocacy & campaigns get, we're trying to solve for that before we add our first live users.  
  > **username_0**: regarding: BP XProfile WordPress User Sync - we don't care if people use aliases, I think that's something we'd actually encourage. This plugin looks like it adds some admin overhead. Is there any reason I shouldn't just ignore this and stick to BuddyPress/BP XProfile WordPress User Sync?  
  > **username_1**: Not knowing your precise circumstances makes it hard to offer more advice. It sounds like you need to test the various options in your particular scenario. Good luck!  
  
  ---
  
  