Roughly 340 signups over two months, 145 of them never verified and therefore never got into the app at all. That number feels enormous.
My instinct is to drop verification entirely and let people in. But I assume there is a reason everyone has this wall, so before I rip it out - is 43% actually a UX number or is something else going on?
Assuming delivery checks out, the pattern that has worked well for me is a soft gate. Let them straight in and verify later. Block only the actions where an unverified address is genuinely a problem: sending mail on their behalf, inviting other people, anything touching money or public content. Everything else is open, with a small persistent banner and a resend button right there in the app.
Verification stops being a wall between a person and the thing they just signed up for, and becomes a nudge they hit at the moment it actually matters.
Slightly sceptical of the panic. 43% not clicking is largely 43% who signed up on impulse, closed the tab and moved on. Removing the wall converts curiosity into rows in your users table, not into customers, and then you get to feel worse about a different metric.
The number worth watching is not verification rate. It is what fraction of people reach your first real action, whatever that is. If dropping the wall raises that, keep it dropped. If it just inflates signups, you have made your dashboard prettier.
Right in general, and yet when I ran it the two moved differently. People reaching the first real action roughly doubled, while verified-and-active stayed flat. Read that as: the wall was also filtering out real people who intended to come back and could not find the email. Both effects existed at once.
If you are tempted by magic links, know what you inherit. They fold login and verification into one click, which is lovely, and they turn every email delivery problem into a login problem, which is not.
The specific one that will bite you: corporate mail security scanners follow links in incoming mail to check them, which pre-clicks your one-time login link and burns it. Then your best customer emails you saying the link is expired and they never even opened it. Allow the token to be used more than once inside a short window, or detect the scanner pattern, or you will get this ticket from exactly the accounts you least want to annoy.
Verify lazily, block only the dangerous actions, and put the resend button on the screen instead of expecting people to go hunting through their inbox.
Worth checking the billing side before you optimise anything: some auth providers only meter users who come back after the first day, so a wave of one-time signups who never return costs you nothing. If yours bills that way, the 145 are a psychological problem rather than a financial one, which changes how much energy this deserves.
@capsule_cora · 3w ago · 2 replies
Before touching the flow, confirm the mail is actually arriving. Auth stacks have surprisingly small default sending limits that nobody reads about until this exact moment - the built-in mailer on some hosted auth services is a couple of messages an hour and will only send to addresses on your own team, and even after you plug in your own SMTP there is typically a default cap in the tens of messages per hour that you have to raise manually in the settings. If you ever had a day with a spike, mail was silently dropped.
Go look at your sending provider's accepted, delivered, bounced and complained counts for those 340 addresses. If delivered is well under 340, this is a plumbing problem and no amount of button redesign fixes it.
Reply
Report
@colorgrade_cleo · 2w ago
And check the domain you are sending from. Mine had authentication set up on the marketing domain and nothing at all on the transactional subdomain the auth service used by default, so a big chunk of verification mail went straight to spam. I spent two weeks redesigning a button before I found a DNS record that did not exist.
Reply
Report